Edit tour

Windows Analysis Report
5kplayer-setup.exe

Overview

General Information

Sample name:	5kplayer-setup.exe
Analysis ID:	1428528
MD5:	0cb8a509b925197bd4b94b4c835c8db9
SHA1:	b741c00855307aa3a8a3c52c651c2c8d969a4f78
SHA256:	02b4b6cd3a3a78cc764cb0ad573a9bce3ab0f1681d5e6926c9501e0ebcd7bbbb
Infos:

Detection

Score:	3
Range:	0 - 100
Whitelisted:	false
Confidence:	0%

Signatures

Checks if the current process is being debugged

Drops PE files

Found dropped PE file which has not been started or loaded

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Classification

Analysis Advice

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Sample searches for specific file, try point organization specific fake files to the analysis machine

Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis

Sample crashes during execution, try analyze it on another analysis machine

Process Tree

System is w10x64_ra

5kplayer-setup.exe (PID: 7036 cmdline: "C:\Users\user\Desktop\5kplayer-setup.exe" MD5: 0CB8A509B925197BD4B94B4C835C8DB9)

5kp.exe (PID: 1696 cmdline: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe MD5: 3E71A7C07BB5BD316F64768D21971CFC)

WerFault.exe (PID: 4712 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 6416 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: 5kplayer-setup.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 5kplayer-setup.exe

Static PE information: certificate valid

Source: unknown

HTTPS traffic detected: 67.228.121.196:443 -> 192.168.2.16:49704 version: TLS 1.2

Source: 5kplayer-setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\5kplayer-setup.exe	File opened: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe
Source: C:\Users\user\Desktop\5kplayer-setup.exe	File opened: C:\Users\user\AppData\Local\
Source: C:\Users\user\Desktop\5kplayer-setup.exe	File opened: C:\Users\user\AppData\
Source: C:\Users\user\Desktop\5kplayer-setup.exe	File opened: C:\Users\user\
Source: C:\Users\user\Desktop\5kplayer-setup.exe	File opened: C:\Users\user\AppData\Local\Temp\5kplayer\
Source: C:\Users\user\Desktop\5kplayer-setup.exe	File opened: C:\Users\user\AppData\Local\Temp\

Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com
Source: global traffic	HTTP traffic detected: HEAD /download/5kplayer-64bit.exe HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: dl1.5kplayer.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: www.5kplayer.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:52 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:52 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:52 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:52 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:52 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:52 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:52 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:53 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:53 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:53 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:53 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:53 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:53 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:53 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:53 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:53 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:54 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:54 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:54 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:54 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:54 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:54 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:54 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:54 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:54 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:55 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:55 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:55 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:55 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:55 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:55 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:55 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:55 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:55 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:55 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:56 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:56 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:56 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:56 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:56 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:56 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:56 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:56 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:56 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:57 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:57 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:57 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:57 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:57 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:57 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:57 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:57 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:57 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:58 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:58 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:58 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:58 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:58 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:58 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:58 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:58 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:58 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:59 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:59 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:59 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:59 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:59 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:59 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:59 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:59 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:59 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:25:59 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:00 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:00 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:00 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:00 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:00 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:00 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:00 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:00 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:00 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:01 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:01 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:01 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:01 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:01 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:01 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:01 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:01 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:01 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:02 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:02 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:02 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:02 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:02 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:02 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:02 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:02 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:02 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:03 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:03 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:03 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:03 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:03 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:03 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:03 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:03 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:03 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:04 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:04 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:04 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:04 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:04 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:04 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:04 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:04 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:04 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:05 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:05 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:05 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:05 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:05 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:05 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:05 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:05 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:05 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:06 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:06 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:06 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:06 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:06 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:06 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:06 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:06 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:06 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:07 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:07 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:07 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:07 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:07 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:07 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:07 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:07 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 04:26:07 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown

HTTPS traffic detected: 67.228.121.196:443 -> 192.168.2.16:49704 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 6416

Source: 5kplayer-setup.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 5kplayer-setup.exe

Static PE information: Section: .reloc ZLIB complexity 1.002685546875

Source: classification engine

Classification label: clean3.winEXE@4/9@2/21

Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

File created: C:\Users\user\AppData\Roaming\Digiarty

Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Mutant created: \Sessions\1\BaseNamedObjects\5KPlayer - Online
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1696

Source: C:\Users\user\Desktop\5kplayer-setup.exe

File created: C:\Users\user\AppData\Local\Temp\nsc854C.tmp

Source: 5kplayer-setup.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\5kplayer-setup.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\5kplayer-setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\user\Desktop\5kplayer-setup.exe

File read: C:\Users\user\Desktop\5kplayer-setup.exe

Source: unknown	Process created: C:\Users\user\Desktop\5kplayer-setup.exe "C:\Users\user\Desktop\5kplayer-setup.exe"
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process created: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process created: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 6416

Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: acgenral.dll
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: winmm.dll
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: samcli.dll
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: msacm32.dll
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: version.dll
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: userenv.dll
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: mpr.dll
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: aclayers.dll
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: sfc.dll
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: shfolder.dll
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: acgenral.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: samcli.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: msacm32.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: aclayers.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: wintab32.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: wlanapi.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: csunsapi.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: swift.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: nfhwcrhk.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: surewarehook.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: dataexchange.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: dcomp.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: twinapi.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: aep.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: atasi.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: swift.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: nfhwcrhk.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: nuronssl.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: surewarehook.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: ubsec.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: csunsapi.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: aep.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: atasi.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: swift.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: nfhwcrhk.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: nuronssl.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: surewarehook.dll
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: ubsec.dll

Source: C:\Users\user\Desktop\5kplayer-setup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Source: 5kplayer-setup.exe

Static PE information: certificate valid

Source: 5kplayer-setup.exe

Static file information: File size 7270888 > 1048576

Source: 5kplayer-setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\5kplayer-setup.exe	File created: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe			Jump to dropped file
Source: C:\Users\user\Desktop\5kplayer-setup.exe	File created: C:\Users\user\AppData\Local\Temp\nss8647.tmp\nsis7zU.dll			Jump to dropped file

Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\5kplayer-setup.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nss8647.tmp\nsis7zU.dll

Jump to dropped file

Source: C:\Users\user\Desktop\5kplayer-setup.exe	File opened: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe
Source: C:\Users\user\Desktop\5kplayer-setup.exe	File opened: C:\Users\user\AppData\Local\
Source: C:\Users\user\Desktop\5kplayer-setup.exe	File opened: C:\Users\user\AppData\
Source: C:\Users\user\Desktop\5kplayer-setup.exe	File opened: C:\Users\user\
Source: C:\Users\user\Desktop\5kplayer-setup.exe	File opened: C:\Users\user\AppData\Local\Temp\5kplayer\
Source: C:\Users\user\Desktop\5kplayer-setup.exe	File opened: C:\Users\user\AppData\Local\Temp\

Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Process information queried: ProcessInformation

Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Process queried: DebugPort

Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Software Packing	NTDS	2 File and Directory Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Source	Detection	Scanner	Label	Link
5kplayer-setup.exe	3%	ReversingLabs
5kplayer-setup.exe	1%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\nss8647.tmp\nsis7zU.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nss8647.tmp\nsis7zU.dll	0%	Virustotal	Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.5kplayer.com	67.228.121.196	true	false		high
dl1.5kplayer.com	67.228.121.193	true	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.89.179.12	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
67.228.121.196	www.5kplayer.com	United States	36351	SOFTLAYERUS	false
67.228.121.193	dl1.5kplayer.com	United States	36351	SOFTLAYERUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428528
Start date and time:	2024-04-19 06:25:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	5kplayer-setup.exe
Detection:	CLEAN
Classification:	clean3.winEXE@4/9@2/21
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.89.179.12
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_5kp.exe_3b92e18cc83f109fc4ff47897356e7efcb1d37ba_f76daea9_1e85dae6-22fa-41a1-80c6-96351ecc220e\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	65536
Entropy (8bit):	1.1631376821520518
Encrypted:	false
SSDEEP:
MD5:	FE76A5B4E2BC1F95C8AD0684E309FADA
SHA1:	CA14BB62FFB449427929EC909AC79D19F00FFA36
SHA-256:	604F8CE533EAA6E87A901320839C3E120E21BCC560AA7321FC94C7D19A01B3B3
SHA-512:	333FA762A48BBC4035B46F8F1216F79264FEDBF8137ACB70BF73C9791885043F0F240BA370FA46B7212340FE2CBE3C589975961FB1E746F95C23F91FCC35AE3C
Malicious:	false
Reputation:	unknown
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.7.9.7.4.3.6.7.9.4.1.6.3.9.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.7.9.7.4.3.7.5.5.4.1.6.6.7.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.e.8.5.d.a.e.6.-.2.2.f.a.-.4.1.a.1.-.8.0.c.6.-.9.6.3.5.1.e.c.c.2.2.0.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.d.e.2.b.0.8.4.-.9.3.4.a.-.4.d.e.a.-.a.f.5.f.-.a.0.4.b.5.e.e.8.5.c.5.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.5.k.p...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.5.k.p.l.a.y.e.r...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.6.a.0.-.0.0.0.1.-.0.0.1.6.-.2.1.b.3.-.4.1.a.1.1.1.9.2.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.3.1.9.c.b.8.3.8.f.0.d.a.b.a.6.1.3.2.3.5.5.1.f.c.4.3.c.c.b.c.f.0.0.0.0.0.9.0.4.!.0.0.0.0.a.b.3.e.c.2.9.6.5.f.4.d.5.7.6.1.f.b.a.0.a.c.d.e.7.8.f.d.7.2.a.c.2.8.9.3.5.4.c.6.!.5.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER21FB.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8284
Entropy (8bit):	3.689370229626464
Encrypted:	false
SSDEEP:
MD5:	62A43700E5533F3187F667CA148672FA
SHA1:	462FB01C935C6092DC1E44C6030D3DFE25C2CD48
SHA-256:	086D24E478D965B04D19060EBE808B9E2EBF11D2A5C02447F8E470A028C5DA63
SHA-512:	43E74AE38B31097C244050C16711F5735DBB025723F9EE11206EFE6AACB2E6DE605A0C3B1DDC46AE2651B702B90C8C6E252351CCC0B7D8F4C3A9EAFB0BEE7E15
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.6.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER221B.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4599
Entropy (8bit):	4.437007169868832
Encrypted:	false
SSDEEP:
MD5:	C95C91117C2F1B8317E9727C4A9F0795
SHA1:	134AB4C164027B00F1F37FD8BD017E996247AE56
SHA-256:	21D6DB0A6A2EF5D4EB927372D858F49665DECB0D3F008A5A078313B8080C6836
SHA-512:	23D62D561EC70F7F470107B4356EC88BC1688D855579A28BB3A4B905D1AB66D121FD75F9018555F92E8A22BE834453A2909586E9CF5327D0E88D7E02DBABE5C6
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="286288" />.. <arg nm="osinsty" val="2" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER50B.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Fri Apr 19 04:26:09 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	5123119
Entropy (8bit):	2.3293534345711535
Encrypted:	false
SSDEEP:
MD5:	38F8A603CA44D184872EA91CCA787B01
SHA1:	F39B2A97AD0085F34627949596A2E140F34F9D7C
SHA-256:	65B448486193F23358A16F1AFD6062C26E7665E98679D8622031CBD3E46DC1F6
SHA-512:	06DB769E1FB54AD7E84CCD0D83D536229E40ED51B853C235BBB1DBDE62F371F9F38B1A951DD97C27B626AC2E2406DE2EB80AFB3A63E8195B8F547F188715C611
Malicious:	false
Reputation:	unknown
Preview:	MDMP..a..... .......a.!f.............*...........#...1......<... T......................`.......8...........T...........H....2M.........\T..........HV..............................................................................eJ.......V......GenuineIntel............T...........A.!f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5kplayer\5kp.7z

Download File

Process:	C:\Users\user\Desktop\5kplayer-setup.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	6642423
Entropy (8bit):	7.999970186659846
Encrypted:	true
SSDEEP:
MD5:	C37A6740BD8E7C1AB2010BD60697A95D
SHA1:	D27729DF46E2D6106F3C4F62B05A7EA19923B24C
SHA-256:	356DF231CC379D53CE7998E9AF9AAD8E7E725F366F7D893EE759C637855248D4
SHA-512:	E289B6A4922E0C3A266733B7EA508313256432EA52225FF2ACB94C68B52B7332003E6E709070D79A26891B02214BF7D101C4368FE6D5B8FD9C186E39A149D901
Malicious:	false
Reputation:	unknown
Preview:	7z..'.... ..=Ze.............t.g>.&..p.........../D.\|....D.).S......a.....z.k..T..&.q..G+.."E.A..Y.r...o:l^.T..'..\..Q..e.9w...2....a.9....)1L..S..}^.S\|C.....Q.>......ve%.%...]W..mO}.X.0Rz.M.........Ta..n....y..Kk..L.-$......+........$....Ay.Y.....Q....Q...[oMu.M.....ZS..+pY......R..(...W..Z..%........=oeP...A..q<X.0.B.F.)........I......K=.).v.{&g..&..PS....r.(.....z.....]\|e%_...H.wz.``.....!..EI.....[..<o.A\...>..-1+..y.x.....wQF...h..."....X. .. ....p.[......zn..U.}q{..a.t.j.X@..t.)0.'.l.u..o.U.,u....T..KJ......%...*.k..........6.qS....5./R...i....j,..2..$.d... .4.....Q6......"?.....&6...@.k.hzb....o.,..B6.Q.OX.}..^.i.i.=z16p......b...L.gVKwI(..g_.`c.6..v.NK......lb.ep..........;LH.....q\RA.....u.=.%Dyl.e.J6...J......>.o.}..o.egN.OS..)..0......r'wr....w........y.s9L.\..".....}$....2..p..o...tr"E.Svxb....r.u...g.u...........8<.1.9.`...d....m....I.B$@....{y.d.l.8.p......&/..Q.......Y\|.x.rv...'...9(.0..A...]..$J..b.0.D.z...7..J

C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Download File

Process:	C:\Users\user\Desktop\5kplayer-setup.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	21981840
Entropy (8bit):	6.563657127759979
Encrypted:	false
SSDEEP:
MD5:	3E71A7C07BB5BD316F64768D21971CFC
SHA1:	AB3EC2965F4D5761FBA0ACDE78FD72AC289354C6
SHA-256:	E00F8BB3EAAFF144C30CEAC509CA4D5267D73A5BAF6D0FE45B3BF8CC58CE3178
SHA-512:	B58ADFD7F5EE981637026A65EA7C21D964E8589AD76D4B6C80F2D00D2EFE477D609852F597FDED713D50F0253B5EB7D5BA34642A8FC5C1B090760248A0E1A117
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e.....................FO...................@...........................P.....{.P....... .............................. J.\|B....J..)...........JO.. ....................................J......................J.h............................text...............................`.P`.data...p...........................@.`..rdata..`.D.......D.................@.p@.qtmetad......!......r!.............@.`@.eh_fram$T'...!..V'...!.............@.0@.bss..........I.......................p..idata..\|B... J..D....H.............@.0..CRT....8....pJ.......I.............@.0..tls.... .....J.......I.............@.0..rsrc....)....J..... I.............@.0.................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nss8647.tmp\nsis7zU.dll

Download File

Process:	C:\Users\user\Desktop\5kplayer-setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	321024
Entropy (8bit):	6.401347031241621
Encrypted:	false
SSDEEP:
MD5:	06A47571AC922F82C098622B2F5F6F63
SHA1:	8A581C33B7F2029C41EDAAD55D024FC0D2D7C427
SHA-256:	E4AB3064F2E094910AE80104EF9D371CCB74EBBEEED592582CF099ACD83F5FE9
SHA-512:	04B3D18042F1FAA536E1393179F412A5644D2CF691FBC14970F79DF5C0594EEEDB0826B495807A3243F27AAA0380423C1F975FE857F32E057309BB3F2A529A83
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........h..\|;..\|;..\|;/:.;..\|;/:.;..\|;/:.;..\|;"..;..\|;..};..\|;"..;..\|;...;..\|;...;..\|;...;..\|;...;..\|;...;..\|;Rich..\|;........PE..L...b..V...........!.....j...................................................`............@..........................g......$^..P................................9......................................@............................................text...Ri.......j.................. ..`.rdata..p............n..............@..@.data....{...p...2...X..............@....rsrc...............................@..@.reloc...W.......X..................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Digiarty\unique.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.077819531114783
Encrypted:	false
SSDEEP:
MD5:	3F64840034A860E903E7B2246052F89C
SHA1:	A38E1C2738910CA46D665AE029F12CFC8F69C205
SHA-256:	69014532CD814061AAF3CFD036421C16B18F1ADD65D6AEA3522DB8908ECF98D9
SHA-512:	367A7AC844D8F76609CB640FBCF8F9DC7248C053313C7D3BA61EF586FDEA54802C3A969C59E184E24C5E4AFB92EFFB2F605A361A8B7AE226CAE435FC8B0C47F0
Malicious:	false
Reputation:	unknown
Preview:	6ca0c914fe991a64

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.31018751789534
Encrypted:	false
SSDEEP:
MD5:	D7923A4A140B0BAB6E4802F5B8F439E8
SHA1:	8349C76CBBDF18367CC88EE9B7022ECB4496FB60
SHA-256:	FADE16CD5F84062EB4056C7119EF7AA4EA7E0507942B01C02DAF7E68C5DB416F
SHA-512:	3B8A11836EE58E2265E586AEEAD2BC1BDAA0B847C540519C2BB9664FB967FC05F12DCB7C8E02DBF19B28DF7CFE91286C9BF23BC112E37065631F209FD65D1741
Malicious:	false
Reputation:	unknown
Preview:	regfF...F....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm....................................................................................................................................................................................................................................................................................................................................................)...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.994216722262718
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	5kplayer-setup.exe
File size:	7'270'888 bytes
MD5:	0cb8a509b925197bd4b94b4c835c8db9
SHA1:	b741c00855307aa3a8a3c52c651c2c8d969a4f78
SHA256:	02b4b6cd3a3a78cc764cb0ad573a9bce3ab0f1681d5e6926c9501e0ebcd7bbbb
SHA512:	7901dd30c8b4169db731006e4e8c33aeada24ae3908999755ee45601e3824a8e845d5bea00c37207373615f6bf1c8acf1cde0d579edaefbacad01d323d227b2b
SSDEEP:	196608:aVsR6S7xbdSAGLoAu6pKph80WK0oASRL7/zwVGNOufRLsDz:jVcAGLoAuPpoK9AeL7rBjRLsX
TLSH:	6D7633136FB78E3CD39225F0CB477E38A9B5DB60A06AC683135299EF6D333895934524
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................t...z...B...8.....

File Icon


Icon Hash:	71d6aa317032564d

Static PE Info

General

Entrypoint:	0x4038af
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x4F47E2E4 [Fri Feb 24 19:20:04 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	be41bf7b8cc010b614bd36bbca606973

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=DigiCert SHA2 Assured ID Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	19/05/2021 02:00:00 23/05/2024 01:59:59
Subject Chain	CN="Digiarty Software, Inc.", O="Digiarty Software, Inc.", L=Chengdu, S=Sichuan, C=CN
Version:	3
Thumbprint MD5:	E52449B6FB0D71581A2377613347EF76
Thumbprint SHA-1:	E122C1337C0DCAE9D48B776CCFD12A70C33F9CE8
Thumbprint SHA-256:	7E00A55AC7216D474B66FE6DBE66A7014631BA5693B10E5A829EA3CE59A77DAC
Serial:	01F30A8BB86816538B43BF89D74D9F48

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+18h], ebp
mov dword ptr [esp+10h], 0040A268h
mov dword ptr [esp+14h], ebp
call dword ptr [00409030h]
push 00008001h
call dword ptr [004090B4h]
push ebp
call dword ptr [004092C0h]
push 00000008h
mov dword ptr [0047EB98h], eax
call 00007FD628C031DBh
push ebp
push 000002B4h
mov dword ptr [0047EAB0h], eax
lea eax, dword ptr [esp+38h]
push eax
push ebp
push 0040A264h
call dword ptr [00409184h]
push 0040A24Ch
push 00476AA0h
call 00007FD628C02EBDh
call dword ptr [004090B0h]
push eax
mov edi, 004CF0A0h
push edi
call 00007FD628C02EABh
push ebp
call dword ptr [00409134h]
cmp word ptr [004CF0A0h], 0022h
mov dword ptr [0047EAB8h], eax
mov eax, edi
jne 00007FD628C007AAh
push 00000022h
pop esi
mov eax, 004CF0A2h
push esi
push eax
call 00007FD628C02B81h
push eax
call dword ptr [00409260h]
mov esi, eax
mov dword ptr [esp+1Ch], esi
jmp 00007FD628C00833h
push 00000020h
pop ebx
cmp ax, bx
jne 00007FD628C007AAh
add esi, 02h
cmp word ptr [esi], bx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ C ] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xac40	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x100000	0x62a30	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x6ed158	0x2090
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x86000	0x994	.ndata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9000	0x2d0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x728c	0x7400	419d4e1be1ac35a5db9c47f553b27cea	False	0.6566540948275862	data	6.499708590628113	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9000	0x2b6e	0x2c00	cca1ca3fbf99570f6de9b43ce767f368	False	0.3678977272727273	data	4.497932535153822	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xc000	0x72b9c	0x200	77f0839f8ebea31040e462523e1c770e	False	0.279296875	data	1.8049406284608531	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x7f000	0x81000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x100000	0x62a30	0x62c00	d773160704a138822d8999da378bbf7f	False	0.826053204113924	data	7.5601313915570545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x163000	0xfd6	0x1000	a9d283bb30600743cf491f95d083e061	False	1.002685546875	data	7.92677442477738	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x1003e8	0x1bb7f	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	1.0003611221209319
RT_ICON	0x11bf68	0x16444	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9998574623920004
RT_ICON	0x1323b0	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.5893765527031823
RT_ICON	0x142bd8	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	United States	0.6659922219886483
RT_ICON	0x14c080	0x67e8	Device independent bitmap graphic, 80 x 160 x 32, image size 26560	English	United States	0.6628947368421053
RT_ICON	0x152868	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	English	United States	0.6903881700554528
RT_ICON	0x157cf0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.6789088332546056
RT_ICON	0x15bf18	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.7429460580912863
RT_ICON	0x15e4c0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.7680581613508443
RT_ICON	0x15f568	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.7630597014925373
RT_ICON	0x160410	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.8331967213114754
RT_ICON	0x160d98	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.865072202166065
RT_ICON	0x161640	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States	0.8911290322580645
RT_ICON	0x161d08	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.7463872832369942
RT_ICON	0x162270	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.8351063829787234
RT_DIALOG	0x1626d8	0x100	data	English	United States	0.5234375
RT_DIALOG	0x1627d8	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x1628f8	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x162958	0xd8	Targa image data - Map 8 x 25668 x 1 +1	English	United States	0.6620370370370371

Imports

DLL	Import
KERNEL32.dll	SetFileTime, CompareFileTime, SearchPathW, GetShortPathNameW, GetFullPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, CreateDirectoryW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, SetErrorMode, lstrcpynA, CloseHandle, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, LoadLibraryW, CreateProcessW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcatW, GetProcAddress, LoadLibraryA, GetModuleHandleA, OpenProcess, lstrcpyW, GetVersionExW, GetSystemDirectoryW, GetVersion, lstrcpyA, RemoveDirectoryW, lstrcmpA, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GlobalFree, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, WideCharToMultiByte, lstrlenA, MulDiv, WriteFile, ReadFile, MultiByteToWideChar, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, lstrlenW
USER32.dll	GetAsyncKeyState, IsDlgButtonChecked, ScreenToClient, GetMessagePos, CallWindowProcW, IsWindowVisible, LoadBitmapW, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, TrackPopupMenu, GetWindowRect, AppendMenuW, CreatePopupMenu, GetSystemMetrics, EndDialog, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, DialogBoxParamW, CheckDlgButton, CreateWindowExW, SystemParametersInfoW, RegisterClassW, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharNextA, CharUpperW, CharPrevW, wvsprintfW, DispatchMessageW, PeekMessageW, wsprintfA, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, CharNextW, GetClassInfoW, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, FindWindowExW
GDI32.dll	SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor, SelectObject
SHELL32.dll	SHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW, SHGetSpecialFolderLocation
ADVAPI32.dll	RegEnumKeyW, RegOpenKeyExW, RegCloseKey, RegDeleteKeyW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumValueW
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 5kplayer-setup.exe

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

General Information

Warnings

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_5kp.exe_3b92e18cc83f109fc4ff47897356e7efcb1d37ba_f76daea9_1e85dae6-22fa-41a1-80c6-96351ecc220e\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER21FB.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER221B.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER50B.tmp.dmp

C:\Users\user\AppData\Local\Temp\5kplayer\5kp.7z

C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

C:\Users\user\AppData\Local\Temp\nss8647.tmp\nsis7zU.dll

C:\Users\user\AppData\Roaming\Digiarty\unique.bin

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Windows Analysis Report
5kplayer-setup.exe