Loading ...

Play interactive tourEdit tour

Analysis Report anchor_x64.exe

Overview

General Information

Sample Name:anchor_x64.exe
Analysis ID:381816
MD5:86fefa2e8be486a49782d4d04095015e
SHA1:f29d6b5c8777028eeef161729b153b4d6e8ba28a
SHA256:a8a8c66b155fcf9bfdf34ba0aca98991440c3d34b8a597c3fdebc8da251c9634
Infos:

Most interesting Screenshot:

Detection

Score:76
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Contains functionality to inject threads in other processes
Creates files in alternative data streams (ADS)
Machine Learning detection for sample
May check the online IP address of the machine
Queries the IP of a very long domain name
Connects to many different domains
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates COM task schedule object (often to register a task for autostart)
Detected potential crypto function
Found evasive API chain (date check)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains more sections than normal
PE file contains sections with non-standard names
Sample file is different than original file name gathered from version info

Classification

Startup

  • System is w10x64
  • anchor_x64.exe (PID: 5668 cmdline: 'C:\Users\user\Desktop\anchor_x64.exe' MD5: 86FEFA2E8BE486A49782D4D04095015E)
  • anchor_x64.exe (PID: 5732 cmdline: C:\Users\user\Desktop\anchor_x64.exe -u MD5: 86FEFA2E8BE486A49782D4D04095015E)
  • anchor_x64.exe (PID: 3756 cmdline: C:\Users\user\Desktop\anchor_x64.exe -u MD5: 86FEFA2E8BE486A49782D4D04095015E)
  • anchor_x64.exe (PID: 6788 cmdline: C:\Users\user\Desktop\anchor_x64.exe -u MD5: 86FEFA2E8BE486A49782D4D04095015E)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

barindex
Multi AV Scanner detection for submitted fileShow sources
Source: anchor_x64.exeVirustotal: Detection: 39%Perma Link
Source: anchor_x64.exeMetadefender: Detection: 13%Perma Link
Source: anchor_x64.exeReversingLabs: Detection: 34%
Machine Learning detection for sampleShow sources
Source: anchor_x64.exeJoe Sandbox ML: detected
Source: anchor_x64.exeStatic PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Source: Binary string: Z:\D\GIT\anchorDns.llvm\Bin\x64\Release\anchorDNS_x64.pdbt source: anchor_x64.exe
Source: Binary string: Z:\D\GIT\anchorDns.llvm\Bin\x64\Release\anchorDNS_x64.pdb source: anchor_x64.exe
Source: C:\Users\user\Desktop\anchor_x64.exeKey opened: HKEY_CURRENT_USER_Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}Jump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeKey opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}Jump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeKey opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAsJump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAsJump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeKey opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}Jump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeKey opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}Jump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeKey opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32Jump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32Jump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeKey opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32Jump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeKey opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32Jump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32Jump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeKey opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandlerJump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandlerJump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeKey opened: HKEY_CURRENT_USER_Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}Jump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeKey opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}Jump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeKey opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAsJump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAsJump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeKey opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}Jump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeKey opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32Jump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32Jump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeKey opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32Jump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32Jump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeKey opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandlerJump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandlerJump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeKey opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32Jump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32Jump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeKey opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}Jump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeKey opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServerJump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServerJump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeKey opened: HKEY_CURRENT_USER_Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}Jump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeKey opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}Jump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeKey opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\ElevationJump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\ElevationJump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeKey opened: HKEY_CURRENT_USER_Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}Jump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeKey opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}Jump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeKey opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAsJump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAsJump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B44358DB FindFirstFileW,GetFileAttributesW,FindNextFileW,FindClose,0_2_00007FF6B44358DB
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B445D404 FindFirstFileExW,0_2_00007FF6B445D404
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64997D404 FindFirstFileExW,32_2_00007FF64997D404

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)Show sources
Source: TrafficSnort IDS: 2032216 ET TROJAN Win32/TrickBot Anchor Variant Style External IP Check 192.168.2.5:49707 -> 3.211.138.232:80
Source: TrafficSnort IDS: 2032216 ET TROJAN Win32/TrickBot Anchor Variant Style External IP Check 192.168.2.5:49739 -> 52.20.197.7:80
Source: TrafficSnort IDS: 2032216 ET TROJAN Win32/TrickBot Anchor Variant Style External IP Check 192.168.2.5:49740 -> 3.211.138.232:80
Source: TrafficSnort IDS: 2032216 ET TROJAN Win32/TrickBot Anchor Variant Style External IP Check 192.168.2.5:49746 -> 52.20.197.7:80
Source: TrafficSnort IDS: 2032216 ET TROJAN Win32/TrickBot Anchor Variant Style External IP Check 192.168.2.5:49749 -> 3.224.94.38:80
May check the online IP address of the machineShow sources
Source: C:\Users\user\Desktop\anchor_x64.exeDNS query: name: checkip.amazonaws.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS query: name: checkip.amazonaws.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS query: name: checkip.amazonaws.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS query: name: checkip.amazonaws.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS query: name: checkip.amazonaws.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS query: name: checkip.amazonaws.com
Source: unknownDNS query: name: checkip.amazonaws.com
Source: unknownDNS query: name: checkip.amazonaws.com
Source: unknownDNS query: name: checkip.amazonaws.com
Source: unknownDNS query: name: checkip.amazonaws.com
Queries the IP of a very long domain nameShow sources
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: efkezwpdxpsq3lsdvnscc.nqfuhj4g5qndhshtlghjlpujhqrbvu.uipcc52icgjgfdelsc3ancaijdnacinun2l.ihvdacjoibefwddrcdfptdhnifsnkdyddddp.ddddddaacg.fgevtf3izno2skelgg3umvcrrb.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: ihidsfghzboscitfrhswgbdqgvv4guil.nmrd22lq2lrwhpqcuma2h2sqhdnq2ay.ijzlljuihupgujlqirarhhzyqulr.d2v4cugas2zsqidfwhvyidgmj.usrhzdddddcdwdgg.fgevtf3izno2skelgg3umvcrrb.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: xvc62upjjgl6duajcmrlhpyqyelq.ubdiczr62ydccfelzfsdf3ie2uljgmm6gmsjw.hdddgpmfd.fgevtf3izno2skelgg3umvcrrb.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 9pldddddddddy999dddhdddddlgor.qoomnokg945lcq6m4dz2fnwyad.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 9plddddjddddy999dddhdddddp9rf.z25ovwddcyzec225njmvvsmqxd.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 9plddddqddddy999dddhdddddpd5w.n3blemjjd2azs3j9c52llpoybj.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 9pldddd2ddddy999dddhdddddds3g.xhn99ol6zi3gsvj4k9ujehmu5h.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 9pldddloddddy999dddhdddddpnwd.z9crufme5l4psjjmrl4mfxfk5b.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 9pldddpvddddy999dddhdddddyjyx.jwb4i2qyfbm4s6nezzdc3gtzqb.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 9pldddy9ddddy999dddhdddddlw4m.kczy5vnfhmmsc9j2mycx6jz6dc.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 9pldddyhgdddy999dddhdddddpswl.bgldl2g6xazfs62juwyuwlr9bk.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 9pldddpcgdddy999dddhdddddl9or.3r4yo6wzmmn6cew2beavnbzbmd.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 9pldddsjgdddy999dddhdddddpb5r.bpatfnu5d6sxsunyuy5ndb6ycj.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 9pldddclgdddy999dddhddddddvvr.fpcnuit4lfkbs46ube5ckzvacd.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 9pldddlmgdddy999dddhdddddl6ff.ynxokgamkhc4cswxtcjmqftx6k.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 9pldddqngdddy999dddhdddddde3f.u5y4irinuiiesrwkb9qlmtmiqh.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 9pldddcfgdddy999dddhddddddr6l.5vzidylzgvglshur9xesgqcokc.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 9plddd4fgdddy999dddhdddddyzbi.dchzuulka4o5cmhvpdo6wmbu6d.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 9pldddsqgdddy999dddhddddddzmw.9resjqy6ihkasmudkuvbzukjni.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 9plddddrgdddy999dddhdddddyham.pgw4vhlvnueacbhu4hyzs35bxc.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 9pldddqrgdddy999dddhddddddbhb.cuirp5fa2xmncm2ltapgvfpbah.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 9pldddprgdddy999dddhdddddlqbh.dfvh9cbplgoasuekjvi39sswzg.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: efkezwpdxpsq3lsdvnsccnqfuhj4g5qnd.hshtlghjlpujhqrbvuui.pcc52icgjgfdelsc3ancaijdnacinun2lihvdac.joibefwddrcdfptdhnifsnkncdcddd.djdddddptmd.gconcfadqbxmsqekmnvx59jeyd.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: sdywilcw422sswtmyeiqdy.iqx3kpudmitglnhzmhtamd3zp.jifnl22mdlzmjbupchgapulphkpedztsiomlch.2ahtglw33pjc3nj22tdqamqbudccapdddcduthd.gconcfadqbxmsqekmnvx59jeyd.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: mvchgd4r3pfehvpcdabpjvyctgmdb2gnbzawds.ycuafhhyyqmbiwzhqrulfeh.acciakczepmdddcdn6m.gconcfadqbxmsqekmnvx59jeyd.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 6fmdddddddddy999dddhddddddlmn.nmepgufwne9jsz2yvjuhe2gmtg.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 6fmddddjddddy999dddhdddddlzjr.u5anp4jpqrzucswdho22oyaydd.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 6fmddddqddddy999dddhdddddplmh.pp2v3ii6debfsh2sov6i59kpnc.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 6fmdddd2ddddy999dddhdddddlbod.bn6bzwu5gzzocuemrtup2mrcmj.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 6fmdddloddddy999dddhdddddynxn.ch4rh44odulbcyhi5oxmtqmnhc.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 6fmdddpvddddy999dddhdddddd3oc.burfjb5fdcrtsij3mjxph4t9ed.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 6fmdddy9ddddy999dddhdddddpguj.p3xbylmctu6ssfwxm6avnqbhzc.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 6fmdddyhgdddy999dddhddddddudj.rxwj34r3eozecpumtr9oy5knqi.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 6fmdddpcgdddy999dddhdddddlaoq.uat5co4whrpesmwycnee4vk9ag.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 6fmdddsjgdddy999dddhdddddltqd.vupuxtkoqfmcczhguflirjy6nb.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 6fmdddclgdddy999dddhddddddr6k.g34zz9ptnbf6sihsnjcwe52ttb.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 6fmdddlmgdddy999dddhdddddpteh.xifcwlwakz6zca6hmx5mhq9xhh.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 6fmdddqngdddy999dddhddddddtfn.bjsnopybkkpqcpwpysopb933tj.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 6fmdddcfgdddy999dddhdddddypvm.wvzauzs59pqnspjpph26suqdeh.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 6fmddd4fgdddy999dddhdddddd6jf.wyhmh92uye33coulyqiz9wp5jb.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 6fmdddsqgdddy999dddhdddddliox.yh4wpbolazchcmjbd3torwaipg.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 6fmddddrgdddy999dddhdddddpkcq.gaydllyaba55cdj4tepn3tt9oi.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 6fmdddqrgdddy999dddhdddddy2sn.qykoejju4byoszu24tflfvyivh.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 6fmdddprgdddy999dddhdddddp9en.66mq25hm6m2ysvhs9avcwmegtk.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: efkezwpdxpsq3lsdvnsccnqfuhj4g5qn.dhshtlghjlpujhqrbvuuipcc52icgjgfd.elsc3ancaijdnacinun2lihvdacjoibefwd.drcdfptdhnifsnkncnddgdddygdddddh69b.n3u3bdlqy4ahsfjea4eialvygh.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: detdzpzfn22etjgnoygduy5r6dvhctsjdmm.cjmsjkgqjhvsqmgmnjgd.ijaqph3lccbvhgf4dfbcu2u4jg.zlljfsjdarwhvyqnalnuhyikzrphyyc.bfejzlddxbddyd4ddj.n3u3bdlqy4ahsfjea4eialvygh.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 3pfehvpcdabpjvyctgmdb2gnbzawdsycua.fhhyyqmbiwzhqrulfehacciakczepmdddcyznl.n3u3bdlqy4ahsfjea4eialvygh.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: vvtgddddddddy999dddhdddddlzpg.oh3hycf9pchmsye5f5msf5olxg.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: vvtgdddjddddy999dddhdddddpyuj.lumvitvr9mvys6u6if4aj2z43g.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: vvtgdddqddddy999dddhdddddyozd.romw9wmsaplpsvnu2xkos94gsj.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: vvtgddd2ddddy999dddhdddddpcjh.x29ziqdor3qecjhdwi3y6tqx6h.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: vvtgddloddddy999dddhdddddlvrl.qu5iyvkvdpz9sces3nv5pbmtag.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: vvtgddpvddddy999dddhdddddp4ac.tb62ikmmdrubss6ben6alszz3i.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: vvtgddy9ddddy999dddhdddddlkph.5wpy6jl9gfrqcmuru6q2psochj.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: vvtgddyhgdddy999dddhdddddp5mq.ptnbi2fjb5xucheykuvzyy6hch.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: vvtgddpcgdddy999dddhddddddpnq.zy3hs93ubdqlsvjtibqjvkr6uj.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: vvtgddsjgdddy999dddhddddddg5k.fs95q9lqgvvbs3hm3d5f2dschb.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: vvtgddclgdddy999dddhdddddytxl.i3dpfey2qkq6svwohnugqufi3h.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: vvtgddlmgdddy999dddhddddddirn.irmi264qck2sc5jv95jhp2u4xi.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: vvtgddqngdddy999dddhdddddpi9q.dg2ljzcl4exuc3hkfogs94qjci.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: vvtgddcfgdddy999dddhdddddpivr.yzmkrxgyr3amst2sn9gvgdat6j.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: vvtgdd4fgdddy999dddhdddddp49w.um3wlc3zjfb5c4wewtbxwb6uvj.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: vvtgddsqgdddy999dddhdddddlu9b.s5nndv5ejjdvszhh6t9sa3kvvg.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: vvtgdddrgdddy999dddhdddddphck.6jcelbziy5ics42fmfs6i2qf3g.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: vvtgddqrgdddy999dddhdddddyqad.rd4qr5m4xxmushwveacwsiq23g.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: vvtgddprgdddy999dddhdddddlbkx.cbqcffdll4y4cpnhzhkpmudufh.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: efkezwpdxpsq3lsdvnsccnqfuhj4g5qndhshtl.ghjlpujhqrbvuuipcc52icgjgfdelsc3ancaijd.nacinun2lihvdacjoibefwdd.rcdfptdhnifsnkncnddgdddygdddddygad.byeui5jwtkm3cs2pz2fp9zcewh.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: detdzpzfn22etjgnoygduy5r6dvh.ctsjdmmcjmsjkgqjhvsqmgmnjgdijaqph3.lccbvhgf4dfbcu2u4jgzlljfsjdarwhvyqnaln.uhyikzrphyycbfejzlddxvc62upjjgddydljwg.byeui5jwtkm3cs2pz2fp9zcewh.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: dabpjvyctgmdb2gnbzawdsycuafhhyyqmbi.wzhqrulfehacciakczepmdddcyahy.byeui5jwtkm3cs2pz2fp9zcewh.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: r5zdddddddddy999dddhdddddlh9l.zryd4rb23loesdus6nh3dvcmfd.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: r5zddddjddddy999dddhdddddyk3n.dk3nrynwbx9mctukfca9qydlwg.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: r5zddddqddddy999dddhdddddywei.hndmjkctud3xs4jdrg5fuqf2wj.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: r5zdddd2ddddy999dddhddddddarq.vpy96cjixdazsbeuc9a9yhfnod.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: r5zdddloddddy999dddhdddddlqew.qtmpn5jib3cbcdubbscas93gog.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: r5zdddpvddddy999dddhdddddlr4f.t2qfeac3xskfcrwe9tdqagvezb.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: r5zdddy9ddddy999dddhdddddlbaj.4cig3iqctojvcu24p5eb5sehmk.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: r5zdddyhgdddy999dddhdddddyxlj.nmzz55pkquabcb2nq6kzvys6ad.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: r5zdddpcgdddy999dddhdddddypfb.qz96crvbld9msvndloy5ozeudh.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: r5zdddsjgdddy999dddhddddddzzl.zhcvpyntsm42sdesosueoqzgxh.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: r5zdddclgdddy999dddhdddddyrsi.9ubumpefzvr2ckhuvampkfv2ik.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: r5zdddlmgdddy999dddhdddddpadj.2favssb3n5zbsenkgiv4uskm9c.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: r5zdddqngdddy999dddhdddddlb2r.9n5wus44j6jks92r3gnjqxgnfd.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: r5zdddcfgdddy999dddhdddddleci.5dirqvocy59xcn6nu9jbfw9psk.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: r5zddd4fgdddy999dddhdddddpd2h.2vl9ho6fks5psr2lacevh9cakg.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: r5zdddsqgdddy999dddhdddddlcvb.9ktc6nf3l4eisvw3t2ratso95h.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: r5zddddrgdddy999dddhdddddpvxh.6rtufkuzgcnys66lgqdd2xasid.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: r5zdddqrgdddy999dddhdddddddhb.llkd5phtskl3cduotxzr2hzvbk.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: r5zdddprgdddy999dddhdddddyqdd.syft2i3xmwqacen9orpna99h2c.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: efkezwpdxpsq3lsdvnsccnqfuhj4g5qndh.shtlghjlpujhqrbvuuipcc52icgjg.fdelsc3ancaijdnacinun2lihv.dacjoibefwddrcdfptdhnifsnknc.ndlohdhddddbdddddqhgg.qhfixf5me5zysvnduapxdzi32k.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: yl4piimm5n3dtfpddfp6jxyrg2nnbys.ch3cn33djbzrnusyci3dy.h3qjqzmch2zrzyiwytgh.fmfw3ylcc3inby4jkzrljtqcifgp23pjqgll2z.ir3lcdyorhdddhyci9.qhfixf5me5zysvnduapxdzi32k.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: xmfqb3dcxdvqb2sjcgqljlrcjv.gyh2pjxmldh2irspinytahrmfc3y.sc9ycnbkgddydpcrb.qhfixf5me5zysvnduapxdzi32k.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 6vtgddddddddy999dddhdddddlghc.rslfn3xxw4zespusful6qzyhth.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 6vtgdddjddddy999dddhdddddy2wm.zc9ttow9npizcj2oo4ej5do5vd.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 6vtgdddqddddy999dddhdddddpaij.yc3n5w2vmg5xcw2g9lzfpeyyzk.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 6vtgddd2ddddy999dddhdddddloij.m9aamelug3wlsoeqqxnhcoonzk.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 6vtgddloddddy999dddhdddddpfxx.byjoxorguw3ac56fzehj92qu4k.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 6vtgddpvddddy999dddhdddddddjn.fjp55udwucbpcehnz45pznu56h.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 6vtgddy9ddddy999dddhdddddyajk.96zgy2mmf3zack2hlrip2yj3kd.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 6vtgddyhgdddy999dddhdddddyz4k.cog9d34uwngqsg2h9wzeinkz2c.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 6vtgddpcgdddy999dddhdddddpeqh.lkql433gfg6wc6w63o4rqsnawh.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 6vtgddsjgdddy999dddhdddddpdpl.cpiv4kq4f22ss9epwfurm6btji.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 6vtgddclgdddy999dddhdddddy9yb.u3fpuydggyexcinugqsfdfiewi.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 6vtgddlmgdddy999dddhdddddykbk.adjvyvgigykts3wy9ioczcikvj.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 6vtgddqngdddy999dddhdddddlvyq.jo4xd3xri5cosl6o69qnws26pk.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 6vtgddcfgdddy999dddhdddddpdbc.taffthi3km4isr6tby4foal5kj.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 6vtgdd4fgdddy999dddhdddddplkc.i62wsex9xh3vc2n9pnwtbqhtyj.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 6vtgddsqgdddy999dddhdddddymtl.4lrirpurbck6cwuoo5znuffoqj.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 6vtgdddrgdddy999dddhdddddpmek.g2sx9dnzrky4sqegczzpo5fm9i.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 6vtgddqrgdddy999dddhdddddd4jr.aax69ti6qen6ca6qpzkyb6seth.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: 6vtgddprgdddy999dddhddddddeth.rap4j9b3ajqjs6hyewd2bfmfvd.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: efkezwpdxpsq3lsdvnsccnqfuhj4.g5qndhshtlghjlpujhqrbvuuip.cc52icgjgfdelsc3ancaijdnacinun.2lihvdacjoibefwddrcdfptdhnifsnkncnd.lohchkwgdgdddygdddddyc2d.yyzoipktrpqicnwxz3hf4icrfg.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: n22etjgnoygduy5r6dvhsoljcgllufdjcmrd2vs.qwglquhqiggr6hzqcgfew.gfsdxbcshs4jkgljufcjcgqj2esq.malljgcidzre22dccfejzf4dlvcs2.ucjcmldddcdzbwd.yyzoipktrpqicnwxz3hf4icrfg.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: xlid32ljczrcjudcj3d62ypjlgldhzarylcw.yu5hqgncb3dc9dcdbkgddyds5hb.yyzoipktrpqicnwxz3hf4icrfg.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: b4tgddddddddy999dddhdddddpiqr.jteukxy5rmqzcrupnseuugr3tk.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: b4tgdddjddddy999dddhddddddrvj.4h4z3b6vdqkzckjcvifdxg25hi.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: b4tgdddqddddy999dddhddddddijk.mduacydqxnfes264u2aqiffmbc.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: b4tgddd2ddddy999dddhdddddlpcc.skhg95ahnhazsvufjs9pj5w6bb.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: b4tgdddpddddy999dddhdddddyism.vf629qyj3ylocmhq4xquq2cf3j.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: b4tgdd44ddddy999dddhdddddpeoj.c6namrxtvuzysbjaycteedpryk.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: b4tgdddggdddy999dddhdddddpcvj.wxq4ylecj6m4coek2mslauz3gh.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: b4tgddqcgdddy999dddhdddddpdog.hynr9mq3j3h5cqna3xqpz63mid.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: b4tgdddkgdddy999dddhdddddystw.nz5deyfwdxlms5hz5beuytmfei.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: b4tgddlmgdddy999dddhdddddybeh.pi5ngtmy2hzkcbel3gx54yz2nh.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: b4tgddcfgdddy999dddhdddddyzkr.pcuntdnhowktchwrtl4zjmasoh.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: b4tgddsqgdddy999dddhdddddpb5b.36aqozrooscbsahbpkpzoiqbii.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: b4tgddprgdddy999dddhdddddpqxg.e4lquweuedaack2grflu5q3gab.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: b4tgddywgdddy999dddhdddddytwl.233e5jfky55kclnr4dymadymfj.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: b4tgddlxgdddy999dddhdddddppdl.waxmtqa5jc43czwoikkjs9cpyg.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: b4tgdddygdddy999dddhddddddixb.6pwsy4pexbcuc2wsneznbljdsd.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: b4tgddqygdddy999dddhddddddffw.z5duhcnkcyofsqhbq3jszy46zi.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: b4tgddpygdddy999dddhdddddlssj.lzoor32orsgqcb6rehhyu6rsxk.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: b4tgddczgdddy999dddhddddddfur.dxexglwwuftac4uqnkxvisjvbd.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: b4tgddyzgdddy999dddhdddddlvxm.qjcreyljjknesmelbuw43evwgd.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: efkezwpdxpsq3lsdvnsccnq.fuhj4g5qndhshtlghjlpujhqr.bvuuipcc52icgjgfdelsc3ancaijdna.cinun2lihvdacjoibefwddrcdfptdhnifsnkn.cndlohcdyddddpdddddd43jd.dobwitxawyf4spwnwhvz6tmgij.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: zboscitfrhswgbdqgvv4guilxzqlhyy.qodql2edcoma4hypqipnhh.e4ihalhus5hulg6jllilar.whyqqolqlhpqctma22zyqhlndhvsiigllusrho.pgyumlirmql2y4gtdqnhdddgdzkm.dobwitxawyf4spwnwhvz6tmgij.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: 2gmqbzzidzacyoccugndhylqwb.chzbsrodfyhapcdakdgppmdddcy5tk.dobwitxawyf4spwnwhvz6tmgij.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: 2gmqbzzidzacyoccugndhylqwb.chzbsrodfyhapcdakdgppmdddcy5tk.dobwitxawyf4spwnwhvz6tmgij.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: 2gmqbzzidzacyoccugndhylqwb.chzbsrodfyhapcdakdgppmdddcy5tk.dobwitxawyf4spwnwhvz6tmgij.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: efkezwpdxpsq3lsdvnsccnqf.uhj4g5qndhshtlghjlpujhqrbvu.uipcc52icgjgfdelsc3ancaijdnaci.nun2lihvdacjoibefwddrcdfptdhnifsnk.ncndlohcdyddddpddddddjmgd.zh2kdd2bgmzds9ewlc4gdg55eb.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: zboscitfrhswgbdqgvv4guilxzqlhyyqod.ql2edcoma4hypqipnhhe4iha.lhus5hulg6jllilarwhyqqolqlhpqctma22zyqh.lndhvsiigllusrhopgyumlirmql2y4gtd.qdddcdmyyg.zh2kdd2bgmzds9ewlc4gdg55eb.sluaknhbsoe.com
Source: C:\Users\user\Desktop\anchor_x64.exeDNS traffic detected: query: izqlhvlqqglqjg4igzryhydch.3vdzl4drviphsljjgl6gldjwhdddgpoej.zh2kdd2bgmzds9ewlc4gdg55eb.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: 9pldddddddddy999dddhdddddl5qq.wkp3o5uammqtcojgatxxnzfluh.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: 9plddddjddddy999dddhdddddys6f.x4w5u2c6hu4ncq2ds3lsfoowlj.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: 9plddddqddddy999dddhdddddykdb.is5b2wg6pdgjc3hiwxesv2mxzi.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: 9pldddd2ddddy999dddhdddddpwdf.nzvwqfrqanmxsmhqcjwwgcczec.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: 9plddddpddddy999dddhdddddlz2b.xfy2sw3aulrgspj6deokfkkyyi.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: 9plddd44ddddy999dddhdddddy2id.ldfnhtzk6pjds4wvcqzm4g2leg.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: 9plddddggdddy999dddhdddddlj2r.swc45z3skqrysdn9bactk2wdwg.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: 9pldddqcgdddy999dddhdddddptiw.mzy4irkums4hci2695qx5yo6wd.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: 9plddddkgdddy999dddhddddddk2g.qmfpmdukjmtyssuso439owrtkd.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: 9pldddlmgdddy999dddhddddddv6l.n9tdulmmdzshsw24untj6g6olh.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: 9pldddcfgdddy999dddhddddddxjf.m6q4kshtxoq2sehrg64e2otxzb.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: 9pldddsqgdddy999dddhdddddl6yx.lu2b5aasjdizcb2wrrl3q9vjac.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: 9pldddprgdddy999dddhdddddydjr.6q9aagez63qrcu62zwfeqy3sub.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: 9pldddywgdddy999dddhdddddlphf.ek6mhkhossxfsmnixixa2qonpb.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: 9pldddlxgdddy999dddhdddddp3eb.dqhfv2j26lg5cy264byd32bsbk.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: 9plddddygdddy999dddhdddddpouf.tekf3etazr5qsqnv29q6vwb3ab.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: 9pldddqygdddy999dddhdddddyyjg.lbw6xkbpmyo2skw2ptrf6ei3fk.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: 9pldddpygdddy999dddhdddddpyrx.qatwix2rvj9ocb2zwain5kdijk.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: 9pldddczgdddy999dddhdddddl66c.4rikdsq6btancwef3jj34yx9xj.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: 9pldddyzgdddy999dddhdddddl55q.xtc34ow4jyiysghm6s5r3fdg2c.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: efkezwpdxpsq3lsdvnsccnqf.uhj4g5qndhshtlghjlpujhqrbvuui.pcc52icgjgfdelsc3anca.ijdnacinun2lihvdacjoibef.wddrcdfptdhnifsnkncnddgdddygddddd2drd.4l66nxnqtu22sgjbc2zhnjwx9i.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: detdzpzfn22etjgnoygduy5.r6dvhsoljcgllufdjcmrd2vsqwglq.uhqiggr6hzqcgfewgfsdxbcshs4jkgljuf.cjcgqj2esqmalljgcidzre.22dccfejzf4dlvcdddcddv4g.4l66nxnqtu22sgjbc2zhnjwx9i.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: nmfhb2ccxlid32ljczrcjudcj3d62yp.jlgldhzarylcwyu5hqgncb3dc9dcdbkgddydqxeb.4l66nxnqtu22sgjbc2zhnjwx9i.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: i4tgddddddddy999dddhdddddljvw.apz2losl4khqcrwcrof4tnvxwk.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: i4tgdddjddddy999dddhdddddppeg.epiyro6xbaafco2o53y3svivmd.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: i4tgdddqddddy999dddhdddddpsli.criibaypmg2tsvucxfp53qrrhh.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: i4tgddd2ddddy999dddhdddddp4yb.n3p9g4w234qjcc2u445brw6jsj.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: i4tgdddpddddy999dddhdddddyo2l.i92vwadvuz3ecc29owsj6wdhth.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: i4tgdd44ddddy999dddhdddddpvqh.9utcvyst5vqssa6w6nd5jmyogc.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: i4tgdddggdddy999dddhddddddsqc.2ohvfyamhcptsje2w2hi9ya3rh.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: i4tgddqcgdddy999dddhdddddd94k.kfrbfdrorkybsgnxyuudbnoh9k.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: i4tgdddkgdddy999dddhdddddpcof.dvmefyszn46hc566zauitanbfd.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: i4tgddlmgdddy999dddhdddddy4uk.kabzkigpe4epci6udrzsah9gfi.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: i4tgddcfgdddy999dddhdddddpb2f.s2rkpzaqdxt5c3hjrkikmpoffi.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: i4tgddsqgdddy999dddhdddddplpd.x9zlrxu6etats5uezlp5ja5fkd.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: i4tgddprgdddy999dddhdddddp3sf.ohrx3agliueecn6dat5yuupwyi.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: i4tgddywgdddy999dddhdddddysdl.lop55mu56yulsqu6ac92lunkki.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: i4tgddlxgdddy999dddhdddddynur.i9xclwtru2ksc6eg665ub4ewwg.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: i4tgdddygdddy999dddhdddddd4qi.g2ynkufys4zxcfhxdtjomw5p4i.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: i4tgddqygdddy999dddhdddddpdom.j42asnnhapegsn6r6hbgvw4vec.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: i4tgddpygdddy999dddhdddddy3uq.v44md4zvun3kcbuy2ebpawaw6j.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: i4tgddczgdddy999dddhdddddlwdi.xhgeo2odu2tusgw5bapio9vgyh.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: i4tgddyzgdddy999dddhdddddpwur.9lgnhyu5tvvusojdrrmtqlbn9c.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: efkezwpdxpsq3lsdvnsccnqfuhj.4g5qndhshtlghjlpujhqr.bvuuipcc52icgjgfdelsc3ancaijdnacinu.n2lihvdacjoibefwddrcdfptdhnifsnkncn.dlohcdyddddpddddddh4sd.el2by9kirmlccdh29xfmxw6ycb.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: zboscitfrhswgbdqgvv4guilxzqlhyyqo.dql2edcoma4hypqipnhh.e4ihalhus5hulg6jllilarwhyqqolqlhpqctma2.2zyqhlndhvsiigllusrhopgyumlirmql2y4gtd.qnhadddldluwh.el2by9kirmlccdh29xfmxw6ycb.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: czrcjudcj3d62ypjlgldhzarylc.wyu5hqgncb3dc9dcdbkgddyd4wod.el2by9kirmlccdh29xfmxw6ycb.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: 94zdddddddddy999dddhdddddlb6d.sxa33wbygdznsr6dnmktxwgffc.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: 94zddddjddddy999dddhdddddlhtf.4wgxjxsjmsyqsxevaxh95qrqac.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: 94zddddqddddy999dddhdddddlinx.afvfn9f92g62sm2co3eu35avwc.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: 94zdddd2ddddy999dddhddddddafb.4fyru9at54c9swnwwuzjln6ccg.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: 94zddddpddddy999dddhdddddprfh.rnsozrnfjg5ssjuzyf5g2psebh.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: 94zddd44ddddy999dddhdddddpbgh.viyctqclbpsms2uvpjxxemrilb.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: 94zddddggdddy999dddhdddddlhnc.wrrfhnupqjemc3ewn2cxky6wui.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: 94zdddqcgdddy999dddhdddddluac.qufekzpeuiqvc2uhdolb4tzs4j.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: 94zddddkgdddy999dddhddddddbkl.ahrdswy2zzhycjhnrc5dtlkjtb.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: 94zdddlmgdddy999dddhdddddlsqm.3n36tykugh2msmneu24ldwmawg.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: 94zdddcfgdddy999dddhddddddbgj.g2kmc25kndupc3e4dzpdgpulfg.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: 94zdddsqgdddy999dddhddddddjkn.vd6k4imksj5vcfejmddw3evb4d.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: 94zdddprgdddy999dddhdddddp9hi.hqsdkaqoqfeqsg2qwruf3g3zwi.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: 94zdddywgdddy999dddhdddddlrdl.xpgvoywmmvvncrh2xxjjlgshfh.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: 94zdddlxgdddy999dddhddddddhcx.czfwo4pukvuost6zsumtwo3qwk.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: 94zddddygdddy999dddhdddddpj6l.ztqavv5xluilsdnitnmt3rmmbb.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: 94zdddqygdddy999dddhdddddd4oq.slgos5hrghxtct6fjjctwuabqh.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: 94zdddpygdddy999dddhdddddl2lf.f466gt53chj2c6ho9erpxr29th.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: 94zdddczgdddy999dddhdddddlt9q.ky6gpbr3pdqgcdehnyc2t5umrh.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: 94zdddyzgdddy999dddhdddddlc5j.dzdsgil5wljhc22ljq2eddsowh.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: efkezwpdxpsq3lsdvnsccnq.fuhj4g5qndhshtlghjlpujhqrbvuui.pcc52icgjgfdelsc3ancai.jdnacinun2lihvdacjoibefwddrc.dfptdhnifsnkncndldlddddqdddddd2bm.izpagnu92o4ncu24frquvc2thh.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: ohchkwmmnnoecl5hjdphuo.abqfy6haycdgawgpyctglw32a.idzanytccsafc2zcqmviqz.h4ryyny2v4cdapwzpycyaln32iib.gacysdcumfnhyyqmvcwzbdr3yne2pycdddhdzlm.izpagnu92o4ncu24frquvc2thh.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: gabngpsc2gmqbzzidzacyoccu.gndhylqwbchzbsrodfyhapcdakdgppmdddcdon4.izpagnu92o4ncu24frquvc2thh.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: wtfgddddddddy999dddhdddddytrn.rkm2jvlxrt6ncy69ih5sig3xld.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: wtfgdddjddddy999dddhdddddyr4c.thtqhmqtohknshuxpcnqsjepug.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: wtfgdddqddddy999dddhdddddyyih.ppa399dynwgnsjjthlrc4kbsji.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: wtfgddd2ddddy999dddhdddddymaj.3yud9k92j35wsz6jvix9bz4sbc.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: wtfgdddpddddy999dddhddddddgci.n2eurt5u5ewrc9hbnpldsxvfoc.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: wtfgdd44ddddy999dddhdddddlp5r.gdwq5vmj6uojsdnpqrae5wxigi.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: wtfgdddggdddy999dddhdddddd2hf.r43e9fu33m4nchwrssjevbknsi.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: wtfgddqcgdddy999dddhdddddyrgb.y2qlfk5gupk2s96e3e3kk2fpbi.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: wtfgdddkgdddy999dddhdddddy5il.q2ign3t2aj5rse6r43psplfcmi.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: wtfgddlmgdddy999dddhdddddy5jf.xti554ejkppjswwilaod54xp5i.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: wtfgddcfgdddy999dddhdddddlrcn.ityoxilmbyk9cawra5lyzbs2aj.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: wtfgddsqgdddy999dddhdddddlf4r.xvm6itkixjw5crj2svitnjhjmg.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: wtfgddprgdddy999dddhdddddybgg.uuyk2gaz4nshsejszhb2zssvyh.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: wtfgddywgdddy999dddhdddddlphc.ty3luv3ax4vusj6yru4qwtkork.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: wtfgddlxgdddy999dddhddddddhnl.ex9b3ql5tb4ccxjoqvx9izqotj.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: wtfgdddygdddy999dddhddddddufk.xfrrqmnf6eg4shnisdim3meypb.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: wtfgddqygdddy999dddhddddddffh.ynlxdlzabgq9sonkpi3mnbw49g.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: wtfgddpygdddy999dddhdddddpp6f.626igjzvbw6gs3u4s6neazuuqh.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: wtfgddczgdddy999dddhdddddppxg.xm53j6ixi6f5s62rumlc6wrjuc.sluaknhbsoe.com
Source: unknownDNS traffic detected: query: wtfgddyzgdddy999dddhdddddyf5c.2gh3s34zvlokc4ua9gamk66mzk.sluaknhbsoe.com
Source: unknownNetwork traffic detected: DNS query count 252
Source: Joe Sandbox ViewIP Address: 3.211.138.232 3.211.138.232
Source: Joe Sandbox ViewIP Address: 52.20.197.7 52.20.197.7
Source: Joe Sandbox ViewASN Name: AMAZON-AESUS AMAZON-AESUS
Source: Joe Sandbox ViewASN Name: AMAZON-AESUS AMAZON-AESUS
Source: global trafficHTTP traffic detected: GET / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: WinHTTP loader/1.0Host: checkip.amazonaws.com
Source: global trafficHTTP traffic detected: GET / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: WinHTTP loader/1.0Host: checkip.amazonaws.com
Source: global trafficHTTP traffic detected: GET / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: WinHTTP loader/1.0Host: checkip.amazonaws.com
Source: global trafficHTTP traffic detected: GET / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: WinHTTP loader/1.0Host: checkip.amazonaws.com
Source: unknownDNS traffic detected: queries for: checkip.amazonaws.com
Source: anchor_x64.exe, 00000001.00000003.235369829.0000022B85CDC000.00000004.00000001.sdmp, anchor_x64.exe, 00000020.00000002.507309729.000001DC6466E000.00000004.00000020.sdmp, anchor_x64.exe, 00000020.00000003.476209421.000001DC64646000.00000004.00000001.sdmp, anchor_x64.exe, 00000020.00000002.507251917.000001DC64617000.00000004.00000020.sdmp, anchor_x64.exe, 00000023.00000003.735729186.0000023311ABB000.00000004.00000001.sdmpString found in binary or memory: http://checkip.amazonaws.com/
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B444048A GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,CreateDesktopA,Sleep,CloseDesktop,GetLastError,GetLastError,GetLastError,CloseHandle,0_2_00007FF6B444048A
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B442A5F60_2_00007FF6B442A5F6
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B442AED20_2_00007FF6B442AED2
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B442F80E0_2_00007FF6B442F80E
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B44352090_2_00007FF6B4435209
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B44239FB0_2_00007FF6B44239FB
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B44552C00_2_00007FF6B44552C0
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B44242E40_2_00007FF6B44242E4
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B44303FD0_2_00007FF6B44303FD
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B44344C30_2_00007FF6B44344C3
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B44395A80_2_00007FF6B44395A8
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B444F5B00_2_00007FF6B444F5B0
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B443CD360_2_00007FF6B443CD36
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B44235750_2_00007FF6B4423575
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B44436090_2_00007FF6B4443609
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B4428E1C0_2_00007FF6B4428E1C
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B445EE180_2_00007FF6B445EE18
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B442C5BE0_2_00007FF6B442C5BE
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B442B68A0_2_00007FF6B442B68A
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B442BE8E0_2_00007FF6B442BE8E
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B4427E980_2_00007FF6B4427E98
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B4462E480_2_00007FF6B4462E48
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B442CE640_2_00007FF6B442CE64
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B4429F0A0_2_00007FF6B4429F0A
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B44287160_2_00007FF6B4428716
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B443BF220_2_00007FF6B443BF22
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B44416CE0_2_00007FF6B44416CE
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B44266C40_2_00007FF6B44266C4
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B445CEEC0_2_00007FF6B445CEEC
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B4426EEC0_2_00007FF6B4426EEC
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B445B6E80_2_00007FF6B445B6E8
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B442777A0_2_00007FF6B442777A
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B443AFAE0_2_00007FF6B443AFAE
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B44527540_2_00007FF6B4452754
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B442176B0_2_00007FF6B442176B
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B444FF600_2_00007FF6B444FF60
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B444D00C0_2_00007FF6B444D00C
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B443D0040_2_00007FF6B443D004
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B444908C0_2_00007FF6B444908C
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B444E8940_2_00007FF6B444E894
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B44210940_2_00007FF6B4421094
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B442C8B20_2_00007FF6B442C8B2
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B443890E0_2_00007FF6B443890E
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B442C0FC0_2_00007FF6B442C0FC
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B44489260_2_00007FF6B4448926
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B442E8EC0_2_00007FF6B442E8EC
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B44220D80_2_00007FF6B44220D8
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B442E1920_2_00007FF6B442E192
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B44289920_2_00007FF6B4428992
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B444217C0_2_00007FF6B444217C
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B443F1480_2_00007FF6B443F148
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B443614C0_2_00007FF6B443614C
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B442693C0_2_00007FF6B442693C
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B442A16E0_2_00007FF6B442A16E
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B44271F60_2_00007FF6B44271F6
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B442F1C70_2_00007FF6B442F1C7
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B44479D80_2_00007FF6B44479D8
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B44282480_2_00007FF6B4428248
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B444FA540_2_00007FF6B444FA54
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B44482500_2_00007FF6B4448250
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B442BA3A0_2_00007FF6B442BA3A
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B443DB2C0_2_00007FF6B443DB2C
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B4427B160_2_00007FF6B4427B16
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B443F31E0_2_00007FF6B443F31E
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B44212B60_2_00007FF6B44212B6
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B442C2F20_2_00007FF6B442C2F2
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B443EBAA0_2_00007FF6B443EBAA
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B443A3AE0_2_00007FF6B443A3AE
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B443FBB40_2_00007FF6B443FBB4
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B442AB960_2_00007FF6B442AB96
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B445FB640_2_00007FF6B445FB64
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B44454140_2_00007FF6B4445414
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B445D4040_2_00007FF6B445D404
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B4437C280_2_00007FF6B4437C28
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B4442C2F0_2_00007FF6B4442C2F
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B4426BCC0_2_00007FF6B4426BCC
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B443C3C20_2_00007FF6B443C3C2
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B44273F40_2_00007FF6B44273F4
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B444048A0_2_00007FF6B444048A
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B44284760_2_00007FF6B4428476
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B445BC9C0_2_00007FF6B445BC9C
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B4429CA40_2_00007FF6B4429CA4
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B442B45A0_2_00007FF6B442B45A
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B442BC620_2_00007FF6B442BC62
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B4447CCD0_2_00007FF6B4447CCD
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B4447CCC0_2_00007FF6B4447CCC
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B44374C40_2_00007FF6B44374C4
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B443B4E40_2_00007FF6B443B4E4
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF6499442E432_2_00007FF6499442E4
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64996825032_2_00007FF649968250
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF6499439FB32_2_00007FF6499439FB
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64996217C32_2_00007FF64996217C
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF6499574C432_2_00007FF6499574C4
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF649967CCC32_2_00007FF649967CCC
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF649957C2832_2_00007FF649957C28
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF6499595A832_2_00007FF6499595A8
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64994E8EC32_2_00007FF64994E8EC
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64996892632_2_00007FF649968926
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64995890E32_2_00007FF64995890E
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64994C2F232_2_00007FF64994C2F2
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF6499412B632_2_00007FF6499412B6
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF6499752C032_2_00007FF6499752C0
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF649947B1632_2_00007FF649947B16
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64995F31E32_2_00007FF64995F31E
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64995DB2C32_2_00007FF64995DB2C
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64994BA3A32_2_00007FF64994BA3A
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64994824832_2_00007FF649948248
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64996FA5432_2_00007FF64996FA54
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF6499679D832_2_00007FF6499679D8
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64994F1C732_2_00007FF64994F1C7
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF6499471F632_2_00007FF6499471F6
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64995520932_2_00007FF649955209
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64994A16E32_2_00007FF64994A16E
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64994693C32_2_00007FF64994693C
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64995614C32_2_00007FF64995614C
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64995F14832_2_00007FF64995F148
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64994E19232_2_00007FF64994E192
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64994899232_2_00007FF649948992
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64995B4E432_2_00007FF64995B4E4
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF6499544C332_2_00007FF6499544C3
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF649967CCD32_2_00007FF649967CCD
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64994B45A32_2_00007FF64994B45A
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64994BC6232_2_00007FF64994BC62
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64997BC9C32_2_00007FF64997BC9C
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF649949CA432_2_00007FF649949CA4
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64994847632_2_00007FF649948476
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64996048A32_2_00007FF64996048A
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF6499473F432_2_00007FF6499473F4
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64995C3C232_2_00007FF64995C3C2
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF649946BCC32_2_00007FF649946BCC
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF649962C2F32_2_00007FF649962C2F
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF6499503FD32_2_00007FF6499503FD
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64997D40432_2_00007FF64997D404
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64996541432_2_00007FF649965414
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64997FB6432_2_00007FF64997FB64
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64994AB9632_2_00007FF64994AB96
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64995EBAA32_2_00007FF64995EBAA
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64995FBB432_2_00007FF64995FBB4
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64995A3AE32_2_00007FF64995A3AE
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64997CEEC32_2_00007FF64997CEEC
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF649946EEC32_2_00007FF649946EEC
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64997B6E832_2_00007FF64997B6E8
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF6499466C432_2_00007FF6499466C4
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64994AED232_2_00007FF64994AED2
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF6499616CE32_2_00007FF6499616CE
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64994871632_2_00007FF649948716
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64995BF2232_2_00007FF64995BF22
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF649949F0A32_2_00007FF649949F0A
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64994CE6432_2_00007FF64994CE64
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF649982E4832_2_00007FF649982E48
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF649947E9832_2_00007FF649947E98
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64994B68A32_2_00007FF64994B68A
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64994BE8E32_2_00007FF64994BE8E
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64994C5BE32_2_00007FF64994C5BE
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF649948E1C32_2_00007FF649948E1C
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64997EE1832_2_00007FF64997EE18
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64994A5F632_2_00007FF64994A5F6
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64996360932_2_00007FF649963609
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64994357532_2_00007FF649943575
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64995CD3632_2_00007FF64995CD36
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64996F5B032_2_00007FF64996F5B0
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF6499420D832_2_00007FF6499420D8
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64994C0FC32_2_00007FF64994C0FC
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64994C8B232_2_00007FF64994C8B2
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64996908C32_2_00007FF64996908C
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64996E89432_2_00007FF64996E894
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64994109432_2_00007FF649941094
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64995D00432_2_00007FF64995D004
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64996D00C32_2_00007FF64996D00C
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64994F80E32_2_00007FF64994F80E
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64996FF6032_2_00007FF64996FF60
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64994176B32_2_00007FF64994176B
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64997275432_2_00007FF649972754
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64995AFAE32_2_00007FF64995AFAE
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64994777A32_2_00007FF64994777A
Source: anchor_x64.exeStatic PE information: Number of sections : 11 > 10
Source: anchor_x64.exe, 00000001.00000002.255677090.0000022B86310000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamenlsbres.dll.muij% vs anchor_x64.exe
Source: anchor_x64.exe, 00000001.00000002.255669152.0000022B86300000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamenlsbres.dllj% vs anchor_x64.exe
Source: anchor_x64.exe, 00000001.00000002.256061058.0000022B86660000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemswsock.dll.muij% vs anchor_x64.exe
Source: anchor_x64.exe, 00000020.00000002.507360594.000001DC64BB0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamenlsbres.dllj% vs anchor_x64.exe
Source: anchor_x64.exe, 00000020.00000002.507368457.000001DC64BC0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamenlsbres.dll.muij% vs anchor_x64.exe
Source: anchor_x64.exe, 00000020.00000002.507378908.000001DC64BD0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemswsock.dll.muij% vs anchor_x64.exe
Source: anchor_x64.exe, 00000023.00000002.808208554.0000023311A20000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemswsock.dll.muij% vs anchor_x64.exe
Source: anchor_x64.exe, 00000023.00000002.808180653.0000023311A00000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamenlsbres.dllj% vs anchor_x64.exe
Source: anchor_x64.exe, 00000023.00000002.808190266.0000023311A10000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamenlsbres.dll.muij% vs anchor_x64.exe
Source: classification engineClassification label: mal76.troj.evad.winEXE@4/2@293/3
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 0_2_00007FF6B444048A GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,CreateDesktopA,Sleep,CloseDesktop,GetLastError,GetLastError,GetLastError,CloseHandle,0_2_00007FF6B444048A
Source: C:\Users\user\Desktop\anchor_x64.exeCode function: 32_2_00007FF64996048A GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,CreateDesktopA,Sleep,CloseDesktop,GetLastError,GetLastError,GetLastError,CloseHandle,32_2_00007FF64996048A
Source: C:\Users\user\Desktop\anchor_x64.exeFile created: C:\Users\user\Desktop\anchor_x64.exe: $dataJump to behavior
Source: anchor_x64.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\anchor_x64.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\anchor_x64.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: anchor_x64.exeVirustotal: Detection: 39%
Source: anchor_x64.exeMetadefender: Detection: 13%
Source: anchor_x64.exeReversingLabs: Detection: 34%
Source: unknownProcess created: C:\Users\user\Desktop\anchor_x64.exe 'C:\Users\user\Desktop\anchor_x64.exe'
Source: unknownProcess created: C:\Users\user\Desktop\anchor_x64.exe C:\Users\user\Desktop\anchor_x64.exe -u
Source: unknownProcess created: C:\Users\user\Desktop\anchor_x64.exe C:\Users\user\Desktop\anchor_x64.exe -u
Source: unknownProcess created: C:\Users\user\Desktop\anchor_x64.exe C:\Users\user\Desktop\anchor_x64.exe -u
Source: C:\Users\user\Desktop\anchor_x64.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32Jump to behavior
Source: anchor_x64.exeStatic PE information: Image base 0x140000000 > 0x60000000
Source: anchor_x64.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: anchor_x64.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: anchor_x64.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: anchor_x64.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: anchor_x64.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: anchor_x64.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: anchor_x64.exeStatic PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Source: anchor_x64.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: Z:\D\GIT\anchorDns.llvm\Bin\x64\Release\anchorDNS_x64.pdbt source: anchor_x64.exe
Source: Binary string: Z:\D\GIT\anchorDns.llvm\Bin\x64\Release\anchorDNS_x64.pdb source: anchor_x64.exe