Windows Analysis Report
Inquiry No PJO-4010574.exe

Overview

General Information

Sample name: Inquiry No PJO-4010574.exe
Analysis ID: 1466207
MD5: 90c9561f85a75295bab33f82962e9c35
SHA1: b1636d78e8c8f81d201c01375d19c77094e7e48c
SHA256: a7b52cf2515d8262cdbea58597fb73cb7ff5a9d1cf82e232cf186d0947b17f7c
Tags: exe
Infos:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Yara detected AntiVM3
Yara detected FormBook
.NET source code contains potential unpacker
.NET source code contains very large array initializations
.NET source code contains very large strings
AI detected suspicious sample
Found direct / indirect Syscall (likely to bypass EDR)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Antivirus detection for URL or domain
Source: http://www.capheconde.com/assets/404_files/style.css Avira URL Cloud: Label: malware
Source: http://www.capheconde.com/9qp1/ Avira URL Cloud: Label: malware
Source: http://www.capheconde.com/9qp1/?L480=nFsp&iHmHOtK=piAR+Ff1iHDjdou/rhEQcU2b6yhYr5PYXWk6yO0m5khCtjLWm0pVMCsJ6m/O3zZYbcRJdhVWYb2ADKDO+u4ZlLMBcWRMf05zG4E+9fsN2UBlQi8qbNBOF5k= Avira URL Cloud: Label: malware
Source: http://www.capheconde.com/ Avira URL Cloud: Label: malware
Multi AV Scanner detection for submitted file
Source: Inquiry No PJO-4010574.exe ReversingLabs: Detection: 36%
Yara detected FormBook
Source: Yara match File source: 2.2.Inquiry No PJO-4010574.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.Inquiry No PJO-4010574.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000007.00000002.4106839112.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.1994362170.0000000001910000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.1992596406.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.4105792819.0000000002C50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.4106877602.0000000003930000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.4109293629.0000000005670000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.1994602722.0000000002E20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.4107064100.0000000003280000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Uses 32bit PE files
Source: Inquiry No PJO-4010574.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: Inquiry No PJO-4010574.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: w32tm.pdb source: Inquiry No PJO-4010574.exe, 00000002.00000002.1992887320.0000000001028000.00000004.00000020.00020000.00000000.sdmp, HeKTvWjrtOUnkuZfNlEvF.exe, 00000006.00000002.4106112279.0000000000748000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: aKtF.pdbSHA256 source: Inquiry No PJO-4010574.exe
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: HeKTvWjrtOUnkuZfNlEvF.exe, 00000006.00000000.1907354628.000000000088E000.00000002.00000001.01000000.0000000C.sdmp, HeKTvWjrtOUnkuZfNlEvF.exe, 00000008.00000000.2059831890.000000000088E000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: wntdll.pdbUGP source: Inquiry No PJO-4010574.exe, 00000002.00000002.1993291852.00000000015C0000.00000040.00001000.00020000.00000000.sdmp, w32tm.exe, 00000007.00000003.1992866888.0000000003061000.00000004.00000020.00020000.00000000.sdmp, w32tm.exe, 00000007.00000002.4107154870.000000000355E000.00000040.00001000.00020000.00000000.sdmp, w32tm.exe, 00000007.00000002.4107154870.00000000033C0000.00000040.00001000.00020000.00000000.sdmp, w32tm.exe, 00000007.00000003.1995659709.0000000003210000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: Inquiry No PJO-4010574.exe, Inquiry No PJO-4010574.exe, 00000002.00000002.1993291852.00000000015C0000.00000040.00001000.00020000.00000000.sdmp, w32tm.exe, w32tm.exe, 00000007.00000003.1992866888.0000000003061000.00000004.00000020.00020000.00000000.sdmp, w32tm.exe, 00000007.00000002.4107154870.000000000355E000.00000040.00001000.00020000.00000000.sdmp, w32tm.exe, 00000007.00000002.4107154870.00000000033C0000.00000040.00001000.00020000.00000000.sdmp, w32tm.exe, 00000007.00000003.1995659709.0000000003210000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: aKtF.pdb source: Inquiry No PJO-4010574.exe
Source: Binary string: w32tm.pdbGCTL source: Inquiry No PJO-4010574.exe, 00000002.00000002.1992887320.0000000001028000.00000004.00000020.00020000.00000000.sdmp, HeKTvWjrtOUnkuZfNlEvF.exe, 00000006.00000002.4106112279.0000000000748000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_02C6BCA0 FindFirstFileW,FindNextFileW,FindClose, 7_2_02C6BCA0
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 4x nop then xor eax, eax 7_2_02C59820
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 4x nop then pop edi 7_2_02C5DEA7
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 4x nop then mov ebx, 00000004h 7_2_03710548

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.4:49743 -> 170.130.64.114:80
Source: Traffic Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.4:49745 -> 107.149.174.220:80
Source: Traffic Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.4:49746 -> 107.149.174.220:80
Source: Traffic Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.4:49748 -> 107.149.174.220:80
Source: Traffic Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.4:49749 -> 188.114.97.3:80
Source: Traffic Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.4:49750 -> 188.114.97.3:80
Source: Traffic Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.4:49752 -> 188.114.97.3:80
Source: Traffic Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.4:49753 -> 103.224.182.250:80
Source: Traffic Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.4:49754 -> 103.224.182.250:80
Source: Traffic Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.4:49756 -> 103.224.182.250:80
Source: Traffic Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.4:49757 -> 203.161.49.220:80
Source: Traffic Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.4:49758 -> 203.161.49.220:80
Source: Traffic Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.4:49760 -> 203.161.49.220:80
Source: Traffic Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.4:49761 -> 212.32.237.101:80
Source: Traffic Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.4:49762 -> 212.32.237.101:80
Source: Traffic Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.4:49764 -> 212.32.237.101:80
Source: Traffic Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.4:49765 -> 217.160.0.85:80
Source: Traffic Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.4:49766 -> 217.160.0.85:80
Source: Traffic Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.4:49768 -> 217.160.0.85:80
Source: Traffic Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.4:49769 -> 162.43.101.114:80
Source: Traffic Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.4:49770 -> 162.43.101.114:80
Source: Traffic Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.4:49772 -> 162.43.101.114:80
Source: Traffic Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.4:49773 -> 116.193.69.142:80
Source: Traffic Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.4:49774 -> 116.193.69.142:80
Source: Traffic Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.4:49776 -> 116.193.69.142:80
Source: Traffic Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.4:49777 -> 103.42.144.60:80
Source: Traffic Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.4:49778 -> 103.42.144.60:80
Source: Traffic Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.4:49780 -> 103.42.144.60:80
Source: Traffic Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.4:49781 -> 188.114.96.3:80
Source: Traffic Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.4:49782 -> 188.114.96.3:80
Performs DNS queries to domains with low reputation
Source: DNS query: www.techsterverse.xyz
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 116.193.69.142 116.193.69.142
Source: Joe Sandbox View IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View IP Address: 188.114.97.3 188.114.97.3
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: QTSC-AS-VNQuangTrungSoftwareCityDevelopmentCompanyVN QTSC-AS-VNQuangTrungSoftwareCityDevelopmentCompanyVN
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View ASN Name: LEASEWEB-NL-AMS-01NetherlandsNL LEASEWEB-NL-AMS-01NetherlandsNL
Source: Joe Sandbox View ASN Name: TRELLIAN-AS-APTrellianPtyLimitedAU TRELLIAN-AS-APTrellianPtyLimitedAU
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKdate: Tue, 02 Jul 2024 15:26:17 GMTserver: Apacheset-cookie: __tad=1719933977.7931131; expires=Fri, 30-Jun-2034 15:26:17 GMT; Max-Age=315360000vary: Accept-Encodingcontent-encoding: gzipcontent-length: 142content-type: text/html; charset=UTF-8connection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 25 8e 4b 0e c2 30 0c 44 d7 f8 14 26 ac 43 38 80 9b 05 37 c9 8f b6 60 48 d5 5a 88 de 9e 34 9e d5 cc 48 f3 6c 9a e4 cd 1e 80 a6 12 b2 07 92 59 b8 f8 91 6b 0c 9c d6 92 af a9 92 d3 12 68 4b eb bc 08 ca be 94 c1 48 f9 89 7b 86 6f d0 d6 34 08 90 d3 a0 5e 91 cd c5 9a 77 8c 63 aa 5c d7 c1 5c 1e 5d 06 0f 42 8b b7 ae b6 3f d1 d9 5a bc 73 f8 bc 10 ad 6d 07 dd b1 f4 9d a5 6f c2 1f 55 63 04 db b0 00 00 00 Data Ascii: %K0D&C87`HZ4HlYkhKH{o4^wc\\]B?ZsmoUc
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKdate: Tue, 02 Jul 2024 15:26:19 GMTserver: Apacheset-cookie: __tad=1719933979.1260067; expires=Fri, 30-Jun-2034 15:26:19 GMT; Max-Age=315360000vary: Accept-Encodingcontent-encoding: gzipcontent-length: 142content-type: text/html; charset=UTF-8connection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 25 8e 4b 0e c2 30 0c 44 d7 f8 14 26 ac 43 38 80 9b 05 37 c9 8f b6 60 48 d5 5a 88 de 9e 34 9e d5 cc 48 f3 6c 9a e4 cd 1e 80 a6 12 b2 07 92 59 b8 f8 91 6b 0c 9c d6 92 af a9 92 d3 12 68 4b eb bc 08 ca be 94 c1 48 f9 89 7b 86 6f d0 d6 34 08 90 d3 a0 5e 91 cd c5 9a 77 8c 63 aa 5c d7 c1 5c 1e 5d 06 0f 42 8b b7 ae b6 3f d1 d9 5a bc 73 f8 bc 10 ad 6d 07 dd b1 f4 9d a5 6f c2 1f 55 63 04 db b0 00 00 00 Data Ascii: %K0D&C87`HZ4HlYkhKH{o4^wc\\]B?ZsmoUc
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKdate: Tue, 02 Jul 2024 15:26:22 GMTserver: Apacheset-cookie: __tad=1719933982.7873299; expires=Fri, 30-Jun-2034 15:26:22 GMT; Max-Age=315360000vary: Accept-Encodingcontent-encoding: gzipcontent-length: 142content-type: text/html; charset=UTF-8connection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 25 8e 4b 0e c2 30 0c 44 d7 f8 14 26 ac 43 38 80 9b 05 37 c9 8f b6 60 48 d5 5a 88 de 9e 34 9e d5 cc 48 f3 6c 9a e4 cd 1e 80 a6 12 b2 07 92 59 b8 f8 91 6b 0c 9c d6 92 af a9 92 d3 12 68 4b eb bc 08 ca be 94 c1 48 f9 89 7b 86 6f d0 d6 34 08 90 d3 a0 5e 91 cd c5 9a 77 8c 63 aa 5c d7 c1 5c 1e 5d 06 0f 42 8b b7 ae b6 3f d1 d9 5a bc 73 f8 bc 10 ad 6d 07 dd b1 f4 9d a5 6f c2 1f 55 63 04 db b0 00 00 00 Data Ascii: %K0D&C87`HZ4HlYkhKH{o4^wc\\]B?ZsmoUc
Source: global traffic HTTP traffic detected: GET /os51/?L480=nFsp&iHmHOtK=c6Au0o4JaGbiIJhi/W9FlVa+W6eKgbIavfE1EfL2H5qYfZI58C4g2l7MAq/uJtf/bSwml0Abw9HN8qCtjnIFaNOIwu03UJk5/xo8eM0g569x/yUzTt9lNQI= HTTP/1.1Host: www.pblfishing.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 7_1 like Mac OS X) AppleWebKit (KHTML, like Gecko) Mobile (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)
Source: global traffic HTTP traffic detected: GET /4ymg/?iHmHOtK=nFZYYf4wbY50wWAChatr++kDEPB15Qhq/x7aQ1H7vt9GgS0wKUnOaHYV5VLziWgziYgeq4JZlKaG5KVexDT+ezFRclyCTcpNeugmvQJUYmTxZwPnAH2U+gM=&L480=nFsp HTTP/1.1Host: www.balifafa.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 7_1 like Mac OS X) AppleWebKit (KHTML, like Gecko) Mobile (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)
Source: global traffic HTTP traffic detected: GET /2zff/?iHmHOtK=4L8xoD0W4Zo4sy88OPxzXkM4Et1OXrliZZOBxyE5jHDJEgkxN8cq+PG6NIXzy1XRCqQIvL5VyJCknvUNNLKk7znic/DfJyEGJbg1Pv28u2ofuxZkWteJjYs=&L480=nFsp HTTP/1.1Host: www.oc7o0.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 7_1 like Mac OS X) AppleWebKit (KHTML, like Gecko) Mobile (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)
Source: global traffic HTTP traffic detected: GET /q9jb/?L480=nFsp&iHmHOtK=j0olB4pKJNfBpTyLtiZxxDaYJCDISEWNP33SxFqZDhQbPJdYHiw3UTQ1/R0QXxI3ie6VZCuGDc6mq4FLm2kA6W78v7HmGQDG94BebamJgmWwFfSc9SoNlnA= HTTP/1.1Host: www.globalcred.coAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 7_1 like Mac OS X) AppleWebKit (KHTML, like Gecko) Mobile (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)
Source: global traffic HTTP traffic detected: GET /5ane/?iHmHOtK=WTbBFWOTcFPDCMhESefslTJ6+GkUog7y940HcquptONdD9QmK5HdLPKC5ymHK27F/BdIZvlTb7atmdZ+8u/HwzLeEe0DEJwM8vfrVi/4VNBsPllMeibbLgY=&L480=nFsp HTTP/1.1Host: www.techsterverse.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 7_1 like Mac OS X) AppleWebKit (KHTML, like Gecko) Mobile (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)
Source: global traffic HTTP traffic detected: GET /zxku/?L480=nFsp&iHmHOtK=LzaBpmw0qv0cK+7U3N9wzWvH1rfTwbRorxIVpXGhhpJEoQVn8DIg0i9de8yEo76YxD/IFdbD3aZ704STPEL3y7t+BH8DETSF9Xq3zszk+n+o3arCieFg2Q4= HTTP/1.1Host: www.relationshipfirst.usAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 7_1 like Mac OS X) AppleWebKit (KHTML, like Gecko) Mobile (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)
Source: global traffic HTTP traffic detected: GET /wryo/?iHmHOtK=LrRmgYPs8LsdxbzfghU7Rrkcqn/uiUbIhXBev7x5iSFC7eFMAdqrv0qIY78m6am6UfdI85MNKFNBcaa15Zv4z5hxclPHNGb5wEZvbrXrYulKcXi85eVkiLQ=&L480=nFsp HTTP/1.1Host: www.bloomvice.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 7_1 like Mac OS X) AppleWebKit (KHTML, like Gecko) Mobile (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)
Source: global traffic HTTP traffic detected: GET /c0wr/?iHmHOtK=I4+9foIZEqozW1CrO2Wz7/DZoylmFTPmq9Ir5hkT/AZ8BMXZmPqfikD+B7Zsb9R0Gx6spdbB+zho64Hj/e3L4EYjhZFv4l597JlEzTSXx7nmICgHg7bGrac=&L480=nFsp HTTP/1.1Host: www.tedjp-x.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 7_1 like Mac OS X) AppleWebKit (KHTML, like Gecko) Mobile (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)
Source: global traffic HTTP traffic detected: GET /9qp1/?L480=nFsp&iHmHOtK=piAR+Ff1iHDjdou/rhEQcU2b6yhYr5PYXWk6yO0m5khCtjLWm0pVMCsJ6m/O3zZYbcRJdhVWYb2ADKDO+u4ZlLMBcWRMf05zG4E+9fsN2UBlQi8qbNBOF5k= HTTP/1.1Host: www.capheconde.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 7_1 like Mac OS X) AppleWebKit (KHTML, like Gecko) Mobile (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)
Source: global traffic HTTP traffic detected: GET /lhex/?iHmHOtK=AKDeU1MOdy2C7+0oZjuGTQm02UaFJku+bqnfKxS0A3LFBkNctrgbipmQYZQ6LZYpsVs9A7W3lG5h26zbDb4ShZiTrehhnNvLwO/B2qpeC52tMHhlrRNDNmI=&L480=nFsp HTTP/1.1Host: www.pp887300.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 7_1 like Mac OS X) AppleWebKit (KHTML, like Gecko) Mobile (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)
Source: global traffic DNS traffic detected: DNS query: www.pblfishing.com
Source: global traffic DNS traffic detected: DNS query: www.balifafa.com
Source: global traffic DNS traffic detected: DNS query: www.newzionocala.com
Source: global traffic DNS traffic detected: DNS query: www.oc7o0.top
Source: global traffic DNS traffic detected: DNS query: www.globalcred.co
Source: global traffic DNS traffic detected: DNS query: www.techsterverse.xyz
Source: global traffic DNS traffic detected: DNS query: www.relationshipfirst.us
Source: global traffic DNS traffic detected: DNS query: www.bloomvice.com
Source: global traffic DNS traffic detected: DNS query: www.colva.info
Source: global traffic DNS traffic detected: DNS query: www.tedjp-x.com
Source: global traffic DNS traffic detected: DNS query: www.capheconde.com
Source: global traffic DNS traffic detected: DNS query: www.pp887300.com
Source: global traffic DNS traffic detected: DNS query: www.ad14.fun
Source: unknown HTTP traffic detected: POST /4ymg/ HTTP/1.1Host: www.balifafa.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, brAccept-Language: en-USOrigin: http://www.balifafa.comReferer: http://www.balifafa.com/4ymg/Content-Length: 204Connection: closeContent-Type: application/x-www-form-urlencodedCache-Control: no-cacheUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 7_1 like Mac OS X) AppleWebKit (KHTML, like Gecko) Mobile (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)Data Raw: 69 48 6d 48 4f 74 4b 3d 71 48 78 34 62 72 4d 52 4a 5a 4e 45 6e 57 41 46 71 2f 30 4a 33 64 70 6c 49 74 5a 38 77 69 46 34 2f 6d 47 4e 62 32 61 61 6e 64 42 45 69 43 31 41 52 44 54 42 66 41 45 59 77 30 62 43 79 46 5a 4a 75 5a 41 62 76 4a 46 71 70 36 65 46 34 4d 31 30 77 41 7a 55 4c 41 39 57 61 55 65 36 63 66 63 32 4d 4c 4d 35 70 44 56 67 49 6c 62 47 53 42 6a 50 42 41 4f 6e 35 69 6e 63 38 74 64 45 78 43 2b 56 70 39 31 77 64 4b 66 74 6d 4b 62 53 32 35 64 6a 6b 56 7a 36 55 4c 4b 33 6d 7a 52 56 53 6e 62 4e 44 73 62 73 56 76 59 52 66 4c 70 4d 46 30 6c 67 78 31 62 4f 4a 64 55 55 77 65 42 65 35 36 7a 79 68 77 3d 3d Data Ascii: iHmHOtK=qHx4brMRJZNEnWAFq/0J3dplItZ8wiF4/mGNb2aandBEiC1ARDTBfAEYw0bCyFZJuZAbvJFqp6eF4M10wAzULA9WaUe6cfc2MLM5pDVgIlbGSBjPBAOn5inc8tdExC+Vp91wdKftmKbS25djkVz6ULK3mzRVSnbNDsbsVvYRfLpMF0lgx1bOJdUUweBe56zyhw==
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/8.5X-Powered-By: ASP.NETDate: Tue, 02 Jul 2024 15:25:14 GMTConnection: closeContent-Length: 1163Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e b7 fe ce f1 c6 f7 b4 ed ce f3 3c 2f
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/8.5X-Powered-By: ASP.NETDate: Tue, 02 Jul 2024 15:25:16 GMTConnection: closeContent-Length: 1163Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e b7 fe ce f1 c6 f7 b4 ed ce f3 3c 2f
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/8.5X-Powered-By: ASP.NETDate: Tue, 02 Jul 2024 15:25:19 GMTConnection: closeContent-Length: 1163Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e b7 fe ce f1 c6 f7 b4 ed ce f3 3c 2f
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/8.5X-Powered-By: ASP.NETDate: Tue, 02 Jul 2024 15:25:21 GMTConnection: closeContent-Length: 1163Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e b7 fe ce f1 c6 f7 b4 ed ce f3 3c 2f
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 02 Jul 2024 15:26:30 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 02 Jul 2024 15:26:33 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 02 Jul 2024 15:26:35 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 02 Jul 2024 15:26:38 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Tue, 02 Jul 2024 15:26:58 GMTServer: ApacheContent-Encoding: gzipData Raw: 31 37 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f c3 30 0c be ef 57 98 70 4e b3 32 0e 5b d7 ee c0 36 09 a4 f1 10 14 01 c7 d0 ba 6b 44 9a 94 d4 a3 1b bf 9e b4 e3 2d c4 c9 4e f4 3d ec cf f1 c1 e2 72 9e 3e 5c 2d a1 a4 4a c3 d5 ed c9 ea 6c 0e 8c 0b 71 37 9a 0b b1 48 17 70 7f 9a 9e af 20 0c 86 90 3a 69 1a 45 ca 1a a9 85 58 5e b0 01 2b 89 ea 48 88 b6 6d 83 76 14 58 b7 16 e9 b5 d8 76 5a 61 47 7e 6f 39 7d 63 06 39 e5 6c 36 88 7b 43 2d cd 3a 61 68 18 6c 2b 1d fd 78 99 26 f9 43 3e 9c 4c 26 7b 55 af 01 71 89 32 f7 15 62 52 a4 b1 eb 60 e9 9c 75 70 3c 3c 06 0e 17 96 a0 b0 1b 93 77 10 f1 89 89 2b 24 09 99 35 84 86 12 46 b8 25 d1 8d 33 85 ac 94 ae 41 4a 36 54 f0 31 f3 a1 50 cd f1 79 a3 5e 12 36 df c3 79 ba ab b1 f3 86 5f 2a c6 f2 4c 66 25 fe 64 f5 5f bc b3 72 56 f7 23 8b f7 99 e3 47 9b ef a0 a1 9d c6 84 15 1e c0 0b 59 29 bd 8b a4 53 52 4f f7 16 65 f8 81 c8 ac b6 2e 3a 1c ca d1 d1 38 9b f6 f8 46 bd 62 e4 0f 83 d5 1e fd cf ea 65 d8 4f 5c 7f a8 7d f1 87 c1 f8 93 bf 50 08 fe 20 b8 c6 47 34 08 37 a8 08 e1 c9 1a 9f 13 18 95 95 04 6b 2c 7c 9a 68 a0 45 e7 4b d0 e7 5a 7b ed 58 74 eb f8 b3 f6 41 ce 06 6f 0c cc 0d 5b 59 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 173}QKO0WpN2[6kD-N=r>\-Jlq7Hp :iEX^+HmvXvZaG~o9}c9l6{C-:ahl+x&C>L&{Uq2bR`up<<w+$5F%3AJ6T1Py^6y_*Lf%d_rV#GY)SROe.:8FbeO\}P G47k,|hEKZ{XtAo[Y0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Tue, 02 Jul 2024 15:27:01 GMTServer: ApacheContent-Encoding: gzipData Raw: 31 37 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f c3 30 0c be ef 57 98 70 4e b3 32 0e 5b d7 ee c0 36 09 a4 f1 10 14 01 c7 d0 ba 6b 44 9a 94 d4 a3 1b bf 9e b4 e3 2d c4 c9 4e f4 3d ec cf f1 c1 e2 72 9e 3e 5c 2d a1 a4 4a c3 d5 ed c9 ea 6c 0e 8c 0b 71 37 9a 0b b1 48 17 70 7f 9a 9e af 20 0c 86 90 3a 69 1a 45 ca 1a a9 85 58 5e b0 01 2b 89 ea 48 88 b6 6d 83 76 14 58 b7 16 e9 b5 d8 76 5a 61 47 7e 6f 39 7d 63 06 39 e5 6c 36 88 7b 43 2d cd 3a 61 68 18 6c 2b 1d fd 78 99 26 f9 43 3e 9c 4c 26 7b 55 af 01 71 89 32 f7 15 62 52 a4 b1 eb 60 e9 9c 75 70 3c 3c 06 0e 17 96 a0 b0 1b 93 77 10 f1 89 89 2b 24 09 99 35 84 86 12 46 b8 25 d1 8d 33 85 ac 94 ae 41 4a 36 54 f0 31 f3 a1 50 cd f1 79 a3 5e 12 36 df c3 79 ba ab b1 f3 86 5f 2a c6 f2 4c 66 25 fe 64 f5 5f bc b3 72 56 f7 23 8b f7 99 e3 47 9b ef a0 a1 9d c6 84 15 1e c0 0b 59 29 bd 8b a4 53 52 4f f7 16 65 f8 81 c8 ac b6 2e 3a 1c ca d1 d1 38 9b f6 f8 46 bd 62 e4 0f 83 d5 1e fd cf ea 65 d8 4f 5c 7f a8 7d f1 87 c1 f8 93 bf 50 08 fe 20 b8 c6 47 34 08 37 a8 08 e1 c9 1a 9f 13 18 95 95 04 6b 2c 7c 9a 68 a0 45 e7 4b d0 e7 5a 7b ed 58 74 eb f8 b3 f6 41 ce 06 6f 0c cc 0d 5b 59 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 173}QKO0WpN2[6kD-N=r>\-Jlq7Hp :iEX^+HmvXvZaG~o9}c9l6{C-:ahl+x&C>L&{Uq2bR`up<<w+$5F%3AJ6T1Py^6y_*Lf%d_rV#GY)SROe.:8FbeO\}P G47k,|hEKZ{XtAo[Y0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Tue, 02 Jul 2024 15:27:04 GMTServer: ApacheContent-Encoding: gzipData Raw: 31 37 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f c3 30 0c be ef 57 98 70 4e b3 32 0e 5b d7 ee c0 36 09 a4 f1 10 14 01 c7 d0 ba 6b 44 9a 94 d4 a3 1b bf 9e b4 e3 2d c4 c9 4e f4 3d ec cf f1 c1 e2 72 9e 3e 5c 2d a1 a4 4a c3 d5 ed c9 ea 6c 0e 8c 0b 71 37 9a 0b b1 48 17 70 7f 9a 9e af 20 0c 86 90 3a 69 1a 45 ca 1a a9 85 58 5e b0 01 2b 89 ea 48 88 b6 6d 83 76 14 58 b7 16 e9 b5 d8 76 5a 61 47 7e 6f 39 7d 63 06 39 e5 6c 36 88 7b 43 2d cd 3a 61 68 18 6c 2b 1d fd 78 99 26 f9 43 3e 9c 4c 26 7b 55 af 01 71 89 32 f7 15 62 52 a4 b1 eb 60 e9 9c 75 70 3c 3c 06 0e 17 96 a0 b0 1b 93 77 10 f1 89 89 2b 24 09 99 35 84 86 12 46 b8 25 d1 8d 33 85 ac 94 ae 41 4a 36 54 f0 31 f3 a1 50 cd f1 79 a3 5e 12 36 df c3 79 ba ab b1 f3 86 5f 2a c6 f2 4c 66 25 fe 64 f5 5f bc b3 72 56 f7 23 8b f7 99 e3 47 9b ef a0 a1 9d c6 84 15 1e c0 0b 59 29 bd 8b a4 53 52 4f f7 16 65 f8 81 c8 ac b6 2e 3a 1c ca d1 d1 38 9b f6 f8 46 bd 62 e4 0f 83 d5 1e fd cf ea 65 d8 4f 5c 7f a8 7d f1 87 c1 f8 93 bf 50 08 fe 20 b8 c6 47 34 08 37 a8 08 e1 c9 1a 9f 13 18 95 95 04 6b 2c 7c 9a 68 a0 45 e7 4b d0 e7 5a 7b ed 58 74 eb f8 b3 f6 41 ce 06 6f 0c cc 0d 5b 59 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 173}QKO0WpN2[6kD-N=r>\-Jlq7Hp :iEX^+HmvXvZaG~o9}c9l6{C-:ahl+x&C>L&{Uq2bR`up<<w+$5F%3AJ6T1Py^6y_*Lf%d_rV#GY)SROe.:8FbeO\}P G47k,|hEKZ{XtAo[Y0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlContent-Length: 601Connection: closeDate: Tue, 02 Jul 2024 15:27:06 GMTServer: ApacheData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 61 72 69 61 6c 3b 22 3e 0a 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 30 61 33 32 38 63 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 30 65 6d 3b 22 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 68 31 3e 0a 20 20 3c 70 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 30 2e 38 65 6d 3b 22 3e 0a 20 20 20 44 69 65 20 61 6e 67 65 67 65 62 65 6e 65 20 53 65 69 74 65 20 6b 6f 6e 6e 74 65 20 6e 69 63 68 74 20 67 65 66 75 6e 64 65 6e 20 77 65 72 64 65 6e 2e 0a 20 20 3c 2f 70 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Error 404 - Not found </title> <meta content="text/html; charset=utf-8" http-equiv="Content-Type"> <meta content="no-cache" http-equiv="cache-control"> </head> <body style="font-family:arial;"> <h1 style="color:#0a328c;font-size:1.0em;"> Error 404 - Not found </h1> <p style="font-size:0.8em;"> Die angegebene Seite konnte nicht gefunden werden. </p> </body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 02 Jul 2024 15:29:00 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 07 Nov 2023 07:43:14 GMTETag: W/"afe-6098b1f8c138d"Content-Encoding: brData Raw: 35 31 33 0d 0a c1 e8 57 00 00 bf bd a8 fb ce fd 7c bd 5d 84 c4 aa b8 8e 93 34 19 8e 63 21 75 ed 36 e8 d6 aa 63 6c 7c a1 b3 7d 89 8f 9d ef 2c fb 92 26 4c f9 fb 48 73 87 06 ad 58 b5 56 b4 a5 9d 8a e8 04 a5 b0 8e 81 5a 21 3e 3a 21 7e 68 57 7e 56 21 f1 af f9 eb e2 5c b3 06 cd c6 74 77 6f 61 0c c3 76 48 9f 6b b3 28 4b 4e b8 9f 30 c5 f0 c1 24 08 a2 45 b0 28 86 38 4d 82 86 0f 96 4f d0 52 2d 36 31 19 0c 06 53 4b aa 13 d9 81 5f 0e 9e 2b b8 b5 6d 9a 74 ea 5d 78 57 ae cf 4f 7f f4 c9 c2 0c c4 2a e1 3e f2 62 95 70 e0 44 74 5a f8 33 82 7d e4 c5 94 44 3e f2 12 aa 08 84 31 c9 72 aa 5a 78 e6 de b4 f5 c1 02 06 db 47 9e 62 8a 53 bf 56 ae c1 2c e3 14 ee 48 05 b3 b2 2b 22 cf 56 4c 71 ea 23 ff 4b 04 49 68 0b 87 32 1d 64 ac 13 2b 0c a1 14 8a 0a d5 c2 d3 e3 2f 80 07 77 67 16 3f 9e 59 84 5b 22 9c c4 f7 cc 4c 06 52 e5 e7 d2 5b 77 ae cf 3c 28 cd ce cf cd cd df 07 c3 a6 9a d7 63 74 29 95 d9 1e bf c4 22 15 b7 22 da 63 21 b5 06 be 50 62 82 29 46 b8 95 87 84 d3 96 33 59 2e 25 4c b0 a4 9b 8c de 16 fb c8 cb d5 80 53 50 83 94 b6 b0 a2 7d 65 87 79 8e 7d 34 01 8f 10 00 40 42 b2 0e 13 2e 94 9b 67 65 4a a2 88 89 ce 51 1a 22 96 74 4c 03 81 cc 22 9a 4d d1 2e df 89 c7 1a 8b d3 b6 72 a1 42 93 26 1a 22 1d b0 e7 1e b2 47 b3 36 97 4b d6 c0 85 3c cc 24 e7 99 ce 09 48 f8 b0 93 c9 ae 88 5c 28 56 83 c6 7b 41 a3 89 86 28 90 d1 20 e7 9f a0 2d 85 b2 da 24 61 7c e0 02 36 7f 19 6d ce cd 57 b8 04 b7 29 cb 06 b2 04 78 fc 62 fc 3b 8c 7f 35 1b 66 d3 ec 9b 27 b8 04 f8 f6 5d 58 b8 21 55 cc 42 5c 02 6c 7e 33 67 e6 6b 73 b4 fe ca 6c c0 42 26 e1 7e 15 97 00 df 64 19 e9 30 21 e1 43 f2 b0 0b 37 a4 8a 59 08 0b 99 c4 25 c8 89 c8 ad 9c 66 ac dd 44 00 00 09 3f cf 71 26 a8 15 53 d6 89 95 0b ce 64 ad 89 36 9c b3 cf a9 0b 8d a9 77 6a dc 43 d1 be b2 08 67 1d e1 42 48 85 a2 d9 5c 6c 28 b9 cc 5c 58 8a 99 a2 74 35 38 25 e3 40 13 95 5a da 6f 4e 58 4b 39 c7 04 92 47 6e 02 0b 09 50 0c 09 a4 7a 30 90 4a c9 c4 85 4a 39 0d 50 fd e0 4d ca 7b 54 b1 90 94 d8 f0 86 28 ae e4 55 aa 4d 05 4f b4 7d 25 1a 03 0f 51 1a 0d bb e5 1d 32 54 fb 54 ca 6c cd 24 ed a7 9c 30 91 0e b7 ef 21 96 92 a9 0b 4e da 87 5c 72 16 41 b1 dd 56 9a d8 00 41 d2 97 48 fd e4 14 40 0b 57 cb 69 1f 48 57 49 07 03 a2 e5 d4 bd 50 31 24 dd 9c 16 3f cc 69 5b 19 51 ce 08 22 45 b9 c5 7a bd 2e 81 56 5d c6 a9 52 34 b3 f2 94 84 49 54 bb 85 47 83 56 ae 59 6c 3d ef d3 40 f6 53 01 b5 d4 99 aa 01 9a 9d 59 a2 dd ac 90 df 69 c8 9e 80 d6 db 67 40 08 c0 6c 9b d3 d1 ae 39 30 c7 e6 4b 73 89 50 6b 3b 15 26 6c f4 7e 42 23 46 40 0a 3e 80 3c cc 28 15 40 44 04 ef 26 4c 7c c3 79 2e 94 af 0e a7 49 3f be 51 6f a4 fd ab f0 08 15 8a 01 61 b5 50 28 30 8e 94 30 9d ee 76 0b 43 54 58 2b ed 85 42 4f b5 57 ea f3 23 f3 94 08 a3 48 3d 40 c6 8a ee b0 1d 26 b0 4a d5 90 66 4e a1 d0 b9 b8 f7 ec da 54 78 85 a8 a4 05 f8 8a f0 32 15 38 6
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 02 Jul 2024 15:29:03 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 07 Nov 2023 07:43:14 GMTETag: W/"afe-6098b1f8c138d"Content-Encoding: brData Raw: 35 31 33 0d 0a c1 e8 57 00 00 bf bd a8 fb ce fd 7c bd 5d 84 c4 aa b8 8e 93 34 19 8e 63 21 75 ed 36 e8 d6 aa 63 6c 7c a1 b3 7d 89 8f 9d ef 2c fb 92 26 4c f9 fb 48 73 87 06 ad 58 b5 56 b4 a5 9d 8a e8 04 a5 b0 8e 81 5a 21 3e 3a 21 7e 68 57 7e 56 21 f1 af f9 eb e2 5c b3 06 cd c6 74 77 6f 61 0c c3 76 48 9f 6b b3 28 4b 4e b8 9f 30 c5 f0 c1 24 08 a2 45 b0 28 86 38 4d 82 86 0f 96 4f d0 52 2d 36 31 19 0c 06 53 4b aa 13 d9 81 5f 0e 9e 2b b8 b5 6d 9a 74 ea 5d 78 57 ae cf 4f 7f f4 c9 c2 0c c4 2a e1 3e f2 62 95 70 e0 44 74 5a f8 33 82 7d e4 c5 94 44 3e f2 12 aa 08 84 31 c9 72 aa 5a 78 e6 de b4 f5 c1 02 06 db 47 9e 62 8a 53 bf 56 ae c1 2c e3 14 ee 48 05 b3 b2 2b 22 cf 56 4c 71 ea 23 ff 4b 04 49 68 0b 87 32 1d 64 ac 13 2b 0c a1 14 8a 0a d5 c2 d3 e3 2f 80 07 77 67 16 3f 9e 59 84 5b 22 9c c4 f7 cc 4c 06 52 e5 e7 d2 5b 77 ae cf 3c 28 cd ce cf cd cd df 07 c3 a6 9a d7 63 74 29 95 d9 1e bf c4 22 15 b7 22 da 63 21 b5 06 be 50 62 82 29 46 b8 95 87 84 d3 96 33 59 2e 25 4c b0 a4 9b 8c de 16 fb c8 cb d5 80 53 50 83 94 b6 b0 a2 7d 65 87 79 8e 7d 34 01 8f 10 00 40 42 b2 0e 13 2e 94 9b 67 65 4a a2 88 89 ce 51 1a 22 96 74 4c 03 81 cc 22 9a 4d d1 2e df 89 c7 1a 8b d3 b6 72 a1 42 93 26 1a 22 1d b0 e7 1e b2 47 b3 36 97 4b d6 c0 85 3c cc 24 e7 99 ce 09 48 f8 b0 93 c9 ae 88 5c 28 56 83 c6 7b 41 a3 89 86 28 90 d1 20 e7 9f a0 2d 85 b2 da 24 61 7c e0 02 36 7f 19 6d ce cd 57 b8 04 b7 29 cb 06 b2 04 78 fc 62 fc 3b 8c 7f 35 1b 66 d3 ec 9b 27 b8 04 f8 f6 5d 58 b8 21 55 cc 42 5c 02 6c 7e 33 67 e6 6b 73 b4 fe ca 6c c0 42 26 e1 7e 15 97 00 df 64 19 e9 30 21 e1 43 f2 b0 0b 37 a4 8a 59 08 0b 99 c4 25 c8 89 c8 ad 9c 66 ac dd 44 00 00 09 3f cf 71 26 a8 15 53 d6 89 95 0b ce 64 ad 89 36 9c b3 cf a9 0b 8d a9 77 6a dc 43 d1 be b2 08 67 1d e1 42 48 85 a2 d9 5c 6c 28 b9 cc 5c 58 8a 99 a2 74 35 38 25 e3 40 13 95 5a da 6f 4e 58 4b 39 c7 04 92 47 6e 02 0b 09 50 0c 09 a4 7a 30 90 4a c9 c4 85 4a 39 0d 50 fd e0 4d ca 7b 54 b1 90 94 d8 f0 86 28 ae e4 55 aa 4d 05 4f b4 7d 25 1a 03 0f 51 1a 0d bb e5 1d 32 54 fb 54 ca 6c cd 24 ed a7 9c 30 91 0e b7 ef 21 96 92 a9 0b 4e da 87 5c 72 16 41 b1 dd 56 9a d8 00 41 d2 97 48 fd e4 14 40 0b 57 cb 69 1f 48 57 49 07 03 a2 e5 d4 bd 50 31 24 dd 9c 16 3f cc 69 5b 19 51 ce 08 22 45 b9 c5 7a bd 2e 81 56 5d c6 a9 52 34 b3 f2 94 84 49 54 bb 85 47 83 56 ae 59 6c 3d ef d3 40 f6 53 01 b5 d4 99 aa 01 9a 9d 59 a2 dd ac 90 df 69 c8 9e 80 d6 db 67 40 08 c0 6c 9b d3 d1 ae 39 30 c7 e6 4b 73 89 50 6b 3b 15 26 6c f4 7e 42 23 46 40 0a 3e 80 3c cc 28 15 40 44 04 ef 26 4c 7c c3 79 2e 94 af 0e a7 49 3f be 51 6f a4 fd ab f0 08 15 8a 01 61 b5 50 28 30 8e 94 30 9d ee 76 0b 43 54 58 2b ed 85 42 4f b5 57 ea f3 23 f3 94 08 a3 48 3d 40 c6 8a ee b0 1d 26 b0 4a d5 90 66 4e a1 d0 b9 b8 f7 ec da 54 78 85 a8 a4 05 f8 8a f0 32 15 38 6
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 02 Jul 2024 15:29:05 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 07 Nov 2023 07:43:14 GMTETag: W/"afe-6098b1f8c138d"Content-Encoding: brData Raw: 35 31 33 0d 0a c1 e8 57 00 00 bf bd a8 fb ce fd 7c bd 5d 84 c4 aa b8 8e 93 34 19 8e 63 21 75 ed 36 e8 d6 aa 63 6c 7c a1 b3 7d 89 8f 9d ef 2c fb 92 26 4c f9 fb 48 73 87 06 ad 58 b5 56 b4 a5 9d 8a e8 04 a5 b0 8e 81 5a 21 3e 3a 21 7e 68 57 7e 56 21 f1 af f9 eb e2 5c b3 06 cd c6 74 77 6f 61 0c c3 76 48 9f 6b b3 28 4b 4e b8 9f 30 c5 f0 c1 24 08 a2 45 b0 28 86 38 4d 82 86 0f 96 4f d0 52 2d 36 31 19 0c 06 53 4b aa 13 d9 81 5f 0e 9e 2b b8 b5 6d 9a 74 ea 5d 78 57 ae cf 4f 7f f4 c9 c2 0c c4 2a e1 3e f2 62 95 70 e0 44 74 5a f8 33 82 7d e4 c5 94 44 3e f2 12 aa 08 84 31 c9 72 aa 5a 78 e6 de b4 f5 c1 02 06 db 47 9e 62 8a 53 bf 56 ae c1 2c e3 14 ee 48 05 b3 b2 2b 22 cf 56 4c 71 ea 23 ff 4b 04 49 68 0b 87 32 1d 64 ac 13 2b 0c a1 14 8a 0a d5 c2 d3 e3 2f 80 07 77 67 16 3f 9e 59 84 5b 22 9c c4 f7 cc 4c 06 52 e5 e7 d2 5b 77 ae cf 3c 28 cd ce cf cd cd df 07 c3 a6 9a d7 63 74 29 95 d9 1e bf c4 22 15 b7 22 da 63 21 b5 06 be 50 62 82 29 46 b8 95 87 84 d3 96 33 59 2e 25 4c b0 a4 9b 8c de 16 fb c8 cb d5 80 53 50 83 94 b6 b0 a2 7d 65 87 79 8e 7d 34 01 8f 10 00 40 42 b2 0e 13 2e 94 9b 67 65 4a a2 88 89 ce 51 1a 22 96 74 4c 03 81 cc 22 9a 4d d1 2e df 89 c7 1a 8b d3 b6 72 a1 42 93 26 1a 22 1d b0 e7 1e b2 47 b3 36 97 4b d6 c0 85 3c cc 24 e7 99 ce 09 48 f8 b0 93 c9 ae 88 5c 28 56 83 c6 7b 41 a3 89 86 28 90 d1 20 e7 9f a0 2d 85 b2 da 24 61 7c e0 02 36 7f 19 6d ce cd 57 b8 04 b7 29 cb 06 b2 04 78 fc 62 fc 3b 8c 7f 35 1b 66 d3 ec 9b 27 b8 04 f8 f6 5d 58 b8 21 55 cc 42 5c 02 6c 7e 33 67 e6 6b 73 b4 fe ca 6c c0 42 26 e1 7e 15 97 00 df 64 19 e9 30 21 e1 43 f2 b0 0b 37 a4 8a 59 08 0b 99 c4 25 c8 89 c8 ad 9c 66 ac dd 44 00 00 09 3f cf 71 26 a8 15 53 d6 89 95 0b ce 64 ad 89 36 9c b3 cf a9 0b 8d a9 77 6a dc 43 d1 be b2 08 67 1d e1 42 48 85 a2 d9 5c 6c 28 b9 cc 5c 58 8a 99 a2 74 35 38 25 e3 40 13 95 5a da 6f 4e 58 4b 39 c7 04 92 47 6e 02 0b 09 50 0c 09 a4 7a 30 90 4a c9 c4 85 4a 39 0d 50 fd e0 4d ca 7b 54 b1 90 94 d8 f0 86 28 ae e4 55 aa 4d 05 4f b4 7d 25 1a 03 0f 51 1a 0d bb e5 1d 32 54 fb 54 ca 6c cd 24 ed a7 9c 30 91 0e b7 ef 21 96 92 a9 0b 4e da 87 5c 72 16 41 b1 dd 56 9a d8 00 41 d2 97 48 fd e4 14 40 0b 57 cb 69 1f 48 57 49 07 03 a2 e5 d4 bd 50 31 24 dd 9c 16 3f cc 69 5b 19 51 ce 08 22 45 b9 c5 7a bd 2e 81 56 5d c6 a9 52 34 b3 f2 94 84 49 54 bb 85 47 83 56 ae 59 6c 3d ef d3 40 f6 53 01 b5 d4 99 aa 01 9a 9d 59 a2 dd ac 90 df 69 c8 9e 80 d6 db 67 40 08 c0 6c 9b d3 d1 ae 39 30 c7 e6 4b 73 89 50 6b 3b 15 26 6c f4 7e 42 23 46 40 0a 3e 80 3c cc 28 15 40 44 04 ef 26 4c 7c c3 79 2e 94 af 0e a7 49 3f be 51 6f a4 fd ab f0 08 15 8a 01 61 b5 50 28 30 8e 94 30 9d ee 76 0b 43 54 58 2b ed 85 42 4f b5 57 ea f3 23 f3 94 08 a3 48 3d 40 c6 8a ee b0 1d 26 b0 4a d5 90 66 4e a1 d0 b9 b8 f7 ec da 54 78 85 a8 a4 05 f8 8a f0 32 15 38 6
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 02 Jul 2024 15:29:08 GMTContent-Type: text/htmlContent-Length: 2814Connection: closeVary: Accept-EncodingLast-Modified: Tue, 07 Nov 2023 07:43:14 GMTETag: "afe-6098b1f8c138d"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6a 61 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 45 55 43 2d 4a 50 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 46 69 6c 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 58 53 45 52 56 45 52 20 49 6e 63 2e 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 49 4e 44 45 58 2c 46 4f 4c 4c 4f 57 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2a 20 7b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 7d 0a 69 6d 67 20 7b 0a 20 20 20 20 62 6f 72 64 65 72 3a 20 30 3b 0a 7d 0a 75 6c 20 7b 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 32 65 6d 3b 0a 7d 0a 68 74 6d 6c 20 7b 0a 20 20 20 20 6f 76 65 72 66 6c 6f 77 2d 79 3a 20 73 63 72 6f 6c 6c 3b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 33 62 37 39 62 37 3b 0a 7d 0a 62 6f 64 79 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 a5 e1 a5 a4 a5 ea a5 aa 22 2c 20 4d 65 69 72 79 6f 2c 20 22 a3 cd a3 d3 20 a3 d0 a5 b4 a5 b7 a5 c3 a5 af 22 2c 20 22 4d 53 20 50 47 6f 74 68 69 63 22 2c 20 22 a5 d2 a5 e9 a5 ae a5 ce b3 d1 a5 b4 20 50 72 6f 20 57 33 22 2c 20 22 48 69 72 61 67 69 6e 6f 20 4b 61 6b 75 20 47 6f 74 68 69 63 20 50 72 6f 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 37 35 25 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 77 68 69 74 65 3b 0a 7d 0a 68 31 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 34 70 78 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 7d 0a 68 31 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 32 30 70 78 3b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 68 32 20 7b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 6
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 02 Jul 2024 15:27:47 GMTServer: Apache/2Expires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cacheSet-Cookie: PHPSESSID=umj15kgrhhl5vgfiobp2qsfekf; path=/Upgrade: h2,h2cConnection: Upgrade, closeVary: Accept-Encoding,User-AgentContent-Encoding: gzipCache-Control: max-age=604800, private, proxy-revalidateContent-Length: 556Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 a5 94 bd 8e d3 40 10 c7 7b 24 de 61 6f 5b e2 8f 3b 1d 02 82 1d 84 42 90 ae 40 47 91 13 50 a1 8d 3d ce ae b2 fe c0 3b 89 cf 4f 70 05 15 42 d4 08 51 d0 d0 81 84 14 17 14 e1 45 fc 26 8c 9d 0f f9 42 e0 0a 5c 78 67 77 fe fb 9b f1 cc ae bd a3 27 e7 c3 f1 ab e7 23 26 31 d6 83 db b7 bc 66 64 5a 24 53 9f 2f 14 a7 95 66 0d 44 48 16 a3 c7 8b 01 05 0b a4 c8 0d a0 cf 2f c6 4f ad fb 9c 39 d7 bc 12 31 b3 e0 cd 5c 2d 7c 3e 4c 13 84 04 ad 71 99 01 67 c1 7a e6 73 84 4b 74 9a 50 0f 77 ac 39 46 ff 46 bd b4 2e 1e 5b c3 34 ce 04 aa 89 ee d2 ce 46 fe 28 9e 6b 81 70 36 ea 22 50 a1 86 c1 a9 7b ea 39 6b b3 8b 4e 44 0c 3e 9f 41 59 a4 79 68 3a 34 d2 f3 03 ca 85 82 22 4b 73 ec 28 0b 15 a2 f4 43 58 a8 00 ac 76 d2 63 2a 51 a8 84 b6 4c 20 34 f8 c7 b6 bb 63 69 95 cc 98 cc 21 f2 79 f3 59 a6 ef 38 11 91 8c 3d 4d d3 a9 06 91 29 63 07 69 ec 04 c6 3c 8a 44 ac 74 e9 3f 6b fc 90 e7 02 fb 77 5d 97 b3 1c b4 cf 0d 96 1a 8c 04 c0 ff 41 8f 29 4d ad d5 3c be f3 02 26 fd 7b ae db 7b 70 63 04 a4 26 6e 7a 47 a4 3f c5 9d 14 28 83 a2 28 ec 40 64 12 a8 5e 21 b4 f1 85 a1 4e 1b 87 2a fc 3a 52 b4 cb 69 37 db 2d ac e9 9a e7 6c 8e 1a 99 93 34 2c b7 d1 43 b5 60 2a f4 79 92 62 94 ce 93 70 9b d6 ce 19 68 42 1f f6 ff 4d 63 75 fa 7c 4d 2b 8f d7 47 86 c6 3d 8a 43 98 fd 35 79 32 38 4f 33 73 c4 c6 39 5d 1a 26 55 5d 5d 25 6c 26 57 df 69 86 75 f5 3e a1 f7 f2 93 22 de c9 fe de 6c b0 de 34 21 41 c2 7e bd 6b 6c 5c 7d 8d d9 4c d5 cb 9f f1 01 4a 8f b4 d5 5b 76 b9 fa 46 77 23 ad 97 3f 02 86 1b 91 6a 08 ab cf 6b 01 4a 51 d2 b4 ae 3e 28 9b f2 ce f6 23 8b 1b 5b c5 29 b7 ba fa c8 74 13 96 61 9b 67 20 eb ea 8b e7 88 6e f5 3b 35 d9 da 9e b3 e9 5d db d0 e6 bf f2 1b 70 1f d1 45 67 04 00 00 Data Ascii: @{$ao[;B@GP=;OpBQE&B\xgw'#&1fdZ$S/fDH/O91\-|>LqgzsKtPw9FF.[4F(kp6"P{9kND>AYyh:4"Ks(CXvc*QL 4ci!yY8=M)ci<Dt?kw]A)M<&{{pc&nzG?((@d^!N*:Ri7-l4,C`*ybphBMcu|M+G=C5y28O3s9]&U]]%l&Wiu>"l4!A~kl\}LJ[vFw#?jkJQ>(#[)tag n;5]pEg
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 02 Jul 2024 15:27:50 GMTServer: Apache/2Expires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cacheSet-Cookie: PHPSESSID=i2fuq24op53l63330epoupbh5e; path=/Upgrade: h2,h2cConnection: Upgrade, closeVary: Accept-Encoding,User-AgentContent-Encoding: gzipCache-Control: max-age=604800, private, proxy-revalidateContent-Length: 556Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 a5 94 bd 8e d3 40 10 c7 7b 24 de 61 6f 5b e2 8f 3b 1d 02 82 1d 84 42 90 ae 40 47 91 13 50 a1 8d 3d ce ae b2 fe c0 3b 89 cf 4f 70 05 15 42 d4 08 51 d0 d0 81 84 14 17 14 e1 45 fc 26 8c 9d 0f f9 42 e0 0a 5c 78 67 77 fe fb 9b f1 cc ae bd a3 27 e7 c3 f1 ab e7 23 26 31 d6 83 db b7 bc 66 64 5a 24 53 9f 2f 14 a7 95 66 0d 44 48 16 a3 c7 8b 01 05 0b a4 c8 0d a0 cf 2f c6 4f ad fb 9c 39 d7 bc 12 31 b3 e0 cd 5c 2d 7c 3e 4c 13 84 04 ad 71 99 01 67 c1 7a e6 73 84 4b 74 9a 50 0f 77 ac 39 46 ff 46 bd b4 2e 1e 5b c3 34 ce 04 aa 89 ee d2 ce 46 fe 28 9e 6b 81 70 36 ea 22 50 a1 86 c1 a9 7b ea 39 6b b3 8b 4e 44 0c 3e 9f 41 59 a4 79 68 3a 34 d2 f3 03 ca 85 82 22 4b 73 ec 28 0b 15 a2 f4 43 58 a8 00 ac 76 d2 63 2a 51 a8 84 b6 4c 20 34 f8 c7 b6 bb 63 69 95 cc 98 cc 21 f2 79 f3 59 a6 ef 38 11 91 8c 3d 4d d3 a9 06 91 29 63 07 69 ec 04 c6 3c 8a 44 ac 74 e9 3f 6b fc 90 e7 02 fb 77 5d 97 b3 1c b4 cf 0d 96 1a 8c 04 c0 ff 41 8f 29 4d ad d5 3c be f3 02 26 fd 7b ae db 7b 70 63 04 a4 26 6e 7a 47 a4 3f c5 9d 14 28 83 a2 28 ec 40 64 12 a8 5e 21 b4 f1 85 a1 4e 1b 87 2a fc 3a 52 b4 cb 69 37 db 2d ac e9 9a e7 6c 8e 1a 99 93 34 2c b7 d1 43 b5 60 2a f4 79 92 62 94 ce 93 70 9b d6 ce 19 68 42 1f f6 ff 4d 63 75 fa 7c 4d 2b 8f d7 47 86 c6 3d 8a 43 98 fd 35 79 32 38 4f 33 73 c4 c6 39 5d 1a 26 55 5d 5d 25 6c 26 57 df 69 86 75 f5 3e a1 f7 f2 93 22 de c9 fe de 6c b0 de 34 21 41 c2 7e bd 6b 6c 5c 7d 8d d9 4c d5 cb 9f f1 01 4a 8f b4 d5 5b 76 b9 fa 46 77 23 ad 97 3f 02 86 1b 91 6a 08 ab cf 6b 01 4a 51 d2 b4 ae 3e 28 9b f2 ce f6 23 8b 1b 5b c5 29 b7 ba fa c8 74 13 96 61 9b 67 20 eb ea 8b e7 88 6e f5 3b 35 d9 da 9e b3 e9 5d db d0 e6 bf f2 1b 70 1f d1 45 67 04 00 00 Data Ascii: @{$ao[;B@GP=;OpBQE&B\xgw'#&1fdZ$S/fDH/O91\-|>LqgzsKtPw9FF.[4F(kp6"P{9kND>AYyh:4"Ks(CXvc*QL 4ci!yY8=M)ci<Dt?kw]A)M<&{{pc&nzG?((@d^!N*:Ri7-l4,C`*ybphBMcu|M+G=C5y28O3s9]&U]]%l&Wiu>"l4!A~kl\}LJ[vFw#?jkJQ>(#[)tag n;5]pEg
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 02 Jul 2024 15:27:55 GMTServer: Apache/2Expires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cacheSet-Cookie: PHPSESSID=a33csnuiia1nspk8fvn93nt02j; path=/Upgrade: h2,h2cConnection: Upgrade, closeVary: Accept-Encoding,User-AgentCache-Control: max-age=604800, private, proxy-revalidateTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 34 36 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 76 69 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 6d 75 6c 61 74 65 49 45 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 34 30 34 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4d 6f 6e 74 73 65 72 72 61 74 3a 35 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 54 69 74 69 6c 6c 69 75 6d 2b 57 65 62 3a 37 30 30 2c 39 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 63 61 70 68 65 63 6f 6e 64 65 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 34 30 34 5f 66 69 6c 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 2f 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 20 20 20 20 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: 467<!DOCTYPE html><html lang="vi"><head> <meta charset="UTF-8" /> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <meta http-equiv="X
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 02 Jul 2024 15:27:55 GMTServer: Apache/2Expires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cacheSet-Cookie: PHPSESSID=a33csnuiia1nspk8fvn93nt02j; path=/Upgrade: h2,h2cConnection: Upgrade, closeVary: Accept-Encoding,User-AgentCache-Control: max-age=604800, private, proxy-revalidateTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 34 36 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 76 69 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 6d 75 6c 61 74 65 49 45 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 34 30 34 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4d 6f 6e 74 73 65 72 72 61 74 3a 35 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 54 69 74 69 6c 6c 69 75 6d 2b 57 65 62 3a 37 30 30 2c 39 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 63 61 70 68 65 63 6f 6e 64 65 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 34 30 34 5f 66 69 6c 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 2f 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 20 20 20 20 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: 467<!DOCTYPE html><html lang="vi"><head> <meta charset="UTF-8" /> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <meta http-equiv="X
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 02 Jul 2024 15:27:55 GMTServer: Apache/2Expires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cacheSet-Cookie: PHPSESSID=a33csnuiia1nspk8fvn93nt02j; path=/Upgrade: h2,h2cConnection: Upgrade, closeVary: Accept-Encoding,User-AgentCache-Control: max-age=604800, private, proxy-revalidateTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 34 36 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 76 69 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 6d 75 6c 61 74 65 49 45 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 34 30 34 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4d 6f 6e 74 73 65 72 72 61 74 3a 35 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 54 69 74 69 6c 6c 69 75 6d 2b 57 65 62 3a 37 30 30 2c 39 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 63 61 70 68 65 63 6f 6e 64 65 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 34 30 34 5f 66 69 6c 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 2f 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 20 20 20 20 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: 467<!DOCTYPE html><html lang="vi"><head> <meta charset="UTF-8" /> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <meta http-equiv="X
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.20.1Date: Tue, 02 Jul 2024 15:27:52 GMTContent-Type: text/html; charset=utf-8X-Cache: MISS from megai-cdnb144-060Content-Length: 917Connection: closeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 3c 74 69 74 6c 65 3e 34 30 33 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 27 6d 61 69 6e 27 20 73 74 79 6c 65 3d 27 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 27 3e 0a 3c 69 3e 3c 68 32 3e 53 6f 6d 65 74 68 69 6e 67 20 65 72 72 6f 72 3a 3c 2f 68 32 3e 3c 2f 69 3e 0a 3c 70 3e 3c 68 33 3e 34 30 33 3c 2f 68 33 3e 3c 68 33 3e 3c 66 6f 6e 74 20 63 6f 6c 6f 72 3d 27 72 65 64 27 3e 64 65 6e 69 65 64 20 62 79 20 72 65 71 75 65 73 74 20 61 63 63 65 73 73 20 63 6f 6e 74 72 6f 6c 3c 2f 66 6f 6e 74 3e 3c 2f 68 33 3e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 68 65 63 6b 20 6f 72 20 3c 61 20 68 72 65 66 3d 27 6a 61 76 61 73 63 72 69 70 74 3a 6c 6f 63 61 74 69 6f 6e 2e 72 65 6c 6f 61 64 28 29 27 3e 74 72 79 20 61 67 61 69 6e 3c 2f 61 3e 20 6c 61 74 65 72 2e 3c 2f 70 3e 0a 3c 64 69 76 3e 68 6f 73 74 6e 61 6d 65 3a 20 6d 65 67 61 69 2d 63 64 6e 62 31 34 34 2d 30 36 30 3c 2f 64 69 76 3e 3c 68 72 3e 0a 3c 64 69 76 20 69 64 3d 27 70 62 27 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 27 6a 61 76 61 73 63 72 69 70 74 27 3e 0a 09 76 61 72 20 72 65 66 65 72 65 72 20 3d 20 65 73 63 61 70 65 28 64 6f 63 75 6d 65 6e 74 2e 72 65 66 65 72 72 65 72 29 3b 0a 09 76 61 72 20 75 72 6c 20 3d 20 65 73 63 61 70 65 28 64 6f 63 75 6d 65 6e 74 2e 55 52 4c 29 3b 0a 09 76 61 72 20 6d 73 67 20 3d 20 27 64 65 6e 69 65 64 25 32 30 62 79 25 32 30 72 65 71 75 65 73 74 25 32 30 61 63 63 65 73 73 25 32 30 63 6f 6e 74 72 6f 6c 27 3b 0a 20 20 20 20 76 61 72 20 68 6f 73 74 6e 61 6d 65 3d 27 6d 65 67 61 69 2d 63 64 6e 62 31 34 34 2d 30 36 30 27 3b 0a 09 76 61 72 20 65 76 65 6e 74 5f 69 64 3d 27 27 3b 0a 09 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 27 3c 73 63 72 27 2b 27 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 65 72 72 6f 72 2e 73 6b 79 63 6c 6f 75 64 2e 74 77 2f 73 79 73 74 65 6d 2f 65 72 72 6f 72 3f 63 6f 64 65 3d 34 30 33 26 76 68 3d 6a 68 30 33 2d 73 69 74 65 2d 32 35 22 3e 3c 2f 73 63 72 27 20 2b 20 27 69 70 74 3e 27 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 21 2d 2d 20 70 61 64 64 69 6e 67 20 66 6f 72 20 69 65 20 2d 2d 3e 3c 21 2d 2d 20 70 61 64 64 69 6e 67 20 66 6f 72 20 69 65 20 2d 2d 3e 3c 21 2d 2d 20 70 61 64 64 69 6e 67 20 66 6f 72 20 69 65 20 2d 2d 3e 3c 21 2d 2d 20 70 61 64 64 69 6e 67 20 66 6f 72 20 69 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 36 36 35 64 37 65 66 61 20 2d 2d 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta htt
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.20.1Date: Tue, 02 Jul 2024 15:27:54 GMTContent-Type: text/html; charset=utf-8X-Cache: MISS from megai-cdnb144-060Content-Length: 917Connection: closeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 3c 74 69 74 6c 65 3e 34 30 33 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 27 6d 61 69 6e 27 20 73 74 79 6c 65 3d 27 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 27 3e 0a 3c 69 3e 3c 68 32 3e 53 6f 6d 65 74 68 69 6e 67 20 65 72 72 6f 72 3a 3c 2f 68 32 3e 3c 2f 69 3e 0a 3c 70 3e 3c 68 33 3e 34 30 33 3c 2f 68 33 3e 3c 68 33 3e 3c 66 6f 6e 74 20 63 6f 6c 6f 72 3d 27 72 65 64 27 3e 64 65 6e 69 65 64 20 62 79 20 72 65 71 75 65 73 74 20 61 63 63 65 73 73 20 63 6f 6e 74 72 6f 6c 3c 2f 66 6f 6e 74 3e 3c 2f 68 33 3e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 68 65 63 6b 20 6f 72 20 3c 61 20 68 72 65 66 3d 27 6a 61 76 61 73 63 72 69 70 74 3a 6c 6f 63 61 74 69 6f 6e 2e 72 65 6c 6f 61 64 28 29 27 3e 74 72 79 20 61 67 61 69 6e 3c 2f 61 3e 20 6c 61 74 65 72 2e 3c 2f 70 3e 0a 3c 64 69 76 3e 68 6f 73 74 6e 61 6d 65 3a 20 6d 65 67 61 69 2d 63 64 6e 62 31 34 34 2d 30 36 30 3c 2f 64 69 76 3e 3c 68 72 3e 0a 3c 64 69 76 20 69 64 3d 27 70 62 27 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 27 6a 61 76 61 73 63 72 69 70 74 27 3e 0a 09 76 61 72 20 72 65 66 65 72 65 72 20 3d 20 65 73 63 61 70 65 28 64 6f 63 75 6d 65 6e 74 2e 72 65 66 65 72 72 65 72 29 3b 0a 09 76 61 72 20 75 72 6c 20 3d 20 65 73 63 61 70 65 28 64 6f 63 75 6d 65 6e 74 2e 55 52 4c 29 3b 0a 09 76 61 72 20 6d 73 67 20 3d 20 27 64 65 6e 69 65 64 25 32 30 62 79 25 32 30 72 65 71 75 65 73 74 25 32 30 61 63 63 65 73 73 25 32 30 63 6f 6e 74 72 6f 6c 27 3b 0a 20 20 20 20 76 61 72 20 68 6f 73 74 6e 61 6d 65 3d 27 6d 65 67 61 69 2d 63 64 6e 62 31 34 34 2d 30 36 30 27 3b 0a 09 76 61 72 20 65 76 65 6e 74 5f 69 64 3d 27 27 3b 0a 09 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 27 3c 73 63 72 27 2b 27 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 65 72 72 6f 72 2e 73 6b 79 63 6c 6f 75 64 2e 74 77 2f 73 79 73 74 65 6d 2f 65 72 72 6f 72 3f 63 6f 64 65 3d 34 30 33 26 76 68 3d 6a 68 30 33 2d 73 69 74 65 2d 32 35 22 3e 3c 2f 73 63 72 27 20 2b 20 27 69 70 74 3e 27 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 21 2d 2d 20 70 61 64 64 69 6e 67 20 66 6f 72 20 69 65 20 2d 2d 3e 3c 21 2d 2d 20 70 61 64 64 69 6e 67 20 66 6f 72 20 69 65 20 2d 2d 3e 3c 21 2d 2d 20 70 61 64 64 69 6e 67 20 66 6f 72 20 69 65 20 2d 2d 3e 3c 21 2d 2d 20 70 61 64 64 69 6e 67 20 66 6f 72 20 69 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 36 36 35 64 37 65 66 61 20 2d 2d 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta htt
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.20.1Date: Tue, 02 Jul 2024 15:27:57 GMTContent-Type: text/html; charset=utf-8X-Cache: MISS from megai-cdnb144-060Content-Length: 917Connection: closeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 3c 74 69 74 6c 65 3e 34 30 33 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 27 6d 61 69 6e 27 20 73 74 79 6c 65 3d 27 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 27 3e 0a 3c 69 3e 3c 68 32 3e 53 6f 6d 65 74 68 69 6e 67 20 65 72 72 6f 72 3a 3c 2f 68 32 3e 3c 2f 69 3e 0a 3c 70 3e 3c 68 33 3e 34 30 33 3c 2f 68 33 3e 3c 68 33 3e 3c 66 6f 6e 74 20 63 6f 6c 6f 72 3d 27 72 65 64 27 3e 64 65 6e 69 65 64 20 62 79 20 72 65 71 75 65 73 74 20 61 63 63 65 73 73 20 63 6f 6e 74 72 6f 6c 3c 2f 66 6f 6e 74 3e 3c 2f 68 33 3e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 68 65 63 6b 20 6f 72 20 3c 61 20 68 72 65 66 3d 27 6a 61 76 61 73 63 72 69 70 74 3a 6c 6f 63 61 74 69 6f 6e 2e 72 65 6c 6f 61 64 28 29 27 3e 74 72 79 20 61 67 61 69 6e 3c 2f 61 3e 20 6c 61 74 65 72 2e 3c 2f 70 3e 0a 3c 64 69 76 3e 68 6f 73 74 6e 61 6d 65 3a 20 6d 65 67 61 69 2d 63 64 6e 62 31 34 34 2d 30 36 30 3c 2f 64 69 76 3e 3c 68 72 3e 0a 3c 64 69 76 20 69 64 3d 27 70 62 27 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 27 6a 61 76 61 73 63 72 69 70 74 27 3e 0a 09 76 61 72 20 72 65 66 65 72 65 72 20 3d 20 65 73 63 61 70 65 28 64 6f 63 75 6d 65 6e 74 2e 72 65 66 65 72 72 65 72 29 3b 0a 09 76 61 72 20 75 72 6c 20 3d 20 65 73 63 61 70 65 28 64 6f 63 75 6d 65 6e 74 2e 55 52 4c 29 3b 0a 09 76 61 72 20 6d 73 67 20 3d 20 27 64 65 6e 69 65 64 25 32 30 62 79 25 32 30 72 65 71 75 65 73 74 25 32 30 61 63 63 65 73 73 25 32 30 63 6f 6e 74 72 6f 6c 27 3b 0a 20 20 20 20 76 61 72 20 68 6f 73 74 6e 61 6d 65 3d 27 6d 65 67 61 69 2d 63 64 6e 62 31 34 34 2d 30 36 30 27 3b 0a 09 76 61 72 20 65 76 65 6e 74 5f 69 64 3d 27 27 3b 0a 09 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 27 3c 73 63 72 27 2b 27 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 65 72 72 6f 72 2e 73 6b 79 63 6c 6f 75 64 2e 74 77 2f 73 79 73 74 65 6d 2f 65 72 72 6f 72 3f 63 6f 64 65 3d 34 30 33 26 76 68 3d 6a 68 30 33 2d 73 69 74 65 2d 32 35 22 3e 3c 2f 73 63 72 27 20 2b 20 27 69 70 74 3e 27 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 21 2d 2d 20 70 61 64 64 69 6e 67 20 66 6f 72 20 69 65 20 2d 2d 3e 3c 21 2d 2d 20 70 61 64 64 69 6e 67 20 66 6f 72 20 69 65 20 2d 2d 3e 3c 21 2d 2d 20 70 61 64 64 69 6e 67 20 66 6f 72 20 69 65 20 2d 2d 3e 3c 21 2d 2d 20 70 61 64 64 69 6e 67 20 66 6f 72 20 69 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 36 36 35 64 37 65 66 61 20 2d 2d 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta htt
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: Tengine/2.3.2Date: Tue, 02 Jul 2024 15:27:59 GMTContent-Type: text/htmlVary: Accept-EncodingAccess-Control-Allow-Origin: *X-Via: 1.1 aws:jp (Cdn Cache Server V2.0), 1.1 ocsapi:00 (Cdn Cache Server V2.0)X-Cache: MISS from megai-cdnb144-060Content-Length: 716Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 20 53 6f 72 72 79 20 66 6f 72 20 74 68 65 20 69 6e 63 6f 6e 76 65 6e 69 65 6e 63 65 2e 3c 62 72 2f 3e 0d 0a 50 6c 65 61 73 65 20 72 65 70 6f 72 74 20 74 68 69 73 20 6d 65 73 73 61 67 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 20 74 68 65 20 66 6f 6c 6c 6f 77 69 6e 67 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 74 6f 20 75 73 2e 3c 62 72 2f 3e 0d 0a 54 68 61 6e 6b 20 79 6f 75 20 76 65 72 79 20 6d 75 63 68 21 3c 2f 70 3e 0d 0a 3c 74 61 62 6c 65 3e 0d 0a 3c 74 72 3e 0d 0a 3c 74 64 3e 55 52 4c 3a 3c 2f 74 64 3e 0d 0a 3c 74 64 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 70 70 38 38 37 33 30 30 2e 63 6f 6d 2f 6c 68 65 78 2f 3f 69 48 6d 48 4f 74 4b 3d 41 4b 44 65 55 31 4d 4f 64 79 32 43 37 2b 30 6f 5a 6a 75 47 54 51 6d 30 32 55 61 46 4a 6b 75 2b 62 71 6e 66 4b 78 53 30 41 33 4c 46 42 6b 4e 63 74 72 67 62 69 70 6d 51 59 5a 51 36 4c 5a 59 70 73 56 73 39 41 37 57 33 6c 47 35 68 32 36 7a 62 44 62 34 53 68 5a 69 54 72 65 68 68 6e 4e 76 4c 77 4f 2f 42 32 71 70 65 43 35 32 74 4d 48 68 6c 72 52 4e 44 4e 6d 49 3d 26 61 6d 70 3b 4c 34 38 30 3d 6e 46 73 70 3c 2f 74 64 3e 0d 0a 3c 2f 74 72 3e 0d 0a 3c 74 72 3e 0d 0a 3c 74 64 3e 53 65 72 76 65 72 3a 3c 2f 74 64 3e 0d 0a 3c 74 64 3e 70 66 66 6e 74 2d 61 77 73 2d 68 6b 30 31 34 3c 2f 74 64 3e 0d 0a 3c 2f 74 72 3e 0d 0a 3c 74 72 3e 0d 0a 3c 74 64 3e 44 61 74 65 3a 3c 2f 74 64 3e 0d 0a 3c 74 64 3e 32 30 32 34 2f 30 37 2f 30 32 20 31 31 3a 32 37 3a 35 39 3c 2f 74 64 3e 0d 0a 3c 2f 74 72 3e 0d 0a 3c 2f 74 61 62 6c 65 3e 0d 0a 3c 68 72 2f 3e 50 6f 77 65 72 65 64 20 62 79 20 54 65 6e 67 69 6e 65 2f 32 2e 33 2e 32 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 74 65 6e 67 69 6e 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center> Sorry for the inconvenience.<br/>Please report this message and include the following information to us.<br/>Thank you very much!</p><table><tr><td>URL:</td><td>https://www.pp887300.com/lhex/?iHmHOtK=AKDeU1MOdy2C7+0oZjuGTQm02UaFJku+bqnfKxS0A3LFBkNctrgbipmQYZQ6LZYpsVs9A7W3lG5h26zbDb4ShZiTrehhnNvLwO/B2qpeC52tMHhlrRNDNmI=&amp;L480=nFsp</td>
Source: w32tm.exe, 00000007.00000002.4107602600.0000000003A8C000.00000004.10000000.00040000.00000000.sdmp, w32tm.exe, 00000007.00000002.4106960993.000000000316D000.00000004.00000020.00020000.00000000.sdmp, HeKTvWjrtOUnkuZfNlEvF.exe, 00000008.00000002.4107041185.000000000323C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2279720857.00000000175AC000.00000004.80000000.00040000.00000000.sdmp, Inquiry No PJO-4010574.exe String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: w32tm.exe, 00000007.00000002.4107602600.0000000003A8C000.00000004.10000000.00040000.00000000.sdmp, w32tm.exe, 00000007.00000002.4106960993.000000000316D000.00000004.00000020.00020000.00000000.sdmp, HeKTvWjrtOUnkuZfNlEvF.exe, 00000008.00000002.4107041185.000000000323C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2279720857.00000000175AC000.00000004.80000000.00040000.00000000.sdmp, Inquiry No PJO-4010574.exe String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: firefox.exe, 00000009.00000002.2281154078.000001EE573C0000.00000040.80000000.00040000.00000000.sdmp String found in binary or memory: http://help.yahoo.com/help/us/ysearch/slurp)
Source: w32tm.exe, 00000007.00000002.4107602600.0000000003A8C000.00000004.10000000.00040000.00000000.sdmp, w32tm.exe, 00000007.00000002.4106960993.000000000316D000.00000004.00000020.00020000.00000000.sdmp, HeKTvWjrtOUnkuZfNlEvF.exe, 00000008.00000002.4107041185.000000000323C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2279720857.00000000175AC000.00000004.80000000.00040000.00000000.sdmp, Inquiry No PJO-4010574.exe String found in binary or memory: http://ocsp.comodoca.com0
Source: Inquiry No PJO-4010574.exe, 00000000.00000002.1675902311.0000000003120000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Inquiry No PJO-4010574.exe, 00000000.00000002.1680143285.00000000060B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: w32tm.exe, 00000007.00000002.4107602600.0000000004E28000.00000004.10000000.00040000.00000000.sdmp, HeKTvWjrtOUnkuZfNlEvF.exe, 00000008.00000002.4107041185.00000000045D8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://www.capheconde.com/
Source: w32tm.exe, 00000007.00000002.4107602600.0000000004E28000.00000004.10000000.00040000.00000000.sdmp, HeKTvWjrtOUnkuZfNlEvF.exe, 00000008.00000002.4107041185.00000000045D8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://www.capheconde.com/assets/404_files/style.css
Source: Inquiry No PJO-4010574.exe, 00000000.00000002.1680143285.00000000060B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: Inquiry No PJO-4010574.exe, 00000000.00000002.1680143285.00000000060B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com
Source: Inquiry No PJO-4010574.exe, 00000000.00000002.1680143285.00000000060B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: Inquiry No PJO-4010574.exe, 00000000.00000002.1680143285.00000000060B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Inquiry No PJO-4010574.exe, 00000000.00000002.1680143285.00000000060B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Inquiry No PJO-4010574.exe, 00000000.00000002.1680143285.00000000060B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: Inquiry No PJO-4010574.exe, 00000000.00000002.1680143285.00000000060B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: Inquiry No PJO-4010574.exe, 00000000.00000002.1680143285.00000000060B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: Inquiry No PJO-4010574.exe, 00000000.00000002.1680143285.00000000060B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: Inquiry No PJO-4010574.exe, 00000000.00000002.1680143285.00000000060B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.com
Source: Inquiry No PJO-4010574.exe, 00000000.00000002.1680143285.00000000060B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: Inquiry No PJO-4010574.exe, 00000000.00000002.1680143285.00000000060B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Inquiry No PJO-4010574.exe, 00000000.00000002.1680143285.00000000060B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Inquiry No PJO-4010574.exe, 00000000.00000002.1680143285.00000000060B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Inquiry No PJO-4010574.exe, 00000000.00000002.1680143285.00000000060B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Inquiry No PJO-4010574.exe, 00000000.00000002.1680143285.00000000060B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: Inquiry No PJO-4010574.exe, 00000000.00000002.1680143285.00000000060B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: HeKTvWjrtOUnkuZfNlEvF.exe, 00000008.00000002.4109293629.0000000005719000.00000040.80000000.00040000.00000000.sdmp String found in binary or memory: http://www.pp887300.com
Source: HeKTvWjrtOUnkuZfNlEvF.exe, 00000008.00000002.4109293629.0000000005719000.00000040.80000000.00040000.00000000.sdmp String found in binary or memory: http://www.pp887300.com/lhex/
Source: w32tm.exe, 00000007.00000002.4109796508.00000000063B0000.00000004.00000800.00020000.00000000.sdmp, HeKTvWjrtOUnkuZfNlEvF.exe, 00000008.00000002.4107041185.0000000003F90000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://www.relationshipfirst.us/zxku/?L480=nFsp&ch=1&iHmHOtK=LzaBpmw0qv0cK
Source: Inquiry No PJO-4010574.exe, 00000000.00000002.1680143285.00000000060B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: Inquiry No PJO-4010574.exe, 00000000.00000002.1679983339.00000000058E0000.00000004.00000020.00020000.00000000.sdmp, Inquiry No PJO-4010574.exe, 00000000.00000002.1680143285.00000000060B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.com
Source: Inquiry No PJO-4010574.exe, 00000000.00000002.1680143285.00000000060B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: Inquiry No PJO-4010574.exe, 00000000.00000002.1680143285.00000000060B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com
Source: Inquiry No PJO-4010574.exe, 00000000.00000002.1680143285.00000000060B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.typography.netD
Source: Inquiry No PJO-4010574.exe, 00000000.00000002.1680143285.00000000060B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: Inquiry No PJO-4010574.exe, 00000000.00000002.1680143285.00000000060B2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: w32tm.exe, 00000007.00000002.4109977258.0000000007E78000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: w32tm.exe, 00000007.00000002.4109977258.0000000007E78000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: w32tm.exe, 00000007.00000002.4109977258.0000000007E78000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: w32tm.exe, 00000007.00000002.4109977258.0000000007E78000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: w32tm.exe, 00000007.00000002.4109977258.0000000007E78000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: w32tm.exe, 00000007.00000002.4109977258.0000000007E78000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: w32tm.exe, 00000007.00000002.4109977258.0000000007E78000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: w32tm.exe, 00000007.00000002.4107602600.0000000004E28000.00000004.10000000.00040000.00000000.sdmp, HeKTvWjrtOUnkuZfNlEvF.exe, 00000008.00000002.4107041185.00000000045D8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://fonts.googleapis.com/css?family=Montserrat:500
Source: w32tm.exe, 00000007.00000002.4107602600.0000000004E28000.00000004.10000000.00040000.00000000.sdmp, HeKTvWjrtOUnkuZfNlEvF.exe, 00000008.00000002.4107041185.00000000045D8000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://fonts.googleapis.com/css?family=Titillium
Source: w32tm.exe, 00000007.00000002.4105919654.0000000002D33000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: w32tm.exe, 00000007.00000002.4105919654.0000000002D33000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: w32tm.exe, 00000007.00000002.4105919654.0000000002D33000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: w32tm.exe, 00000007.00000002.4105919654.0000000002D33000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033LMEM
Source: w32tm.exe, 00000007.00000002.4105919654.0000000002D33000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033at
Source: w32tm.exe, 00000007.00000002.4105919654.0000000002D33000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: w32tm.exe, 00000007.00000003.2171499734.0000000007E54000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: w32tm.exe, 00000007.00000002.4107602600.0000000003A8C000.00000004.10000000.00040000.00000000.sdmp, w32tm.exe, 00000007.00000002.4106960993.000000000316D000.00000004.00000020.00020000.00000000.sdmp, HeKTvWjrtOUnkuZfNlEvF.exe, 00000008.00000002.4107041185.000000000323C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2279720857.00000000175AC000.00000004.80000000.00040000.00000000.sdmp, Inquiry No PJO-4010574.exe String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0
Source: w32tm.exe, 00000007.00000002.4109977258.0000000007E78000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: w32tm.exe, 00000007.00000002.4107602600.0000000004FBA000.00000004.10000000.00040000.00000000.sdmp, HeKTvWjrtOUnkuZfNlEvF.exe, 00000008.00000002.4107041185.000000000476A000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://www.pp887300.com/lhex/?iHmHOtK=AKDeU1MOdy2C7

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 2.2.Inquiry No PJO-4010574.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.Inquiry No PJO-4010574.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000007.00000002.4106839112.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.1994362170.0000000001910000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.1992596406.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.4105792819.0000000002C50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.4106877602.0000000003930000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.4109293629.0000000005670000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.1994602722.0000000002E20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.4107064100.0000000003280000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 2.2.Inquiry No PJO-4010574.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 2.2.Inquiry No PJO-4010574.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000007.00000002.4106839112.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.1994362170.0000000001910000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.1992596406.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000007.00000002.4105792819.0000000002C50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.4106877602.0000000003930000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000002.4109293629.0000000005670000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.1994602722.0000000002E20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000007.00000002.4107064100.0000000003280000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
.NET source code contains very large array initializations
Source: 0.2.Inquiry No PJO-4010574.exe.5ab0000.7.raw.unpack, -Module-.cs Large array initialization: _200D_200D_202B_206F_206A_206B_202B_200B_200D_206D_200C_206B_206A_200B_202E_200C_200E_202A_200E_206D_206F_202D_206F_206D_206C_200F_206A_202D_206C_202B_206A_206F_202A_206A_200E_200F_200B_200F_202E_202D_202E: array initializer size 3088
.NET source code contains very large strings
Source: Inquiry No PJO-4010574.exe, frm_login.cs Long String: Length: 97210
Source: 7.2.w32tm.exe.3a8cd08.2.raw.unpack, frm_login.cs Long String: Length: 97210
Source: 8.2.HeKTvWjrtOUnkuZfNlEvF.exe.323cd08.1.raw.unpack, frm_login.cs Long String: Length: 97210
Source: 8.0.HeKTvWjrtOUnkuZfNlEvF.exe.323cd08.1.raw.unpack, frm_login.cs Long String: Length: 97210
Source: 9.2.firefox.exe.175acd08.0.raw.unpack, frm_login.cs Long String: Length: 97210
Contains functionality to call native functions
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0042B183 NtClose, 2_2_0042B183
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01632B60 NtClose,LdrInitializeThunk, 2_2_01632B60
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01632DF0 NtQuerySystemInformation,LdrInitializeThunk, 2_2_01632DF0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01632C70 NtFreeVirtualMemory,LdrInitializeThunk, 2_2_01632C70
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016335C0 NtCreateMutant,LdrInitializeThunk, 2_2_016335C0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01634340 NtSetContextThread, 2_2_01634340
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01634650 NtSuspendThread, 2_2_01634650
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01632BE0 NtQueryValueKey, 2_2_01632BE0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01632BF0 NtAllocateVirtualMemory, 2_2_01632BF0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01632BA0 NtEnumerateValueKey, 2_2_01632BA0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01632B80 NtQueryInformationFile, 2_2_01632B80
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01632AF0 NtWriteFile, 2_2_01632AF0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01632AD0 NtReadFile, 2_2_01632AD0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01632AB0 NtWaitForSingleObject, 2_2_01632AB0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01632D30 NtUnmapViewOfSection, 2_2_01632D30
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01632D00 NtSetInformationFile, 2_2_01632D00
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01632D10 NtMapViewOfSection, 2_2_01632D10
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01632DD0 NtDelayExecution, 2_2_01632DD0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01632DB0 NtEnumerateKey, 2_2_01632DB0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01632C60 NtCreateKey, 2_2_01632C60
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01632C00 NtQueryInformationProcess, 2_2_01632C00
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01632CF0 NtOpenProcess, 2_2_01632CF0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01632CC0 NtQueryVirtualMemory, 2_2_01632CC0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01632CA0 NtQueryInformationToken, 2_2_01632CA0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01632F60 NtCreateProcessEx, 2_2_01632F60
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01632F30 NtCreateSection, 2_2_01632F30
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01632FE0 NtCreateFile, 2_2_01632FE0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01632FA0 NtQuerySection, 2_2_01632FA0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01632FB0 NtResumeThread, 2_2_01632FB0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01632F90 NtProtectVirtualMemory, 2_2_01632F90
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01632E30 NtWriteVirtualMemory, 2_2_01632E30
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01632EE0 NtQueueApcThread, 2_2_01632EE0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01632EA0 NtAdjustPrivilegesToken, 2_2_01632EA0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01632E80 NtReadVirtualMemory, 2_2_01632E80
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01633010 NtOpenDirectoryObject, 2_2_01633010
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01633090 NtSetValueKey, 2_2_01633090
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016339B0 NtGetContextThread, 2_2_016339B0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01633D70 NtOpenThread, 2_2_01633D70
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01633D10 NtOpenProcessToken, 2_2_01633D10
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03434340 NtSetContextThread,LdrInitializeThunk, 7_2_03434340
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03434650 NtSuspendThread,LdrInitializeThunk, 7_2_03434650
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03432B60 NtClose,LdrInitializeThunk, 7_2_03432B60
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03432BE0 NtQueryValueKey,LdrInitializeThunk, 7_2_03432BE0
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03432BF0 NtAllocateVirtualMemory,LdrInitializeThunk, 7_2_03432BF0
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03432BA0 NtEnumerateValueKey,LdrInitializeThunk, 7_2_03432BA0
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03432AD0 NtReadFile,LdrInitializeThunk, 7_2_03432AD0
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03432AF0 NtWriteFile,LdrInitializeThunk, 7_2_03432AF0
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03432F30 NtCreateSection,LdrInitializeThunk, 7_2_03432F30
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03432FE0 NtCreateFile,LdrInitializeThunk, 7_2_03432FE0
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03432FB0 NtResumeThread,LdrInitializeThunk, 7_2_03432FB0
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03432EE0 NtQueueApcThread,LdrInitializeThunk, 7_2_03432EE0
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03432E80 NtReadVirtualMemory,LdrInitializeThunk, 7_2_03432E80
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03432D10 NtMapViewOfSection,LdrInitializeThunk, 7_2_03432D10
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03432D30 NtUnmapViewOfSection,LdrInitializeThunk, 7_2_03432D30
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03432DD0 NtDelayExecution,LdrInitializeThunk, 7_2_03432DD0
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03432DF0 NtQuerySystemInformation,LdrInitializeThunk, 7_2_03432DF0
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03432C60 NtCreateKey,LdrInitializeThunk, 7_2_03432C60
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03432C70 NtFreeVirtualMemory,LdrInitializeThunk, 7_2_03432C70
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03432CA0 NtQueryInformationToken,LdrInitializeThunk, 7_2_03432CA0
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_034335C0 NtCreateMutant,LdrInitializeThunk, 7_2_034335C0
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_034339B0 NtGetContextThread,LdrInitializeThunk, 7_2_034339B0
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03432B80 NtQueryInformationFile, 7_2_03432B80
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03432AB0 NtWaitForSingleObject, 7_2_03432AB0
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03432F60 NtCreateProcessEx, 7_2_03432F60
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03432F90 NtProtectVirtualMemory, 7_2_03432F90
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03432FA0 NtQuerySection, 7_2_03432FA0
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03432E30 NtWriteVirtualMemory, 7_2_03432E30
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03432EA0 NtAdjustPrivilegesToken, 7_2_03432EA0
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03432D00 NtSetInformationFile, 7_2_03432D00
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03432DB0 NtEnumerateKey, 7_2_03432DB0
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03432C00 NtQueryInformationProcess, 7_2_03432C00
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03432CC0 NtQueryVirtualMemory, 7_2_03432CC0
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03432CF0 NtOpenProcess, 7_2_03432CF0
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03433010 NtOpenDirectoryObject, 7_2_03433010
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03433090 NtSetValueKey, 7_2_03433090
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03433D70 NtOpenThread, 7_2_03433D70
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03433D10 NtOpenProcessToken, 7_2_03433D10
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_02C77B50 NtCreateFile, 7_2_02C77B50
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_02C77E30 NtClose, 7_2_02C77E30
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_02C77F80 NtAllocateVirtualMemory, 7_2_02C77F80
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_02C77CB0 NtReadFile, 7_2_02C77CB0
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_02C77DA0 NtDeleteFile, 7_2_02C77DA0
Detected potential crypto function
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 0_2_02F0D5BC 0_2_02F0D5BC
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 0_2_05AD6F88 0_2_05AD6F88
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 0_2_05ADAA28 0_2_05ADAA28
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 0_2_05AD2538 0_2_05AD2538
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 0_2_05ADF530 0_2_05ADF530
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 0_2_05AD2548 0_2_05AD2548
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 0_2_05AD6728 0_2_05AD6728
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 0_2_05AD6718 0_2_05AD6718
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 0_2_05AD26DB 0_2_05AD26DB
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 0_2_05AD6168 0_2_05AD6168
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 0_2_05AD6178 0_2_05AD6178
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 0_2_05AD6F78 0_2_05AD6F78
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 0_2_05ADDE88 0_2_05ADDE88
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 0_2_05AD09E8 0_2_05AD09E8
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 0_2_05AD09F8 0_2_05AD09F8
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 0_2_05ADDA50 0_2_05ADDA50
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0040E057 2_2_0040E057
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_00403067 2_2_00403067
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_004030B0 2_2_004030B0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_00401130 2_2_00401130
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0040FC6B 2_2_0040FC6B
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0040FC73 2_2_0040FC73
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0042D5D3 2_2_0042D5D3
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_00416613 2_2_00416613
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_00402E36 2_2_00402E36
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0040FE93 2_2_0040FE93
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0040DF13 2_2_0040DF13
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01688158 2_2_01688158
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F0100 2_2_015F0100
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0169A118 2_2_0169A118
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016B81CC 2_2_016B81CC
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016C01AA 2_2_016C01AA
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016B41A2 2_2_016B41A2
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01692000 2_2_01692000
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016BA352 2_2_016BA352
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016C03E6 2_2_016C03E6
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0160E3F0 2_2_0160E3F0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016A0274 2_2_016A0274
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016802C0 2_2_016802C0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01600535 2_2_01600535
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016C0591 2_2_016C0591
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016B2446 2_2_016B2446
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016A4420 2_2_016A4420
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016AE4F6 2_2_016AE4F6
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01600770 2_2_01600770
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01624750 2_2_01624750
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015FC7C0 2_2_015FC7C0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0161C6E0 2_2_0161C6E0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01616962 2_2_01616962
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016029A0 2_2_016029A0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016CA9A6 2_2_016CA9A6
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0160A840 2_2_0160A840
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01602840 2_2_01602840
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0162E8F0 2_2_0162E8F0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015E68B8 2_2_015E68B8
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016BAB40 2_2_016BAB40
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016B6BD7 2_2_016B6BD7
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015FEA80 2_2_015FEA80
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0160AD00 2_2_0160AD00
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0169CD1F 2_2_0169CD1F
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015FADE0 2_2_015FADE0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01618DBF 2_2_01618DBF
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01600C00 2_2_01600C00
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F0CF2 2_2_015F0CF2
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016A0CB5 2_2_016A0CB5
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01674F40 2_2_01674F40
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01642F28 2_2_01642F28
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01620F30 2_2_01620F30
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016A2F30 2_2_016A2F30
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F2FC8 2_2_015F2FC8
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0167EFA0 2_2_0167EFA0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01600E59 2_2_01600E59
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016BEE26 2_2_016BEE26
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016BEEDB 2_2_016BEEDB
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01612E90 2_2_01612E90
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016BCE93 2_2_016BCE93
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016CB16B 2_2_016CB16B
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0163516C 2_2_0163516C
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015EF172 2_2_015EF172
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0160B1B0 2_2_0160B1B0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016B70E9 2_2_016B70E9
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016BF0E0 2_2_016BF0E0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016070C0 2_2_016070C0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016AF0CC 2_2_016AF0CC
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015ED34C 2_2_015ED34C
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016B132D 2_2_016B132D
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0164739A 2_2_0164739A
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016A12ED 2_2_016A12ED
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0161D2F0 2_2_0161D2F0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0161B2C0 2_2_0161B2C0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016052A0 2_2_016052A0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016B7571 2_2_016B7571
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0169D5B0 2_2_0169D5B0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F1460 2_2_015F1460
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016BF43F 2_2_016BF43F
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016BF7B0 2_2_016BF7B0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01645630 2_2_01645630
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016B16CC 2_2_016B16CC
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01609950 2_2_01609950
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0161B950 2_2_0161B950
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01695910 2_2_01695910
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0166D800 2_2_0166D800
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016038E0 2_2_016038E0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016BFB76 2_2_016BFB76
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01675BF0 2_2_01675BF0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0163DBF9 2_2_0163DBF9
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0161FB80 2_2_0161FB80
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01673A6C 2_2_01673A6C
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016BFA49 2_2_016BFA49
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016B7A46 2_2_016B7A46
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016ADAC6 2_2_016ADAC6
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01645AA0 2_2_01645AA0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0169DAAC 2_2_0169DAAC
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016A1AA3 2_2_016A1AA3
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016B7D73 2_2_016B7D73
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01603D40 2_2_01603D40
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016B1D5A 2_2_016B1D5A
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0161FDC0 2_2_0161FDC0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01679C32 2_2_01679C32
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016BFCF2 2_2_016BFCF2
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016BFF09 2_2_016BFF09
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015C3FD5 2_2_015C3FD5
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015C3FD2 2_2_015C3FD2
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016BFFB1 2_2_016BFFB1
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01601F92 2_2_01601F92
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01609EB0 2_2_01609EB0
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe Code function: 6_2_03A6A3FD 6_2_03A6A3FD
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe Code function: 6_2_03A687E9 6_2_03A687E9
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe Code function: 6_2_03A686A5 6_2_03A686A5
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe Code function: 6_2_03A6A625 6_2_03A6A625
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe Code function: 6_2_03A70DA5 6_2_03A70DA5
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe Code function: 6_2_03A87D65 6_2_03A87D65
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe Code function: 6_2_03A6A405 6_2_03A6A405
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_034BA352 7_2_034BA352
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_034C03E6 7_2_034C03E6
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_0340E3F0 7_2_0340E3F0
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_034A0274 7_2_034A0274
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_034802C0 7_2_034802C0
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03488158 7_2_03488158
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_033F0100 7_2_033F0100
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_0349A118 7_2_0349A118
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_034B81CC 7_2_034B81CC
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_034C01AA 7_2_034C01AA
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_034B41A2 7_2_034B41A2
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03492000 7_2_03492000
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03424750 7_2_03424750
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03400770 7_2_03400770
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_033FC7C0 7_2_033FC7C0
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_0341C6E0 7_2_0341C6E0
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03400535 7_2_03400535
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_034C0591 7_2_034C0591
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_034B2446 7_2_034B2446
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_034A4420 7_2_034A4420
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_034AE4F6 7_2_034AE4F6
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_034BAB40 7_2_034BAB40
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_034B6BD7 7_2_034B6BD7
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_033FEA80 7_2_033FEA80
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03416962 7_2_03416962
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_034029A0 7_2_034029A0
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_034CA9A6 7_2_034CA9A6
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_0340A840 7_2_0340A840
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03402840 7_2_03402840
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_033E68B8 7_2_033E68B8
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_0342E8F0 7_2_0342E8F0
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03474F40 7_2_03474F40
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03442F28 7_2_03442F28
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03420F30 7_2_03420F30
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_034A2F30 7_2_034A2F30
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_0347EFA0 7_2_0347EFA0
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_033F2FC8 7_2_033F2FC8
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03400E59 7_2_03400E59
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_034BEE26 7_2_034BEE26
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_034BEEDB 7_2_034BEEDB
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03412E90 7_2_03412E90
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_034BCE93 7_2_034BCE93
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_0340AD00 7_2_0340AD00
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_0349CD1F 7_2_0349CD1F
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_033FADE0 7_2_033FADE0
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03418DBF 7_2_03418DBF
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03400C00 7_2_03400C00
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_033F0CF2 7_2_033F0CF2
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_034A0CB5 7_2_034A0CB5
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_034B132D 7_2_034B132D
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_033ED34C 7_2_033ED34C
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_0344739A 7_2_0344739A
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_0341B2C0 7_2_0341B2C0
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_034A12ED 7_2_034A12ED
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_0341D2F0 7_2_0341D2F0
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_034052A0 7_2_034052A0
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_034CB16B 7_2_034CB16B
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_0343516C 7_2_0343516C
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_033EF172 7_2_033EF172
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_0340B1B0 7_2_0340B1B0
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_034070C0 7_2_034070C0
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_034AF0CC 7_2_034AF0CC
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_034B70E9 7_2_034B70E9
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_034BF0E0 7_2_034BF0E0
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_034BF7B0 7_2_034BF7B0
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03445630 7_2_03445630
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_034B16CC 7_2_034B16CC
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_034B7571 7_2_034B7571
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_034C95C3 7_2_034C95C3
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_0349D5B0 7_2_0349D5B0
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_033F1460 7_2_033F1460
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_034BF43F 7_2_034BF43F
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_034BFB76 7_2_034BFB76
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03475BF0 7_2_03475BF0
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_0343DBF9 7_2_0343DBF9
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_0341FB80 7_2_0341FB80
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_034BFA49 7_2_034BFA49
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_034B7A46 7_2_034B7A46
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03473A6C 7_2_03473A6C
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_034ADAC6 7_2_034ADAC6
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03445AA0 7_2_03445AA0
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_0349DAAC 7_2_0349DAAC
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_034A1AA3 7_2_034A1AA3
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03409950 7_2_03409950
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_0341B950 7_2_0341B950
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03495910 7_2_03495910
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_0346D800 7_2_0346D800
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_034038E0 7_2_034038E0
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_034BFF09 7_2_034BFF09
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03401F92 7_2_03401F92
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_033C3FD5 7_2_033C3FD5
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_033C3FD2 7_2_033C3FD2
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_034BFFB1 7_2_034BFFB1
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03409EB0 7_2_03409EB0
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03403D40 7_2_03403D40
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_034B1D5A 7_2_034B1D5A
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_034B7D73 7_2_034B7D73
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_0341FDC0 7_2_0341FDC0
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_03479C32 7_2_03479C32
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_034BFCF2 7_2_034BFCF2
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_02C61760 7_2_02C61760
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_02C7A280 7_2_02C7A280
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_02C5ABC0 7_2_02C5ABC0
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_02C5CB40 7_2_02C5CB40
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_02C5C918 7_2_02C5C918
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_02C5C920 7_2_02C5C920
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_02C5AD04 7_2_02C5AD04
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_02C632C0 7_2_02C632C0
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_0371B148 7_2_0371B148
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_0371C0E8 7_2_0371C0E8
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_0371BD43 7_2_0371BD43
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_0371BC24 7_2_0371BC24
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\w32tm.exe Code function: String function: 03435130 appears 58 times
Source: C:\Windows\SysWOW64\w32tm.exe Code function: String function: 0347F290 appears 103 times
Source: C:\Windows\SysWOW64\w32tm.exe Code function: String function: 033EB970 appears 262 times
Source: C:\Windows\SysWOW64\w32tm.exe Code function: String function: 03447E54 appears 107 times
Source: C:\Windows\SysWOW64\w32tm.exe Code function: String function: 0346EA12 appears 86 times
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: String function: 01635130 appears 58 times
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: String function: 0166EA12 appears 86 times
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: String function: 01647E54 appears 99 times
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: String function: 0167F290 appears 103 times
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: String function: 015EB970 appears 262 times
PE / OLE file has an invalid certificate
Source: Inquiry No PJO-4010574.exe Static PE information: invalid certificate
Sample file is different than original file name gathered from version info
Source: Inquiry No PJO-4010574.exe, 00000000.00000002.1680053369.0000000005AB0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameRT.dll. vs Inquiry No PJO-4010574.exe
Source: Inquiry No PJO-4010574.exe, 00000000.00000002.1676543543.0000000004B71000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs Inquiry No PJO-4010574.exe
Source: Inquiry No PJO-4010574.exe, 00000000.00000002.1685839730.000000000D9E0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs Inquiry No PJO-4010574.exe
Source: Inquiry No PJO-4010574.exe, 00000000.00000002.1675902311.0000000003168000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameRT.dll. vs Inquiry No PJO-4010574.exe
Source: Inquiry No PJO-4010574.exe, 00000000.00000000.1652632490.0000000000BFE000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameaKtF.exe( vs Inquiry No PJO-4010574.exe
Source: Inquiry No PJO-4010574.exe, 00000000.00000002.1674169057.000000000113E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs Inquiry No PJO-4010574.exe
Source: Inquiry No PJO-4010574.exe, 00000002.00000002.1993291852.00000000016ED000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs Inquiry No PJO-4010574.exe
Source: Inquiry No PJO-4010574.exe, 00000002.00000002.1992887320.000000000105F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamew32time.dllj% vs Inquiry No PJO-4010574.exe
Source: Inquiry No PJO-4010574.exe, 00000002.00000002.1992887320.0000000001028000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamew32time.dllj% vs Inquiry No PJO-4010574.exe
Source: Inquiry No PJO-4010574.exe Binary or memory string: OriginalFilenameaKtF.exe( vs Inquiry No PJO-4010574.exe
Uses 32bit PE files
Source: Inquiry No PJO-4010574.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 2.2.Inquiry No PJO-4010574.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 2.2.Inquiry No PJO-4010574.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000007.00000002.4106839112.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.1994362170.0000000001910000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.1992596406.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000007.00000002.4105792819.0000000002C50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.4106877602.0000000003930000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000002.4109293629.0000000005670000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.1994602722.0000000002E20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000007.00000002.4107064100.0000000003280000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0.2.Inquiry No PJO-4010574.exe.4d97058.5.raw.unpack, jlyCsIJhdydLdiZic2.cs Security API names: _0020.SetAccessControl
Source: 0.2.Inquiry No PJO-4010574.exe.4d97058.5.raw.unpack, jlyCsIJhdydLdiZic2.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Inquiry No PJO-4010574.exe.4d97058.5.raw.unpack, jlyCsIJhdydLdiZic2.cs Security API names: _0020.AddAccessRule
Source: 0.2.Inquiry No PJO-4010574.exe.d9e0000.10.raw.unpack, Mt3guFvOHaG1AVqyKk.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Inquiry No PJO-4010574.exe.4e1ae78.6.raw.unpack, jlyCsIJhdydLdiZic2.cs Security API names: _0020.SetAccessControl
Source: 0.2.Inquiry No PJO-4010574.exe.4e1ae78.6.raw.unpack, jlyCsIJhdydLdiZic2.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Inquiry No PJO-4010574.exe.4e1ae78.6.raw.unpack, jlyCsIJhdydLdiZic2.cs Security API names: _0020.AddAccessRule
Source: 0.2.Inquiry No PJO-4010574.exe.d9e0000.10.raw.unpack, jlyCsIJhdydLdiZic2.cs Security API names: _0020.SetAccessControl
Source: 0.2.Inquiry No PJO-4010574.exe.d9e0000.10.raw.unpack, jlyCsIJhdydLdiZic2.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Inquiry No PJO-4010574.exe.d9e0000.10.raw.unpack, jlyCsIJhdydLdiZic2.cs Security API names: _0020.AddAccessRule
Source: 0.2.Inquiry No PJO-4010574.exe.4d97058.5.raw.unpack, Mt3guFvOHaG1AVqyKk.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Inquiry No PJO-4010574.exe.4e1ae78.6.raw.unpack, Mt3guFvOHaG1AVqyKk.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Inquiry No PJO-4010574.exe.31810e4.0.raw.unpack, ReactionVessel.cs Suspicious method names: .ReactionVessel.Inject
Source: 0.2.Inquiry No PJO-4010574.exe.31181d8.4.raw.unpack, ReactionVessel.cs Suspicious method names: .ReactionVessel.Inject
Source: 0.2.Inquiry No PJO-4010574.exe.65a0000.9.raw.unpack, ReactionVessel.cs Suspicious method names: .ReactionVessel.Inject
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@7/2@15/10
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Inquiry No PJO-4010574.exe.log Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Mutant created: NULL
Source: C:\Windows\SysWOW64\w32tm.exe File created: C:\Users\user\AppData\Local\Temp\6U1s-63 Jump to behavior
Source: Inquiry No PJO-4010574.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: Inquiry No PJO-4010574.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%
Source: C:\Program Files\Mozilla Firefox\firefox.exe File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: Inquiry No PJO-4010574.exe, 00000000.00000000.1652539662.0000000000B02000.00000002.00000001.01000000.00000003.sdmp, w32tm.exe, 00000007.00000002.4107602600.0000000003A8C000.00000004.10000000.00040000.00000000.sdmp, w32tm.exe, 00000007.00000002.4106960993.000000000316D000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000009.00000002.2279720857.00000000175AC000.00000004.80000000.00040000.00000000.sdmp Binary or memory string: INSERT INTO tab_grade (gId, gName) VALUES(NULL, @gName);SELECT @@IDENTITY# Add successfullyInfo%Add unsuccessfully-Grade name not changed
Source: w32tm.exe, 00000007.00000003.2174341266.0000000002D97000.00000004.00000020.00020000.00000000.sdmp, w32tm.exe, 00000007.00000002.4105919654.0000000002D97000.00000004.00000020.00020000.00000000.sdmp, w32tm.exe, 00000007.00000003.2172046053.0000000002D97000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: Inquiry No PJO-4010574.exe ReversingLabs: Detection: 36%
Source: unknown Process created: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe "C:\Users\user\Desktop\Inquiry No PJO-4010574.exe"
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process created: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe "C:\Users\user\Desktop\Inquiry No PJO-4010574.exe"
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe Process created: C:\Windows\SysWOW64\w32tm.exe "C:\Windows\SysWOW64\w32tm.exe"
Source: C:\Windows\SysWOW64\w32tm.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process created: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe "C:\Users\user\Desktop\Inquiry No PJO-4010574.exe" Jump to behavior
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe Process created: C:\Windows\SysWOW64\w32tm.exe "C:\Windows\SysWOW64\w32tm.exe" Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe" Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe Section loaded: ntdsapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe Section loaded: mlang.dll Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe Section loaded: winsqlite3.dll Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\ Jump to behavior
Source: Inquiry No PJO-4010574.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: Inquiry No PJO-4010574.exe Static file information: File size 1059848 > 1048576
Source: Inquiry No PJO-4010574.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Inquiry No PJO-4010574.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: w32tm.pdb source: Inquiry No PJO-4010574.exe, 00000002.00000002.1992887320.0000000001028000.00000004.00000020.00020000.00000000.sdmp, HeKTvWjrtOUnkuZfNlEvF.exe, 00000006.00000002.4106112279.0000000000748000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: aKtF.pdbSHA256 source: Inquiry No PJO-4010574.exe
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: HeKTvWjrtOUnkuZfNlEvF.exe, 00000006.00000000.1907354628.000000000088E000.00000002.00000001.01000000.0000000C.sdmp, HeKTvWjrtOUnkuZfNlEvF.exe, 00000008.00000000.2059831890.000000000088E000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: wntdll.pdbUGP source: Inquiry No PJO-4010574.exe, 00000002.00000002.1993291852.00000000015C0000.00000040.00001000.00020000.00000000.sdmp, w32tm.exe, 00000007.00000003.1992866888.0000000003061000.00000004.00000020.00020000.00000000.sdmp, w32tm.exe, 00000007.00000002.4107154870.000000000355E000.00000040.00001000.00020000.00000000.sdmp, w32tm.exe, 00000007.00000002.4107154870.00000000033C0000.00000040.00001000.00020000.00000000.sdmp, w32tm.exe, 00000007.00000003.1995659709.0000000003210000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: Inquiry No PJO-4010574.exe, Inquiry No PJO-4010574.exe, 00000002.00000002.1993291852.00000000015C0000.00000040.00001000.00020000.00000000.sdmp, w32tm.exe, w32tm.exe, 00000007.00000003.1992866888.0000000003061000.00000004.00000020.00020000.00000000.sdmp, w32tm.exe, 00000007.00000002.4107154870.000000000355E000.00000040.00001000.00020000.00000000.sdmp, w32tm.exe, 00000007.00000002.4107154870.00000000033C0000.00000040.00001000.00020000.00000000.sdmp, w32tm.exe, 00000007.00000003.1995659709.0000000003210000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: aKtF.pdb source: Inquiry No PJO-4010574.exe
Source: Binary string: w32tm.pdbGCTL source: Inquiry No PJO-4010574.exe, 00000002.00000002.1992887320.0000000001028000.00000004.00000020.00020000.00000000.sdmp, HeKTvWjrtOUnkuZfNlEvF.exe, 00000006.00000002.4106112279.0000000000748000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: Inquiry No PJO-4010574.exe, frm_login.cs .Net Code: InitializeComponent
Source: 0.2.Inquiry No PJO-4010574.exe.5ab0000.7.raw.unpack, -Module-.cs .Net Code: _200D_200D_202B_206F_206A_206B_202B_200B_200D_206D_200C_206B_206A_200B_202E_200C_200E_202A_200E_206D_206F_202D_206F_206D_206C_200F_206A_202D_206C_202B_206A_206F_202A_206A_200E_200F_200B_200F_202E_202D_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.Inquiry No PJO-4010574.exe.5ab0000.7.raw.unpack, PingPong.cs .Net Code: _206E_206D_206E_206E_202E_202E_200C_206A_202D_206E_200C_202B_200F_206E_200B_202E_200E_202A_202D_200E_200E_200E_200E_202B_200E_202C_200C_200B_202C_202D_200C_202A_200B_200C_206D_206B_202B_202A_202E_200C_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.Inquiry No PJO-4010574.exe.4d97058.5.raw.unpack, jlyCsIJhdydLdiZic2.cs .Net Code: sRsLKgtK63 System.Reflection.Assembly.Load(byte[])
Source: 0.2.Inquiry No PJO-4010574.exe.4e1ae78.6.raw.unpack, jlyCsIJhdydLdiZic2.cs .Net Code: sRsLKgtK63 System.Reflection.Assembly.Load(byte[])
Source: 0.2.Inquiry No PJO-4010574.exe.d9e0000.10.raw.unpack, jlyCsIJhdydLdiZic2.cs .Net Code: sRsLKgtK63 System.Reflection.Assembly.Load(byte[])
Source: 7.2.w32tm.exe.3a8cd08.2.raw.unpack, frm_login.cs .Net Code: InitializeComponent
Source: 8.2.HeKTvWjrtOUnkuZfNlEvF.exe.323cd08.1.raw.unpack, frm_login.cs .Net Code: InitializeComponent
Source: 8.0.HeKTvWjrtOUnkuZfNlEvF.exe.323cd08.1.raw.unpack, frm_login.cs .Net Code: InitializeComponent
Source: 9.2.firefox.exe.175acd08.0.raw.unpack, frm_login.cs .Net Code: InitializeComponent
Binary contains a suspicious time stamp
Source: Inquiry No PJO-4010574.exe Static PE information: 0xFA6A0E45 [Sun Feb 18 15:07:49 2103 UTC]
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 0_2_02F0F110 pushad ; iretd 0_2_02F0F111
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 0_2_05AD4C38 push esp; retf 0_2_05AD4C39
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 0_2_05AD0C01 push 8BBCEB50h; ret 0_2_05AD0C07
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_00407947 push ebx; retf 2_2_00407948
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0041A1AE push eax; iretd 2_2_0041A1DD
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0041A1B3 push eax; iretd 2_2_0041A1DD
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0041CA3D push ebp; retf 2_2_0041CA3E
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0041A2F5 push esi; ret 2_2_0041A2FB
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0041A294 push ebp; ret 2_2_0041A2A3
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_00403350 push eax; ret 2_2_00403352
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0040836A push edx; iretd 2_2_0040836B
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_00417C75 push ds; ret 2_2_00417D02
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_00417C2A push FFFFFF92h; ret 2_2_00417C37
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0040CC31 push ebp; retf 2_2_0040CC51
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_00417CDB push ds; ret 2_2_00417D02
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0041A4DF push eax; retf 2_2_0041A4E0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_00417643 pushfd ; retf 07A8h 2_2_0041770E
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0040A6B3 push esi; retf 2_2_0040A6BD
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015C225F pushad ; ret 2_2_015C27F9
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015C27FA pushad ; ret 2_2_015C27F9
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F09AD push ecx; mov dword ptr [esp], ecx 2_2_015F09B6
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015C283D push eax; iretd 2_2_015C2858
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe Code function: 6_2_03A723BC push FFFFFF92h; ret 6_2_03A723C9
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe Code function: 6_2_03A673C3 push ebp; retf 6_2_03A673E3
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe Code function: 6_2_03A74A87 push esi; ret 6_2_03A74A8D
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe Code function: 6_2_03A62AFC push edx; iretd 6_2_03A62AFD
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe Code function: 6_2_03A74A26 push ebp; ret 6_2_03A74A35
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe Code function: 6_2_03A78A47 push cs; retf 6_2_03A78A48
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe Code function: 6_2_03A7898C push es; iretd 6_2_03A7898D
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe Code function: 6_2_03A771CF push ebp; retf 6_2_03A771D0
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe Code function: 6_2_03A74945 push eax; iretd 6_2_03A7496F
Source: Inquiry No PJO-4010574.exe Static PE information: section name: .text entropy: 7.192378963901829
Source: 0.2.Inquiry No PJO-4010574.exe.4d97058.5.raw.unpack, HZfiQZegVXaNZioKFCU.cs High entropy of concatenated method names: 'd89W2WjuW5', 'zyBWPKQ5Mt', 'dcvWKO4vvr', 'xa1WRwf6sM', 's0GWf7y58N', 'y3GWdf6PRj', 'cBpWrFehhy', 'sirWv1Eh2m', 'OnGWiWab5m', 'JibWHN8NM6'
Source: 0.2.Inquiry No PJO-4010574.exe.4d97058.5.raw.unpack, hOBKZ99L1VvIPkFMcY.cs High entropy of concatenated method names: 'aho8v10t4f', 'zoj8iJk6Mp', 'yHD8MuiMUk', 'JAv8ndEJ6j', 'VSb8twC6ul', 'x8l8pq1lc1', 'NSe8NshoOq', 'eIS8S7i05u', 'gOe8GuECtk', 'qYO8CiICbs'
Source: 0.2.Inquiry No PJO-4010574.exe.4d97058.5.raw.unpack, n1bajde0VoktvHxhIaq.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'JJn6UqAHGs', 'ie86cvL8tV', 'w2M6Ac87c3', 'QZc6Z7HZJY', 'N2e6a14msQ', 'AB86BCnxBm', 'pfd6TaTSan'
Source: 0.2.Inquiry No PJO-4010574.exe.4d97058.5.raw.unpack, N1W1qCV58swAJ16fOj.cs High entropy of concatenated method names: 'bWfqM4Fh7Y', 'lltqnobM9f', 'K0Dq5ahhV7', 'IsoqtOurMD', 'hvEqU3cHqA', 'lAFqp1HoGs', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Inquiry No PJO-4010574.exe.4d97058.5.raw.unpack, Mt3guFvOHaG1AVqyKk.cs High entropy of concatenated method names: 'nnbhUwjeLJ', 'c17hcgvbri', 'zu9hAl9yFq', 'rfmhZlpxIK', 'WdMha4NibO', 'AcihBeDS9J', 'jRehTnUJgD', 'pJNhmgCQux', 'fTChVyoYMM', 'gFihl6i7Ih'
Source: 0.2.Inquiry No PJO-4010574.exe.4d97058.5.raw.unpack, VmjXDYyAB62AtkUGF0.cs High entropy of concatenated method names: 'n8WKLULbA', 'EZYRAct6x', 'n3KdwqLaa', 'WwqrykeXp', 'ckii88Zkw', 'UlKHCUH7Q', 'fkLB2r4sat7NVSKgF9', 'utkrleKRvc0iS8qyIM', 'qR8qpjmRL', 'mW66igCUq'
Source: 0.2.Inquiry No PJO-4010574.exe.4d97058.5.raw.unpack, R6F553Z08eJLqMtruS.cs High entropy of concatenated method names: 'QYKxEv0XX7', 'vQjxu7Oi7h', 'ToString', 'isixjQgcFK', 'SgFxh0Y8ba', 'GaWxoyhBqk', 'kiZxXG5IEc', 'rg3xbm7I3h', 'RGZxQhd2Ev', 'sCqxJ7AlWT'
Source: 0.2.Inquiry No PJO-4010574.exe.4d97058.5.raw.unpack, Hq0l0dM86n1JSfT47Q.cs High entropy of concatenated method names: 'DRWbFUySsZ', 'O93bhigosA', 'sKubXqigkF', 'f2NbQDJcaU', 'XFabJGRMim', 'MYWXaZg7uV', 'RJfXB6vpLN', 'wD8XTeI7a9', 't5AXmlLyyZ', 'vcuXVS6srw'
Source: 0.2.Inquiry No PJO-4010574.exe.4d97058.5.raw.unpack, sptFLA3Sdi7eaSVAvF.cs High entropy of concatenated method names: 'DQvQ2r630f', 's5vQPTFgo0', 'bCvQKKCOVK', 'xV6QR2KQCg', 'aiDQfYK1Bo', 'GFtQdWI5eM', 'LijQrkhrLX', 'FaJQvjqkD4', 'tAtQibiBTm', 'FLtQHGXmbw'
Source: 0.2.Inquiry No PJO-4010574.exe.4d97058.5.raw.unpack, XblrE9NO6nWQbkJB1v.cs High entropy of concatenated method names: 'eJ5QjGrijv', 'yLQQoYVKKW', 'eytQbx2C4Q', 'pEVblSh9s4', 'SwtbzTHxIQ', 'n6NQgg8GTa', 'rXfQekvkHo', 'hW8QyFvIoF', 'fSjQ0aRwKX', 'WM4QLt27pI'
Source: 0.2.Inquiry No PJO-4010574.exe.4d97058.5.raw.unpack, aNsZB6mFlVic3U6jXQ.cs High entropy of concatenated method names: 'pZiqjJn38x', 'a0HqhVngoP', 'wlLqojlVNw', 'jcxqXvEuQJ', 'zICqbTiWa9', 'dADqQuuKE4', 'PqKqJuWuIA', 'g7hqYfJJ65', 'ljeqErx9W9', 'jXLquXRT1T'
Source: 0.2.Inquiry No PJO-4010574.exe.4d97058.5.raw.unpack, aNig6qlFjH0Z8ElFE0.cs High entropy of concatenated method names: 'VdDWe3ShTy', 'xVeW0itwXP', 'l6nWLbecka', 'I86WjxwR9p', 'qwpWh4yE9a', 'vWOWXdlLTS', 'FfvWbkRUjL', 'DHSqTEJtgb', 'sVLqmjYCX3', 'joHqVOyGkf'
Source: 0.2.Inquiry No PJO-4010574.exe.4d97058.5.raw.unpack, jlyCsIJhdydLdiZic2.cs High entropy of concatenated method names: 'pUQ0FPIvnr', 'Hwk0jrndg6', 'uax0hjxaBT', 'ldc0oUOInT', 'omw0Xkwq0v', 'G2j0btLQ3a', 'cXJ0Q3gxO2', 'MVj0JjeLIW', 'qDN0YAicdt', 'VDF0E0YJea'
Source: 0.2.Inquiry No PJO-4010574.exe.4d97058.5.raw.unpack, dH0IG9hiOWlT2GAXaI.cs High entropy of concatenated method names: 'Dispose', 'ydveVXmxnO', 'envyn0dkFL', 'Aix44j1iuF', 'dgNelsZB6F', 'YViezc3U6j', 'ProcessDialogKey', 'iQGyg1W1qC', 'H8syewAJ16', 'AOjyygNig6'
Source: 0.2.Inquiry No PJO-4010574.exe.4d97058.5.raw.unpack, UheDuMBpsjhupJXKnC.cs High entropy of concatenated method names: 'N1Bxm40KWt', 'EMoxlsx1Kb', 'r6pqgEZGjq', 'EkeqeMwbG7', 'VYwxCvyGDY', 'K5tx7lM1jU', 'a1sx9I3mi7', 'ahZxUXv3wf', 'nAJxcx3rZp', 'CMZxAABBkk'
Source: 0.2.Inquiry No PJO-4010574.exe.4d97058.5.raw.unpack, KnNkSuLCjgF2P8p60s.cs High entropy of concatenated method names: 'n1SeQt3guF', 'xHaeJG1AVq', 'EUkeExI9GK', 'c2oeurKwXc', 'BiBeDri5q0', 'Y0deI86n1J', 'J2Vey3UkGcPfn9uY3y', 'dG53QhrhckVodVtpp4', 'EooeeIERNP', 'kIue0k8fwY'
Source: 0.2.Inquiry No PJO-4010574.exe.4d97058.5.raw.unpack, iSGaOHiUkxI9GK02or.cs High entropy of concatenated method names: 'pGdoRrCgZg', 'FlVodZvKJT', 'q8BovI0ML6', 'DYBoiiBQAk', 'cvQoDbydhy', 'dAooI9ia8X', 'KPEox0qOZG', 'M8QoqaDgGo', 'gJ4oWgA13D', 'UMMo60U7qH'
Source: 0.2.Inquiry No PJO-4010574.exe.4d97058.5.raw.unpack, Cr72uOAWSMcsZRZ3Pf.cs High entropy of concatenated method names: 'ToString', 'au3IC0Ny6A', 'qwuInbHYt0', 'xSEI5lBXiE', 'Pq9Itbb1Q3', 'RsiIpBfkUp', 'UhII1tL9lM', 'selIND9XZt', 'EL0ISFM2yZ', 'hbAI3jZAge'
Source: 0.2.Inquiry No PJO-4010574.exe.4d97058.5.raw.unpack, zwXcfuHLFGMHIdiBri.cs High entropy of concatenated method names: 'o30XfV0COE', 'UEIXrOrqcg', 'IbLo53tkKU', 'eDootH3wkq', 'CT4opi3wXx', 'Oano1sMVhB', 'QoRoNcb1VF', 'j9roSt2Jlq', 'ECCo38j0Hm', 'p9toGWc8Pf'
Source: 0.2.Inquiry No PJO-4010574.exe.4d97058.5.raw.unpack, EvAiwfUE1bA66crygk.cs High entropy of concatenated method names: 'fSJDGFi9es', 'o79D70WMhq', 'oi0DUHdh1o', 'aZUDcCqKcU', 'ImnDna5CB6', 'Mu7D5jqmvg', 'NRXDtOq0nf', 'w5uDphxegF', 'mqnD1jpePZ', 'y4rDN3ZKfr'
Source: 0.2.Inquiry No PJO-4010574.exe.4e1ae78.6.raw.unpack, HZfiQZegVXaNZioKFCU.cs High entropy of concatenated method names: 'd89W2WjuW5', 'zyBWPKQ5Mt', 'dcvWKO4vvr', 'xa1WRwf6sM', 's0GWf7y58N', 'y3GWdf6PRj', 'cBpWrFehhy', 'sirWv1Eh2m', 'OnGWiWab5m', 'JibWHN8NM6'
Source: 0.2.Inquiry No PJO-4010574.exe.4e1ae78.6.raw.unpack, hOBKZ99L1VvIPkFMcY.cs High entropy of concatenated method names: 'aho8v10t4f', 'zoj8iJk6Mp', 'yHD8MuiMUk', 'JAv8ndEJ6j', 'VSb8twC6ul', 'x8l8pq1lc1', 'NSe8NshoOq', 'eIS8S7i05u', 'gOe8GuECtk', 'qYO8CiICbs'
Source: 0.2.Inquiry No PJO-4010574.exe.4e1ae78.6.raw.unpack, n1bajde0VoktvHxhIaq.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'JJn6UqAHGs', 'ie86cvL8tV', 'w2M6Ac87c3', 'QZc6Z7HZJY', 'N2e6a14msQ', 'AB86BCnxBm', 'pfd6TaTSan'
Source: 0.2.Inquiry No PJO-4010574.exe.4e1ae78.6.raw.unpack, N1W1qCV58swAJ16fOj.cs High entropy of concatenated method names: 'bWfqM4Fh7Y', 'lltqnobM9f', 'K0Dq5ahhV7', 'IsoqtOurMD', 'hvEqU3cHqA', 'lAFqp1HoGs', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Inquiry No PJO-4010574.exe.4e1ae78.6.raw.unpack, Mt3guFvOHaG1AVqyKk.cs High entropy of concatenated method names: 'nnbhUwjeLJ', 'c17hcgvbri', 'zu9hAl9yFq', 'rfmhZlpxIK', 'WdMha4NibO', 'AcihBeDS9J', 'jRehTnUJgD', 'pJNhmgCQux', 'fTChVyoYMM', 'gFihl6i7Ih'
Source: 0.2.Inquiry No PJO-4010574.exe.4e1ae78.6.raw.unpack, VmjXDYyAB62AtkUGF0.cs High entropy of concatenated method names: 'n8WKLULbA', 'EZYRAct6x', 'n3KdwqLaa', 'WwqrykeXp', 'ckii88Zkw', 'UlKHCUH7Q', 'fkLB2r4sat7NVSKgF9', 'utkrleKRvc0iS8qyIM', 'qR8qpjmRL', 'mW66igCUq'
Source: 0.2.Inquiry No PJO-4010574.exe.4e1ae78.6.raw.unpack, R6F553Z08eJLqMtruS.cs High entropy of concatenated method names: 'QYKxEv0XX7', 'vQjxu7Oi7h', 'ToString', 'isixjQgcFK', 'SgFxh0Y8ba', 'GaWxoyhBqk', 'kiZxXG5IEc', 'rg3xbm7I3h', 'RGZxQhd2Ev', 'sCqxJ7AlWT'
Source: 0.2.Inquiry No PJO-4010574.exe.4e1ae78.6.raw.unpack, Hq0l0dM86n1JSfT47Q.cs High entropy of concatenated method names: 'DRWbFUySsZ', 'O93bhigosA', 'sKubXqigkF', 'f2NbQDJcaU', 'XFabJGRMim', 'MYWXaZg7uV', 'RJfXB6vpLN', 'wD8XTeI7a9', 't5AXmlLyyZ', 'vcuXVS6srw'
Source: 0.2.Inquiry No PJO-4010574.exe.4e1ae78.6.raw.unpack, sptFLA3Sdi7eaSVAvF.cs High entropy of concatenated method names: 'DQvQ2r630f', 's5vQPTFgo0', 'bCvQKKCOVK', 'xV6QR2KQCg', 'aiDQfYK1Bo', 'GFtQdWI5eM', 'LijQrkhrLX', 'FaJQvjqkD4', 'tAtQibiBTm', 'FLtQHGXmbw'
Source: 0.2.Inquiry No PJO-4010574.exe.4e1ae78.6.raw.unpack, XblrE9NO6nWQbkJB1v.cs High entropy of concatenated method names: 'eJ5QjGrijv', 'yLQQoYVKKW', 'eytQbx2C4Q', 'pEVblSh9s4', 'SwtbzTHxIQ', 'n6NQgg8GTa', 'rXfQekvkHo', 'hW8QyFvIoF', 'fSjQ0aRwKX', 'WM4QLt27pI'
Source: 0.2.Inquiry No PJO-4010574.exe.4e1ae78.6.raw.unpack, aNsZB6mFlVic3U6jXQ.cs High entropy of concatenated method names: 'pZiqjJn38x', 'a0HqhVngoP', 'wlLqojlVNw', 'jcxqXvEuQJ', 'zICqbTiWa9', 'dADqQuuKE4', 'PqKqJuWuIA', 'g7hqYfJJ65', 'ljeqErx9W9', 'jXLquXRT1T'
Source: 0.2.Inquiry No PJO-4010574.exe.4e1ae78.6.raw.unpack, aNig6qlFjH0Z8ElFE0.cs High entropy of concatenated method names: 'VdDWe3ShTy', 'xVeW0itwXP', 'l6nWLbecka', 'I86WjxwR9p', 'qwpWh4yE9a', 'vWOWXdlLTS', 'FfvWbkRUjL', 'DHSqTEJtgb', 'sVLqmjYCX3', 'joHqVOyGkf'
Source: 0.2.Inquiry No PJO-4010574.exe.4e1ae78.6.raw.unpack, jlyCsIJhdydLdiZic2.cs High entropy of concatenated method names: 'pUQ0FPIvnr', 'Hwk0jrndg6', 'uax0hjxaBT', 'ldc0oUOInT', 'omw0Xkwq0v', 'G2j0btLQ3a', 'cXJ0Q3gxO2', 'MVj0JjeLIW', 'qDN0YAicdt', 'VDF0E0YJea'
Source: 0.2.Inquiry No PJO-4010574.exe.4e1ae78.6.raw.unpack, dH0IG9hiOWlT2GAXaI.cs High entropy of concatenated method names: 'Dispose', 'ydveVXmxnO', 'envyn0dkFL', 'Aix44j1iuF', 'dgNelsZB6F', 'YViezc3U6j', 'ProcessDialogKey', 'iQGyg1W1qC', 'H8syewAJ16', 'AOjyygNig6'
Source: 0.2.Inquiry No PJO-4010574.exe.4e1ae78.6.raw.unpack, UheDuMBpsjhupJXKnC.cs High entropy of concatenated method names: 'N1Bxm40KWt', 'EMoxlsx1Kb', 'r6pqgEZGjq', 'EkeqeMwbG7', 'VYwxCvyGDY', 'K5tx7lM1jU', 'a1sx9I3mi7', 'ahZxUXv3wf', 'nAJxcx3rZp', 'CMZxAABBkk'
Source: 0.2.Inquiry No PJO-4010574.exe.4e1ae78.6.raw.unpack, KnNkSuLCjgF2P8p60s.cs High entropy of concatenated method names: 'n1SeQt3guF', 'xHaeJG1AVq', 'EUkeExI9GK', 'c2oeurKwXc', 'BiBeDri5q0', 'Y0deI86n1J', 'J2Vey3UkGcPfn9uY3y', 'dG53QhrhckVodVtpp4', 'EooeeIERNP', 'kIue0k8fwY'
Source: 0.2.Inquiry No PJO-4010574.exe.4e1ae78.6.raw.unpack, iSGaOHiUkxI9GK02or.cs High entropy of concatenated method names: 'pGdoRrCgZg', 'FlVodZvKJT', 'q8BovI0ML6', 'DYBoiiBQAk', 'cvQoDbydhy', 'dAooI9ia8X', 'KPEox0qOZG', 'M8QoqaDgGo', 'gJ4oWgA13D', 'UMMo60U7qH'
Source: 0.2.Inquiry No PJO-4010574.exe.4e1ae78.6.raw.unpack, Cr72uOAWSMcsZRZ3Pf.cs High entropy of concatenated method names: 'ToString', 'au3IC0Ny6A', 'qwuInbHYt0', 'xSEI5lBXiE', 'Pq9Itbb1Q3', 'RsiIpBfkUp', 'UhII1tL9lM', 'selIND9XZt', 'EL0ISFM2yZ', 'hbAI3jZAge'
Source: 0.2.Inquiry No PJO-4010574.exe.4e1ae78.6.raw.unpack, zwXcfuHLFGMHIdiBri.cs High entropy of concatenated method names: 'o30XfV0COE', 'UEIXrOrqcg', 'IbLo53tkKU', 'eDootH3wkq', 'CT4opi3wXx', 'Oano1sMVhB', 'QoRoNcb1VF', 'j9roSt2Jlq', 'ECCo38j0Hm', 'p9toGWc8Pf'
Source: 0.2.Inquiry No PJO-4010574.exe.4e1ae78.6.raw.unpack, EvAiwfUE1bA66crygk.cs High entropy of concatenated method names: 'fSJDGFi9es', 'o79D70WMhq', 'oi0DUHdh1o', 'aZUDcCqKcU', 'ImnDna5CB6', 'Mu7D5jqmvg', 'NRXDtOq0nf', 'w5uDphxegF', 'mqnD1jpePZ', 'y4rDN3ZKfr'
Source: 0.2.Inquiry No PJO-4010574.exe.d9e0000.10.raw.unpack, HZfiQZegVXaNZioKFCU.cs High entropy of concatenated method names: 'd89W2WjuW5', 'zyBWPKQ5Mt', 'dcvWKO4vvr', 'xa1WRwf6sM', 's0GWf7y58N', 'y3GWdf6PRj', 'cBpWrFehhy', 'sirWv1Eh2m', 'OnGWiWab5m', 'JibWHN8NM6'
Source: 0.2.Inquiry No PJO-4010574.exe.d9e0000.10.raw.unpack, hOBKZ99L1VvIPkFMcY.cs High entropy of concatenated method names: 'aho8v10t4f', 'zoj8iJk6Mp', 'yHD8MuiMUk', 'JAv8ndEJ6j', 'VSb8twC6ul', 'x8l8pq1lc1', 'NSe8NshoOq', 'eIS8S7i05u', 'gOe8GuECtk', 'qYO8CiICbs'
Source: 0.2.Inquiry No PJO-4010574.exe.d9e0000.10.raw.unpack, n1bajde0VoktvHxhIaq.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'JJn6UqAHGs', 'ie86cvL8tV', 'w2M6Ac87c3', 'QZc6Z7HZJY', 'N2e6a14msQ', 'AB86BCnxBm', 'pfd6TaTSan'
Source: 0.2.Inquiry No PJO-4010574.exe.d9e0000.10.raw.unpack, N1W1qCV58swAJ16fOj.cs High entropy of concatenated method names: 'bWfqM4Fh7Y', 'lltqnobM9f', 'K0Dq5ahhV7', 'IsoqtOurMD', 'hvEqU3cHqA', 'lAFqp1HoGs', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Inquiry No PJO-4010574.exe.d9e0000.10.raw.unpack, Mt3guFvOHaG1AVqyKk.cs High entropy of concatenated method names: 'nnbhUwjeLJ', 'c17hcgvbri', 'zu9hAl9yFq', 'rfmhZlpxIK', 'WdMha4NibO', 'AcihBeDS9J', 'jRehTnUJgD', 'pJNhmgCQux', 'fTChVyoYMM', 'gFihl6i7Ih'
Source: 0.2.Inquiry No PJO-4010574.exe.d9e0000.10.raw.unpack, VmjXDYyAB62AtkUGF0.cs High entropy of concatenated method names: 'n8WKLULbA', 'EZYRAct6x', 'n3KdwqLaa', 'WwqrykeXp', 'ckii88Zkw', 'UlKHCUH7Q', 'fkLB2r4sat7NVSKgF9', 'utkrleKRvc0iS8qyIM', 'qR8qpjmRL', 'mW66igCUq'
Source: 0.2.Inquiry No PJO-4010574.exe.d9e0000.10.raw.unpack, R6F553Z08eJLqMtruS.cs High entropy of concatenated method names: 'QYKxEv0XX7', 'vQjxu7Oi7h', 'ToString', 'isixjQgcFK', 'SgFxh0Y8ba', 'GaWxoyhBqk', 'kiZxXG5IEc', 'rg3xbm7I3h', 'RGZxQhd2Ev', 'sCqxJ7AlWT'
Source: 0.2.Inquiry No PJO-4010574.exe.d9e0000.10.raw.unpack, Hq0l0dM86n1JSfT47Q.cs High entropy of concatenated method names: 'DRWbFUySsZ', 'O93bhigosA', 'sKubXqigkF', 'f2NbQDJcaU', 'XFabJGRMim', 'MYWXaZg7uV', 'RJfXB6vpLN', 'wD8XTeI7a9', 't5AXmlLyyZ', 'vcuXVS6srw'
Source: 0.2.Inquiry No PJO-4010574.exe.d9e0000.10.raw.unpack, sptFLA3Sdi7eaSVAvF.cs High entropy of concatenated method names: 'DQvQ2r630f', 's5vQPTFgo0', 'bCvQKKCOVK', 'xV6QR2KQCg', 'aiDQfYK1Bo', 'GFtQdWI5eM', 'LijQrkhrLX', 'FaJQvjqkD4', 'tAtQibiBTm', 'FLtQHGXmbw'
Source: 0.2.Inquiry No PJO-4010574.exe.d9e0000.10.raw.unpack, XblrE9NO6nWQbkJB1v.cs High entropy of concatenated method names: 'eJ5QjGrijv', 'yLQQoYVKKW', 'eytQbx2C4Q', 'pEVblSh9s4', 'SwtbzTHxIQ', 'n6NQgg8GTa', 'rXfQekvkHo', 'hW8QyFvIoF', 'fSjQ0aRwKX', 'WM4QLt27pI'
Source: 0.2.Inquiry No PJO-4010574.exe.d9e0000.10.raw.unpack, aNsZB6mFlVic3U6jXQ.cs High entropy of concatenated method names: 'pZiqjJn38x', 'a0HqhVngoP', 'wlLqojlVNw', 'jcxqXvEuQJ', 'zICqbTiWa9', 'dADqQuuKE4', 'PqKqJuWuIA', 'g7hqYfJJ65', 'ljeqErx9W9', 'jXLquXRT1T'
Source: 0.2.Inquiry No PJO-4010574.exe.d9e0000.10.raw.unpack, aNig6qlFjH0Z8ElFE0.cs High entropy of concatenated method names: 'VdDWe3ShTy', 'xVeW0itwXP', 'l6nWLbecka', 'I86WjxwR9p', 'qwpWh4yE9a', 'vWOWXdlLTS', 'FfvWbkRUjL', 'DHSqTEJtgb', 'sVLqmjYCX3', 'joHqVOyGkf'
Source: 0.2.Inquiry No PJO-4010574.exe.d9e0000.10.raw.unpack, jlyCsIJhdydLdiZic2.cs High entropy of concatenated method names: 'pUQ0FPIvnr', 'Hwk0jrndg6', 'uax0hjxaBT', 'ldc0oUOInT', 'omw0Xkwq0v', 'G2j0btLQ3a', 'cXJ0Q3gxO2', 'MVj0JjeLIW', 'qDN0YAicdt', 'VDF0E0YJea'
Source: 0.2.Inquiry No PJO-4010574.exe.d9e0000.10.raw.unpack, dH0IG9hiOWlT2GAXaI.cs High entropy of concatenated method names: 'Dispose', 'ydveVXmxnO', 'envyn0dkFL', 'Aix44j1iuF', 'dgNelsZB6F', 'YViezc3U6j', 'ProcessDialogKey', 'iQGyg1W1qC', 'H8syewAJ16', 'AOjyygNig6'
Source: 0.2.Inquiry No PJO-4010574.exe.d9e0000.10.raw.unpack, UheDuMBpsjhupJXKnC.cs High entropy of concatenated method names: 'N1Bxm40KWt', 'EMoxlsx1Kb', 'r6pqgEZGjq', 'EkeqeMwbG7', 'VYwxCvyGDY', 'K5tx7lM1jU', 'a1sx9I3mi7', 'ahZxUXv3wf', 'nAJxcx3rZp', 'CMZxAABBkk'
Source: 0.2.Inquiry No PJO-4010574.exe.d9e0000.10.raw.unpack, KnNkSuLCjgF2P8p60s.cs High entropy of concatenated method names: 'n1SeQt3guF', 'xHaeJG1AVq', 'EUkeExI9GK', 'c2oeurKwXc', 'BiBeDri5q0', 'Y0deI86n1J', 'J2Vey3UkGcPfn9uY3y', 'dG53QhrhckVodVtpp4', 'EooeeIERNP', 'kIue0k8fwY'
Source: 0.2.Inquiry No PJO-4010574.exe.d9e0000.10.raw.unpack, iSGaOHiUkxI9GK02or.cs High entropy of concatenated method names: 'pGdoRrCgZg', 'FlVodZvKJT', 'q8BovI0ML6', 'DYBoiiBQAk', 'cvQoDbydhy', 'dAooI9ia8X', 'KPEox0qOZG', 'M8QoqaDgGo', 'gJ4oWgA13D', 'UMMo60U7qH'
Source: 0.2.Inquiry No PJO-4010574.exe.d9e0000.10.raw.unpack, Cr72uOAWSMcsZRZ3Pf.cs High entropy of concatenated method names: 'ToString', 'au3IC0Ny6A', 'qwuInbHYt0', 'xSEI5lBXiE', 'Pq9Itbb1Q3', 'RsiIpBfkUp', 'UhII1tL9lM', 'selIND9XZt', 'EL0ISFM2yZ', 'hbAI3jZAge'
Source: 0.2.Inquiry No PJO-4010574.exe.d9e0000.10.raw.unpack, zwXcfuHLFGMHIdiBri.cs High entropy of concatenated method names: 'o30XfV0COE', 'UEIXrOrqcg', 'IbLo53tkKU', 'eDootH3wkq', 'CT4opi3wXx', 'Oano1sMVhB', 'QoRoNcb1VF', 'j9roSt2Jlq', 'ECCo38j0Hm', 'p9toGWc8Pf'
Source: 0.2.Inquiry No PJO-4010574.exe.d9e0000.10.raw.unpack, EvAiwfUE1bA66crygk.cs High entropy of concatenated method names: 'fSJDGFi9es', 'o79D70WMhq', 'oi0DUHdh1o', 'aZUDcCqKcU', 'ImnDna5CB6', 'Mu7D5jqmvg', 'NRXDtOq0nf', 'w5uDphxegF', 'mqnD1jpePZ', 'y4rDN3ZKfr'
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: Inquiry No PJO-4010574.exe PID: 6792, type: MEMORYSTR
Switches to a custom stack to bypass stack traces
Source: C:\Windows\SysWOW64\w32tm.exe API/Special instruction interceptor: Address: 7FFE2220D324
Source: C:\Windows\SysWOW64\w32tm.exe API/Special instruction interceptor: Address: 7FFE2220D7E4
Source: C:\Windows\SysWOW64\w32tm.exe API/Special instruction interceptor: Address: 7FFE2220D944
Source: C:\Windows\SysWOW64\w32tm.exe API/Special instruction interceptor: Address: 7FFE2220D504
Source: C:\Windows\SysWOW64\w32tm.exe API/Special instruction interceptor: Address: 7FFE2220D544
Source: C:\Windows\SysWOW64\w32tm.exe API/Special instruction interceptor: Address: 7FFE2220D1E4
Source: C:\Windows\SysWOW64\w32tm.exe API/Special instruction interceptor: Address: 7FFE22210154
Source: C:\Windows\SysWOW64\w32tm.exe API/Special instruction interceptor: Address: 7FFE2220DA44
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Memory allocated: 2E20000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Memory allocated: 3100000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Memory allocated: 2E20000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Memory allocated: 81D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Memory allocated: 91D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Memory allocated: 9390000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Memory allocated: A390000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Memory allocated: A700000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Memory allocated: B700000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Memory allocated: C700000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Memory allocated: DA70000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Memory allocated: EA70000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Memory allocated: FA70000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Memory allocated: 10140000 memory reserve | memory write watch Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0163096E rdtsc 2_2_0163096E
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Window / User API: threadDelayed 577 Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Window / User API: threadDelayed 417 Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe Window / User API: threadDelayed 473 Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe Window / User API: threadDelayed 9499 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe API coverage: 0.7 %
Source: C:\Windows\SysWOW64\w32tm.exe API coverage: 2.6 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe TID: 1892 Thread sleep time: -3689348814741908s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe TID: 3060 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe TID: 7608 Thread sleep count: 473 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe TID: 7608 Thread sleep time: -946000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe TID: 7608 Thread sleep count: 9499 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe TID: 7608 Thread sleep time: -18998000s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe TID: 7632 Thread sleep time: -50000s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe TID: 7632 Thread sleep time: -40500s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe TID: 7632 Thread sleep count: 33 > 30 Jump to behavior
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe TID: 7632 Thread sleep time: -33000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\SysWOW64\w32tm.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\w32tm.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\w32tm.exe Code function: 7_2_02C6BCA0 FindFirstFileW,FindNextFileW,FindClose, 7_2_02C6BCA0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: w32tm.exe, 00000007.00000002.4105919654.0000000002D24000.00000004.00000020.00020000.00000000.sdmp, HeKTvWjrtOUnkuZfNlEvF.exe, 00000008.00000002.4106566980.0000000001320000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000009.00000002.2281286248.000001EE5749C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0163096E rdtsc 2_2_0163096E
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_004175C3 LdrLoadDll, 2_2_004175C3
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015EC156 mov eax, dword ptr fs:[00000030h] 2_2_015EC156
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F6154 mov eax, dword ptr fs:[00000030h] 2_2_015F6154
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F6154 mov eax, dword ptr fs:[00000030h] 2_2_015F6154
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01684144 mov eax, dword ptr fs:[00000030h] 2_2_01684144
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01684144 mov eax, dword ptr fs:[00000030h] 2_2_01684144
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01684144 mov ecx, dword ptr fs:[00000030h] 2_2_01684144
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01684144 mov eax, dword ptr fs:[00000030h] 2_2_01684144
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01684144 mov eax, dword ptr fs:[00000030h] 2_2_01684144
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01688158 mov eax, dword ptr fs:[00000030h] 2_2_01688158
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01620124 mov eax, dword ptr fs:[00000030h] 2_2_01620124
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0169E10E mov eax, dword ptr fs:[00000030h] 2_2_0169E10E
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0169E10E mov ecx, dword ptr fs:[00000030h] 2_2_0169E10E
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0169E10E mov eax, dword ptr fs:[00000030h] 2_2_0169E10E
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0169E10E mov eax, dword ptr fs:[00000030h] 2_2_0169E10E
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0169E10E mov ecx, dword ptr fs:[00000030h] 2_2_0169E10E
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0169E10E mov eax, dword ptr fs:[00000030h] 2_2_0169E10E
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0169E10E mov eax, dword ptr fs:[00000030h] 2_2_0169E10E
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0169E10E mov ecx, dword ptr fs:[00000030h] 2_2_0169E10E
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0169E10E mov eax, dword ptr fs:[00000030h] 2_2_0169E10E
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0169E10E mov ecx, dword ptr fs:[00000030h] 2_2_0169E10E
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0169A118 mov ecx, dword ptr fs:[00000030h] 2_2_0169A118
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0169A118 mov eax, dword ptr fs:[00000030h] 2_2_0169A118
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0169A118 mov eax, dword ptr fs:[00000030h] 2_2_0169A118
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0169A118 mov eax, dword ptr fs:[00000030h] 2_2_0169A118
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016B0115 mov eax, dword ptr fs:[00000030h] 2_2_016B0115
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016C61E5 mov eax, dword ptr fs:[00000030h] 2_2_016C61E5
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016201F8 mov eax, dword ptr fs:[00000030h] 2_2_016201F8
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016B61C3 mov eax, dword ptr fs:[00000030h] 2_2_016B61C3
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016B61C3 mov eax, dword ptr fs:[00000030h] 2_2_016B61C3
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0166E1D0 mov eax, dword ptr fs:[00000030h] 2_2_0166E1D0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0166E1D0 mov eax, dword ptr fs:[00000030h] 2_2_0166E1D0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0166E1D0 mov ecx, dword ptr fs:[00000030h] 2_2_0166E1D0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0166E1D0 mov eax, dword ptr fs:[00000030h] 2_2_0166E1D0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0166E1D0 mov eax, dword ptr fs:[00000030h] 2_2_0166E1D0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015EA197 mov eax, dword ptr fs:[00000030h] 2_2_015EA197
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015EA197 mov eax, dword ptr fs:[00000030h] 2_2_015EA197
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015EA197 mov eax, dword ptr fs:[00000030h] 2_2_015EA197
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016AC188 mov eax, dword ptr fs:[00000030h] 2_2_016AC188
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016AC188 mov eax, dword ptr fs:[00000030h] 2_2_016AC188
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01630185 mov eax, dword ptr fs:[00000030h] 2_2_01630185
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01694180 mov eax, dword ptr fs:[00000030h] 2_2_01694180
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01694180 mov eax, dword ptr fs:[00000030h] 2_2_01694180
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0167019F mov eax, dword ptr fs:[00000030h] 2_2_0167019F
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0167019F mov eax, dword ptr fs:[00000030h] 2_2_0167019F
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0167019F mov eax, dword ptr fs:[00000030h] 2_2_0167019F
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0167019F mov eax, dword ptr fs:[00000030h] 2_2_0167019F
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F2050 mov eax, dword ptr fs:[00000030h] 2_2_015F2050
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0161C073 mov eax, dword ptr fs:[00000030h] 2_2_0161C073
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01676050 mov eax, dword ptr fs:[00000030h] 2_2_01676050
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01686030 mov eax, dword ptr fs:[00000030h] 2_2_01686030
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01674000 mov ecx, dword ptr fs:[00000030h] 2_2_01674000
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01692000 mov eax, dword ptr fs:[00000030h] 2_2_01692000
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01692000 mov eax, dword ptr fs:[00000030h] 2_2_01692000
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01692000 mov eax, dword ptr fs:[00000030h] 2_2_01692000
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01692000 mov eax, dword ptr fs:[00000030h] 2_2_01692000
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01692000 mov eax, dword ptr fs:[00000030h] 2_2_01692000
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01692000 mov eax, dword ptr fs:[00000030h] 2_2_01692000
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01692000 mov eax, dword ptr fs:[00000030h] 2_2_01692000
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01692000 mov eax, dword ptr fs:[00000030h] 2_2_01692000
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0160E016 mov eax, dword ptr fs:[00000030h] 2_2_0160E016
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0160E016 mov eax, dword ptr fs:[00000030h] 2_2_0160E016
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0160E016 mov eax, dword ptr fs:[00000030h] 2_2_0160E016
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0160E016 mov eax, dword ptr fs:[00000030h] 2_2_0160E016
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015EA020 mov eax, dword ptr fs:[00000030h] 2_2_015EA020
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015EC020 mov eax, dword ptr fs:[00000030h] 2_2_015EC020
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016760E0 mov eax, dword ptr fs:[00000030h] 2_2_016760E0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016320F0 mov ecx, dword ptr fs:[00000030h] 2_2_016320F0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015EC0F0 mov eax, dword ptr fs:[00000030h] 2_2_015EC0F0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F80E9 mov eax, dword ptr fs:[00000030h] 2_2_015F80E9
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016720DE mov eax, dword ptr fs:[00000030h] 2_2_016720DE
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015EA0E3 mov ecx, dword ptr fs:[00000030h] 2_2_015EA0E3
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016880A8 mov eax, dword ptr fs:[00000030h] 2_2_016880A8
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016B60B8 mov eax, dword ptr fs:[00000030h] 2_2_016B60B8
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016B60B8 mov ecx, dword ptr fs:[00000030h] 2_2_016B60B8
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F208A mov eax, dword ptr fs:[00000030h] 2_2_015F208A
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0169437C mov eax, dword ptr fs:[00000030h] 2_2_0169437C
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01672349 mov eax, dword ptr fs:[00000030h] 2_2_01672349
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01672349 mov eax, dword ptr fs:[00000030h] 2_2_01672349
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01672349 mov eax, dword ptr fs:[00000030h] 2_2_01672349
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01672349 mov eax, dword ptr fs:[00000030h] 2_2_01672349
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01672349 mov eax, dword ptr fs:[00000030h] 2_2_01672349
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01672349 mov eax, dword ptr fs:[00000030h] 2_2_01672349
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01672349 mov eax, dword ptr fs:[00000030h] 2_2_01672349
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01672349 mov eax, dword ptr fs:[00000030h] 2_2_01672349
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01672349 mov eax, dword ptr fs:[00000030h] 2_2_01672349
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01672349 mov eax, dword ptr fs:[00000030h] 2_2_01672349
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01672349 mov eax, dword ptr fs:[00000030h] 2_2_01672349
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01672349 mov eax, dword ptr fs:[00000030h] 2_2_01672349
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01672349 mov eax, dword ptr fs:[00000030h] 2_2_01672349
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01672349 mov eax, dword ptr fs:[00000030h] 2_2_01672349
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01672349 mov eax, dword ptr fs:[00000030h] 2_2_01672349
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016BA352 mov eax, dword ptr fs:[00000030h] 2_2_016BA352
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01698350 mov ecx, dword ptr fs:[00000030h] 2_2_01698350
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0167035C mov eax, dword ptr fs:[00000030h] 2_2_0167035C
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0167035C mov eax, dword ptr fs:[00000030h] 2_2_0167035C
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0167035C mov eax, dword ptr fs:[00000030h] 2_2_0167035C
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0167035C mov ecx, dword ptr fs:[00000030h] 2_2_0167035C
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0167035C mov eax, dword ptr fs:[00000030h] 2_2_0167035C
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0167035C mov eax, dword ptr fs:[00000030h] 2_2_0167035C
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015EC310 mov ecx, dword ptr fs:[00000030h] 2_2_015EC310
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0162A30B mov eax, dword ptr fs:[00000030h] 2_2_0162A30B
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0162A30B mov eax, dword ptr fs:[00000030h] 2_2_0162A30B
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0162A30B mov eax, dword ptr fs:[00000030h] 2_2_0162A30B
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01610310 mov ecx, dword ptr fs:[00000030h] 2_2_01610310
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016003E9 mov eax, dword ptr fs:[00000030h] 2_2_016003E9
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016003E9 mov eax, dword ptr fs:[00000030h] 2_2_016003E9
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016003E9 mov eax, dword ptr fs:[00000030h] 2_2_016003E9
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016003E9 mov eax, dword ptr fs:[00000030h] 2_2_016003E9
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016003E9 mov eax, dword ptr fs:[00000030h] 2_2_016003E9
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016003E9 mov eax, dword ptr fs:[00000030h] 2_2_016003E9
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016003E9 mov eax, dword ptr fs:[00000030h] 2_2_016003E9
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016003E9 mov eax, dword ptr fs:[00000030h] 2_2_016003E9
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0160E3F0 mov eax, dword ptr fs:[00000030h] 2_2_0160E3F0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0160E3F0 mov eax, dword ptr fs:[00000030h] 2_2_0160E3F0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0160E3F0 mov eax, dword ptr fs:[00000030h] 2_2_0160E3F0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016263FF mov eax, dword ptr fs:[00000030h] 2_2_016263FF
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F83C0 mov eax, dword ptr fs:[00000030h] 2_2_015F83C0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F83C0 mov eax, dword ptr fs:[00000030h] 2_2_015F83C0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F83C0 mov eax, dword ptr fs:[00000030h] 2_2_015F83C0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F83C0 mov eax, dword ptr fs:[00000030h] 2_2_015F83C0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015FA3C0 mov eax, dword ptr fs:[00000030h] 2_2_015FA3C0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015FA3C0 mov eax, dword ptr fs:[00000030h] 2_2_015FA3C0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015FA3C0 mov eax, dword ptr fs:[00000030h] 2_2_015FA3C0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015FA3C0 mov eax, dword ptr fs:[00000030h] 2_2_015FA3C0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015FA3C0 mov eax, dword ptr fs:[00000030h] 2_2_015FA3C0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015FA3C0 mov eax, dword ptr fs:[00000030h] 2_2_015FA3C0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016AC3CD mov eax, dword ptr fs:[00000030h] 2_2_016AC3CD
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016763C0 mov eax, dword ptr fs:[00000030h] 2_2_016763C0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0169E3DB mov eax, dword ptr fs:[00000030h] 2_2_0169E3DB
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0169E3DB mov eax, dword ptr fs:[00000030h] 2_2_0169E3DB
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0169E3DB mov ecx, dword ptr fs:[00000030h] 2_2_0169E3DB
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0169E3DB mov eax, dword ptr fs:[00000030h] 2_2_0169E3DB
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016943D4 mov eax, dword ptr fs:[00000030h] 2_2_016943D4
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016943D4 mov eax, dword ptr fs:[00000030h] 2_2_016943D4
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015E8397 mov eax, dword ptr fs:[00000030h] 2_2_015E8397
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015E8397 mov eax, dword ptr fs:[00000030h] 2_2_015E8397
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015E8397 mov eax, dword ptr fs:[00000030h] 2_2_015E8397
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015EE388 mov eax, dword ptr fs:[00000030h] 2_2_015EE388
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015EE388 mov eax, dword ptr fs:[00000030h] 2_2_015EE388
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015EE388 mov eax, dword ptr fs:[00000030h] 2_2_015EE388
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0161438F mov eax, dword ptr fs:[00000030h] 2_2_0161438F
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0161438F mov eax, dword ptr fs:[00000030h] 2_2_0161438F
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F6259 mov eax, dword ptr fs:[00000030h] 2_2_015F6259
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015EA250 mov eax, dword ptr fs:[00000030h] 2_2_015EA250
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016A0274 mov eax, dword ptr fs:[00000030h] 2_2_016A0274
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016A0274 mov eax, dword ptr fs:[00000030h] 2_2_016A0274
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016A0274 mov eax, dword ptr fs:[00000030h] 2_2_016A0274
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016A0274 mov eax, dword ptr fs:[00000030h] 2_2_016A0274
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016A0274 mov eax, dword ptr fs:[00000030h] 2_2_016A0274
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016A0274 mov eax, dword ptr fs:[00000030h] 2_2_016A0274
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016A0274 mov eax, dword ptr fs:[00000030h] 2_2_016A0274
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016A0274 mov eax, dword ptr fs:[00000030h] 2_2_016A0274
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016A0274 mov eax, dword ptr fs:[00000030h] 2_2_016A0274
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016A0274 mov eax, dword ptr fs:[00000030h] 2_2_016A0274
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016A0274 mov eax, dword ptr fs:[00000030h] 2_2_016A0274
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016A0274 mov eax, dword ptr fs:[00000030h] 2_2_016A0274
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01678243 mov eax, dword ptr fs:[00000030h] 2_2_01678243
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01678243 mov ecx, dword ptr fs:[00000030h] 2_2_01678243
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015E826B mov eax, dword ptr fs:[00000030h] 2_2_015E826B
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016AA250 mov eax, dword ptr fs:[00000030h] 2_2_016AA250
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016AA250 mov eax, dword ptr fs:[00000030h] 2_2_016AA250
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F4260 mov eax, dword ptr fs:[00000030h] 2_2_015F4260
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F4260 mov eax, dword ptr fs:[00000030h] 2_2_015F4260
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F4260 mov eax, dword ptr fs:[00000030h] 2_2_015F4260
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015E823B mov eax, dword ptr fs:[00000030h] 2_2_015E823B
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016002E1 mov eax, dword ptr fs:[00000030h] 2_2_016002E1
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016002E1 mov eax, dword ptr fs:[00000030h] 2_2_016002E1
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016002E1 mov eax, dword ptr fs:[00000030h] 2_2_016002E1
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015FA2C3 mov eax, dword ptr fs:[00000030h] 2_2_015FA2C3
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015FA2C3 mov eax, dword ptr fs:[00000030h] 2_2_015FA2C3
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015FA2C3 mov eax, dword ptr fs:[00000030h] 2_2_015FA2C3
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015FA2C3 mov eax, dword ptr fs:[00000030h] 2_2_015FA2C3
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015FA2C3 mov eax, dword ptr fs:[00000030h] 2_2_015FA2C3
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016002A0 mov eax, dword ptr fs:[00000030h] 2_2_016002A0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016002A0 mov eax, dword ptr fs:[00000030h] 2_2_016002A0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016862A0 mov eax, dword ptr fs:[00000030h] 2_2_016862A0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016862A0 mov ecx, dword ptr fs:[00000030h] 2_2_016862A0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016862A0 mov eax, dword ptr fs:[00000030h] 2_2_016862A0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016862A0 mov eax, dword ptr fs:[00000030h] 2_2_016862A0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016862A0 mov eax, dword ptr fs:[00000030h] 2_2_016862A0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016862A0 mov eax, dword ptr fs:[00000030h] 2_2_016862A0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01670283 mov eax, dword ptr fs:[00000030h] 2_2_01670283
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01670283 mov eax, dword ptr fs:[00000030h] 2_2_01670283
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01670283 mov eax, dword ptr fs:[00000030h] 2_2_01670283
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0162E284 mov eax, dword ptr fs:[00000030h] 2_2_0162E284
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0162E284 mov eax, dword ptr fs:[00000030h] 2_2_0162E284
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0162656A mov eax, dword ptr fs:[00000030h] 2_2_0162656A
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0162656A mov eax, dword ptr fs:[00000030h] 2_2_0162656A
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0162656A mov eax, dword ptr fs:[00000030h] 2_2_0162656A
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F8550 mov eax, dword ptr fs:[00000030h] 2_2_015F8550
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F8550 mov eax, dword ptr fs:[00000030h] 2_2_015F8550
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01600535 mov eax, dword ptr fs:[00000030h] 2_2_01600535
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01600535 mov eax, dword ptr fs:[00000030h] 2_2_01600535
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01600535 mov eax, dword ptr fs:[00000030h] 2_2_01600535
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01600535 mov eax, dword ptr fs:[00000030h] 2_2_01600535
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01600535 mov eax, dword ptr fs:[00000030h] 2_2_01600535
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01600535 mov eax, dword ptr fs:[00000030h] 2_2_01600535
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0161E53E mov eax, dword ptr fs:[00000030h] 2_2_0161E53E
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0161E53E mov eax, dword ptr fs:[00000030h] 2_2_0161E53E
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0161E53E mov eax, dword ptr fs:[00000030h] 2_2_0161E53E
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0161E53E mov eax, dword ptr fs:[00000030h] 2_2_0161E53E
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0161E53E mov eax, dword ptr fs:[00000030h] 2_2_0161E53E
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01686500 mov eax, dword ptr fs:[00000030h] 2_2_01686500
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016C4500 mov eax, dword ptr fs:[00000030h] 2_2_016C4500
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016C4500 mov eax, dword ptr fs:[00000030h] 2_2_016C4500
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016C4500 mov eax, dword ptr fs:[00000030h] 2_2_016C4500
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016C4500 mov eax, dword ptr fs:[00000030h] 2_2_016C4500
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016C4500 mov eax, dword ptr fs:[00000030h] 2_2_016C4500
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016C4500 mov eax, dword ptr fs:[00000030h] 2_2_016C4500
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016C4500 mov eax, dword ptr fs:[00000030h] 2_2_016C4500
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0161E5E7 mov eax, dword ptr fs:[00000030h] 2_2_0161E5E7
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0161E5E7 mov eax, dword ptr fs:[00000030h] 2_2_0161E5E7
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0161E5E7 mov eax, dword ptr fs:[00000030h] 2_2_0161E5E7
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0161E5E7 mov eax, dword ptr fs:[00000030h] 2_2_0161E5E7
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0161E5E7 mov eax, dword ptr fs:[00000030h] 2_2_0161E5E7
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0161E5E7 mov eax, dword ptr fs:[00000030h] 2_2_0161E5E7
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0161E5E7 mov eax, dword ptr fs:[00000030h] 2_2_0161E5E7
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0161E5E7 mov eax, dword ptr fs:[00000030h] 2_2_0161E5E7
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F65D0 mov eax, dword ptr fs:[00000030h] 2_2_015F65D0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0162C5ED mov eax, dword ptr fs:[00000030h] 2_2_0162C5ED
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0162C5ED mov eax, dword ptr fs:[00000030h] 2_2_0162C5ED
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0162E5CF mov eax, dword ptr fs:[00000030h] 2_2_0162E5CF
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0162E5CF mov eax, dword ptr fs:[00000030h] 2_2_0162E5CF
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0162A5D0 mov eax, dword ptr fs:[00000030h] 2_2_0162A5D0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0162A5D0 mov eax, dword ptr fs:[00000030h] 2_2_0162A5D0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F25E0 mov eax, dword ptr fs:[00000030h] 2_2_015F25E0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016705A7 mov eax, dword ptr fs:[00000030h] 2_2_016705A7
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016705A7 mov eax, dword ptr fs:[00000030h] 2_2_016705A7
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016705A7 mov eax, dword ptr fs:[00000030h] 2_2_016705A7
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016145B1 mov eax, dword ptr fs:[00000030h] 2_2_016145B1
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016145B1 mov eax, dword ptr fs:[00000030h] 2_2_016145B1
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F2582 mov eax, dword ptr fs:[00000030h] 2_2_015F2582
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F2582 mov ecx, dword ptr fs:[00000030h] 2_2_015F2582
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01624588 mov eax, dword ptr fs:[00000030h] 2_2_01624588
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0162E59C mov eax, dword ptr fs:[00000030h] 2_2_0162E59C
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015E645D mov eax, dword ptr fs:[00000030h] 2_2_015E645D
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0167C460 mov ecx, dword ptr fs:[00000030h] 2_2_0167C460
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0161A470 mov eax, dword ptr fs:[00000030h] 2_2_0161A470
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0161A470 mov eax, dword ptr fs:[00000030h] 2_2_0161A470
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0161A470 mov eax, dword ptr fs:[00000030h] 2_2_0161A470
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0162E443 mov eax, dword ptr fs:[00000030h] 2_2_0162E443
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0162E443 mov eax, dword ptr fs:[00000030h] 2_2_0162E443
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0162E443 mov eax, dword ptr fs:[00000030h] 2_2_0162E443
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0162E443 mov eax, dword ptr fs:[00000030h] 2_2_0162E443
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0162E443 mov eax, dword ptr fs:[00000030h] 2_2_0162E443
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0162E443 mov eax, dword ptr fs:[00000030h] 2_2_0162E443
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0162E443 mov eax, dword ptr fs:[00000030h] 2_2_0162E443
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0162E443 mov eax, dword ptr fs:[00000030h] 2_2_0162E443
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0161245A mov eax, dword ptr fs:[00000030h] 2_2_0161245A
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016AA456 mov eax, dword ptr fs:[00000030h] 2_2_016AA456
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01676420 mov eax, dword ptr fs:[00000030h] 2_2_01676420
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01676420 mov eax, dword ptr fs:[00000030h] 2_2_01676420
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01676420 mov eax, dword ptr fs:[00000030h] 2_2_01676420
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01676420 mov eax, dword ptr fs:[00000030h] 2_2_01676420
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01676420 mov eax, dword ptr fs:[00000030h] 2_2_01676420
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01676420 mov eax, dword ptr fs:[00000030h] 2_2_01676420
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01676420 mov eax, dword ptr fs:[00000030h] 2_2_01676420
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01628402 mov eax, dword ptr fs:[00000030h] 2_2_01628402
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01628402 mov eax, dword ptr fs:[00000030h] 2_2_01628402
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01628402 mov eax, dword ptr fs:[00000030h] 2_2_01628402
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015EC427 mov eax, dword ptr fs:[00000030h] 2_2_015EC427
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015EE420 mov eax, dword ptr fs:[00000030h] 2_2_015EE420
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015EE420 mov eax, dword ptr fs:[00000030h] 2_2_015EE420
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015EE420 mov eax, dword ptr fs:[00000030h] 2_2_015EE420
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F04E5 mov ecx, dword ptr fs:[00000030h] 2_2_015F04E5
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016244B0 mov ecx, dword ptr fs:[00000030h] 2_2_016244B0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0167A4B0 mov eax, dword ptr fs:[00000030h] 2_2_0167A4B0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016AA49A mov eax, dword ptr fs:[00000030h] 2_2_016AA49A
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F64AB mov eax, dword ptr fs:[00000030h] 2_2_015F64AB
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F0750 mov eax, dword ptr fs:[00000030h] 2_2_015F0750
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01600770 mov eax, dword ptr fs:[00000030h] 2_2_01600770
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01600770 mov eax, dword ptr fs:[00000030h] 2_2_01600770
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01600770 mov eax, dword ptr fs:[00000030h] 2_2_01600770
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01600770 mov eax, dword ptr fs:[00000030h] 2_2_01600770
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01600770 mov eax, dword ptr fs:[00000030h] 2_2_01600770
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01600770 mov eax, dword ptr fs:[00000030h] 2_2_01600770
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01600770 mov eax, dword ptr fs:[00000030h] 2_2_01600770
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01600770 mov eax, dword ptr fs:[00000030h] 2_2_01600770
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01600770 mov eax, dword ptr fs:[00000030h] 2_2_01600770
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01600770 mov eax, dword ptr fs:[00000030h] 2_2_01600770
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01600770 mov eax, dword ptr fs:[00000030h] 2_2_01600770
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01600770 mov eax, dword ptr fs:[00000030h] 2_2_01600770
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F8770 mov eax, dword ptr fs:[00000030h] 2_2_015F8770
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0162674D mov esi, dword ptr fs:[00000030h] 2_2_0162674D
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0162674D mov eax, dword ptr fs:[00000030h] 2_2_0162674D
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0162674D mov eax, dword ptr fs:[00000030h] 2_2_0162674D
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01674755 mov eax, dword ptr fs:[00000030h] 2_2_01674755
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01632750 mov eax, dword ptr fs:[00000030h] 2_2_01632750
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01632750 mov eax, dword ptr fs:[00000030h] 2_2_01632750
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0167E75D mov eax, dword ptr fs:[00000030h] 2_2_0167E75D
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0162C720 mov eax, dword ptr fs:[00000030h] 2_2_0162C720
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0162C720 mov eax, dword ptr fs:[00000030h] 2_2_0162C720
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F0710 mov eax, dword ptr fs:[00000030h] 2_2_015F0710
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0166C730 mov eax, dword ptr fs:[00000030h] 2_2_0166C730
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0162273C mov eax, dword ptr fs:[00000030h] 2_2_0162273C
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0162273C mov ecx, dword ptr fs:[00000030h] 2_2_0162273C
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0162273C mov eax, dword ptr fs:[00000030h] 2_2_0162273C
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0162C700 mov eax, dword ptr fs:[00000030h] 2_2_0162C700
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01620710 mov eax, dword ptr fs:[00000030h] 2_2_01620710
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0167E7E1 mov eax, dword ptr fs:[00000030h] 2_2_0167E7E1
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016127ED mov eax, dword ptr fs:[00000030h] 2_2_016127ED
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016127ED mov eax, dword ptr fs:[00000030h] 2_2_016127ED
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016127ED mov eax, dword ptr fs:[00000030h] 2_2_016127ED
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015FC7C0 mov eax, dword ptr fs:[00000030h] 2_2_015FC7C0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F47FB mov eax, dword ptr fs:[00000030h] 2_2_015F47FB
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F47FB mov eax, dword ptr fs:[00000030h] 2_2_015F47FB
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016707C3 mov eax, dword ptr fs:[00000030h] 2_2_016707C3
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016A47A0 mov eax, dword ptr fs:[00000030h] 2_2_016A47A0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0169678E mov eax, dword ptr fs:[00000030h] 2_2_0169678E
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F07AF mov eax, dword ptr fs:[00000030h] 2_2_015F07AF
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0162A660 mov eax, dword ptr fs:[00000030h] 2_2_0162A660
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0162A660 mov eax, dword ptr fs:[00000030h] 2_2_0162A660
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016B866E mov eax, dword ptr fs:[00000030h] 2_2_016B866E
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016B866E mov eax, dword ptr fs:[00000030h] 2_2_016B866E
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01622674 mov eax, dword ptr fs:[00000030h] 2_2_01622674
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0160C640 mov eax, dword ptr fs:[00000030h] 2_2_0160C640
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01626620 mov eax, dword ptr fs:[00000030h] 2_2_01626620
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01628620 mov eax, dword ptr fs:[00000030h] 2_2_01628620
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0160E627 mov eax, dword ptr fs:[00000030h] 2_2_0160E627
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0160260B mov eax, dword ptr fs:[00000030h] 2_2_0160260B
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0160260B mov eax, dword ptr fs:[00000030h] 2_2_0160260B
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0160260B mov eax, dword ptr fs:[00000030h] 2_2_0160260B
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0160260B mov eax, dword ptr fs:[00000030h] 2_2_0160260B
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0160260B mov eax, dword ptr fs:[00000030h] 2_2_0160260B
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0160260B mov eax, dword ptr fs:[00000030h] 2_2_0160260B
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0160260B mov eax, dword ptr fs:[00000030h] 2_2_0160260B
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0166E609 mov eax, dword ptr fs:[00000030h] 2_2_0166E609
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F262C mov eax, dword ptr fs:[00000030h] 2_2_015F262C
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01632619 mov eax, dword ptr fs:[00000030h] 2_2_01632619
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0166E6F2 mov eax, dword ptr fs:[00000030h] 2_2_0166E6F2
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0166E6F2 mov eax, dword ptr fs:[00000030h] 2_2_0166E6F2
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0166E6F2 mov eax, dword ptr fs:[00000030h] 2_2_0166E6F2
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0166E6F2 mov eax, dword ptr fs:[00000030h] 2_2_0166E6F2
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016706F1 mov eax, dword ptr fs:[00000030h] 2_2_016706F1
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016706F1 mov eax, dword ptr fs:[00000030h] 2_2_016706F1
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0162A6C7 mov ebx, dword ptr fs:[00000030h] 2_2_0162A6C7
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0162A6C7 mov eax, dword ptr fs:[00000030h] 2_2_0162A6C7
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0162C6A6 mov eax, dword ptr fs:[00000030h] 2_2_0162C6A6
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F4690 mov eax, dword ptr fs:[00000030h] 2_2_015F4690
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F4690 mov eax, dword ptr fs:[00000030h] 2_2_015F4690
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016266B0 mov eax, dword ptr fs:[00000030h] 2_2_016266B0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01616962 mov eax, dword ptr fs:[00000030h] 2_2_01616962
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01616962 mov eax, dword ptr fs:[00000030h] 2_2_01616962
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01616962 mov eax, dword ptr fs:[00000030h] 2_2_01616962
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0163096E mov eax, dword ptr fs:[00000030h] 2_2_0163096E
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0163096E mov edx, dword ptr fs:[00000030h] 2_2_0163096E
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0163096E mov eax, dword ptr fs:[00000030h] 2_2_0163096E
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01694978 mov eax, dword ptr fs:[00000030h] 2_2_01694978
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01694978 mov eax, dword ptr fs:[00000030h] 2_2_01694978
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0167C97C mov eax, dword ptr fs:[00000030h] 2_2_0167C97C
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01670946 mov eax, dword ptr fs:[00000030h] 2_2_01670946
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0168892B mov eax, dword ptr fs:[00000030h] 2_2_0168892B
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015E8918 mov eax, dword ptr fs:[00000030h] 2_2_015E8918
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015E8918 mov eax, dword ptr fs:[00000030h] 2_2_015E8918
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0167892A mov eax, dword ptr fs:[00000030h] 2_2_0167892A
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0166E908 mov eax, dword ptr fs:[00000030h] 2_2_0166E908
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0166E908 mov eax, dword ptr fs:[00000030h] 2_2_0166E908
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0167C912 mov eax, dword ptr fs:[00000030h] 2_2_0167C912
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0167E9E0 mov eax, dword ptr fs:[00000030h] 2_2_0167E9E0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015FA9D0 mov eax, dword ptr fs:[00000030h] 2_2_015FA9D0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015FA9D0 mov eax, dword ptr fs:[00000030h] 2_2_015FA9D0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015FA9D0 mov eax, dword ptr fs:[00000030h] 2_2_015FA9D0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015FA9D0 mov eax, dword ptr fs:[00000030h] 2_2_015FA9D0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015FA9D0 mov eax, dword ptr fs:[00000030h] 2_2_015FA9D0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015FA9D0 mov eax, dword ptr fs:[00000030h] 2_2_015FA9D0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016229F9 mov eax, dword ptr fs:[00000030h] 2_2_016229F9
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016229F9 mov eax, dword ptr fs:[00000030h] 2_2_016229F9
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016869C0 mov eax, dword ptr fs:[00000030h] 2_2_016869C0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016249D0 mov eax, dword ptr fs:[00000030h] 2_2_016249D0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016BA9D3 mov eax, dword ptr fs:[00000030h] 2_2_016BA9D3
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016029A0 mov eax, dword ptr fs:[00000030h] 2_2_016029A0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016029A0 mov eax, dword ptr fs:[00000030h] 2_2_016029A0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016029A0 mov eax, dword ptr fs:[00000030h] 2_2_016029A0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016029A0 mov eax, dword ptr fs:[00000030h] 2_2_016029A0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016029A0 mov eax, dword ptr fs:[00000030h] 2_2_016029A0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016029A0 mov eax, dword ptr fs:[00000030h] 2_2_016029A0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016029A0 mov eax, dword ptr fs:[00000030h] 2_2_016029A0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016029A0 mov eax, dword ptr fs:[00000030h] 2_2_016029A0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016029A0 mov eax, dword ptr fs:[00000030h] 2_2_016029A0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016029A0 mov eax, dword ptr fs:[00000030h] 2_2_016029A0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016029A0 mov eax, dword ptr fs:[00000030h] 2_2_016029A0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016029A0 mov eax, dword ptr fs:[00000030h] 2_2_016029A0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016029A0 mov eax, dword ptr fs:[00000030h] 2_2_016029A0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016789B3 mov esi, dword ptr fs:[00000030h] 2_2_016789B3
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016789B3 mov eax, dword ptr fs:[00000030h] 2_2_016789B3
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016789B3 mov eax, dword ptr fs:[00000030h] 2_2_016789B3
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F09AD mov eax, dword ptr fs:[00000030h] 2_2_015F09AD
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F09AD mov eax, dword ptr fs:[00000030h] 2_2_015F09AD
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F4859 mov eax, dword ptr fs:[00000030h] 2_2_015F4859
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F4859 mov eax, dword ptr fs:[00000030h] 2_2_015F4859
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0167E872 mov eax, dword ptr fs:[00000030h] 2_2_0167E872
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0167E872 mov eax, dword ptr fs:[00000030h] 2_2_0167E872
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01686870 mov eax, dword ptr fs:[00000030h] 2_2_01686870
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01686870 mov eax, dword ptr fs:[00000030h] 2_2_01686870
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01602840 mov ecx, dword ptr fs:[00000030h] 2_2_01602840
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01620854 mov eax, dword ptr fs:[00000030h] 2_2_01620854
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0162A830 mov eax, dword ptr fs:[00000030h] 2_2_0162A830
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0169483A mov eax, dword ptr fs:[00000030h] 2_2_0169483A
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0169483A mov eax, dword ptr fs:[00000030h] 2_2_0169483A
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01612835 mov eax, dword ptr fs:[00000030h] 2_2_01612835
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01612835 mov eax, dword ptr fs:[00000030h] 2_2_01612835
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01612835 mov eax, dword ptr fs:[00000030h] 2_2_01612835
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01612835 mov ecx, dword ptr fs:[00000030h] 2_2_01612835
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01612835 mov eax, dword ptr fs:[00000030h] 2_2_01612835
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01612835 mov eax, dword ptr fs:[00000030h] 2_2_01612835
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0167C810 mov eax, dword ptr fs:[00000030h] 2_2_0167C810
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016BA8E4 mov eax, dword ptr fs:[00000030h] 2_2_016BA8E4
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0162C8F9 mov eax, dword ptr fs:[00000030h] 2_2_0162C8F9
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0162C8F9 mov eax, dword ptr fs:[00000030h] 2_2_0162C8F9
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0161E8C0 mov eax, dword ptr fs:[00000030h] 2_2_0161E8C0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016C08C0 mov eax, dword ptr fs:[00000030h] 2_2_016C08C0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F0887 mov eax, dword ptr fs:[00000030h] 2_2_015F0887
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0167C89D mov eax, dword ptr fs:[00000030h] 2_2_0167C89D
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015ECB7E mov eax, dword ptr fs:[00000030h] 2_2_015ECB7E
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016A4B4B mov eax, dword ptr fs:[00000030h] 2_2_016A4B4B
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016A4B4B mov eax, dword ptr fs:[00000030h] 2_2_016A4B4B
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01686B40 mov eax, dword ptr fs:[00000030h] 2_2_01686B40
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01686B40 mov eax, dword ptr fs:[00000030h] 2_2_01686B40
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016BAB40 mov eax, dword ptr fs:[00000030h] 2_2_016BAB40
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01698B42 mov eax, dword ptr fs:[00000030h] 2_2_01698B42
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0169EB50 mov eax, dword ptr fs:[00000030h] 2_2_0169EB50
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016C2B57 mov eax, dword ptr fs:[00000030h] 2_2_016C2B57
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016C2B57 mov eax, dword ptr fs:[00000030h] 2_2_016C2B57
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016C2B57 mov eax, dword ptr fs:[00000030h] 2_2_016C2B57
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016C2B57 mov eax, dword ptr fs:[00000030h] 2_2_016C2B57
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0161EB20 mov eax, dword ptr fs:[00000030h] 2_2_0161EB20
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0161EB20 mov eax, dword ptr fs:[00000030h] 2_2_0161EB20
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016B8B28 mov eax, dword ptr fs:[00000030h] 2_2_016B8B28
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016B8B28 mov eax, dword ptr fs:[00000030h] 2_2_016B8B28
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0166EB1D mov eax, dword ptr fs:[00000030h] 2_2_0166EB1D
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0166EB1D mov eax, dword ptr fs:[00000030h] 2_2_0166EB1D
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0166EB1D mov eax, dword ptr fs:[00000030h] 2_2_0166EB1D
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0166EB1D mov eax, dword ptr fs:[00000030h] 2_2_0166EB1D
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0166EB1D mov eax, dword ptr fs:[00000030h] 2_2_0166EB1D
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0166EB1D mov eax, dword ptr fs:[00000030h] 2_2_0166EB1D
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0166EB1D mov eax, dword ptr fs:[00000030h] 2_2_0166EB1D
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0166EB1D mov eax, dword ptr fs:[00000030h] 2_2_0166EB1D
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0166EB1D mov eax, dword ptr fs:[00000030h] 2_2_0166EB1D
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F0BCD mov eax, dword ptr fs:[00000030h] 2_2_015F0BCD
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F0BCD mov eax, dword ptr fs:[00000030h] 2_2_015F0BCD
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F0BCD mov eax, dword ptr fs:[00000030h] 2_2_015F0BCD
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0167CBF0 mov eax, dword ptr fs:[00000030h] 2_2_0167CBF0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0161EBFC mov eax, dword ptr fs:[00000030h] 2_2_0161EBFC
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01610BCB mov eax, dword ptr fs:[00000030h] 2_2_01610BCB
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01610BCB mov eax, dword ptr fs:[00000030h] 2_2_01610BCB
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01610BCB mov eax, dword ptr fs:[00000030h] 2_2_01610BCB
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F8BF0 mov eax, dword ptr fs:[00000030h] 2_2_015F8BF0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F8BF0 mov eax, dword ptr fs:[00000030h] 2_2_015F8BF0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F8BF0 mov eax, dword ptr fs:[00000030h] 2_2_015F8BF0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0169EBD0 mov eax, dword ptr fs:[00000030h] 2_2_0169EBD0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016A4BB0 mov eax, dword ptr fs:[00000030h] 2_2_016A4BB0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016A4BB0 mov eax, dword ptr fs:[00000030h] 2_2_016A4BB0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01600BBE mov eax, dword ptr fs:[00000030h] 2_2_01600BBE
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01600BBE mov eax, dword ptr fs:[00000030h] 2_2_01600BBE
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0169EA60 mov eax, dword ptr fs:[00000030h] 2_2_0169EA60
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0162CA6F mov eax, dword ptr fs:[00000030h] 2_2_0162CA6F
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0162CA6F mov eax, dword ptr fs:[00000030h] 2_2_0162CA6F
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0162CA6F mov eax, dword ptr fs:[00000030h] 2_2_0162CA6F
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F6A50 mov eax, dword ptr fs:[00000030h] 2_2_015F6A50
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F6A50 mov eax, dword ptr fs:[00000030h] 2_2_015F6A50
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F6A50 mov eax, dword ptr fs:[00000030h] 2_2_015F6A50
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F6A50 mov eax, dword ptr fs:[00000030h] 2_2_015F6A50
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F6A50 mov eax, dword ptr fs:[00000030h] 2_2_015F6A50
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F6A50 mov eax, dword ptr fs:[00000030h] 2_2_015F6A50
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F6A50 mov eax, dword ptr fs:[00000030h] 2_2_015F6A50
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0166CA72 mov eax, dword ptr fs:[00000030h] 2_2_0166CA72
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0166CA72 mov eax, dword ptr fs:[00000030h] 2_2_0166CA72
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01600A5B mov eax, dword ptr fs:[00000030h] 2_2_01600A5B
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01600A5B mov eax, dword ptr fs:[00000030h] 2_2_01600A5B
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0162CA24 mov eax, dword ptr fs:[00000030h] 2_2_0162CA24
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0161EA2E mov eax, dword ptr fs:[00000030h] 2_2_0161EA2E
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01614A35 mov eax, dword ptr fs:[00000030h] 2_2_01614A35
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01614A35 mov eax, dword ptr fs:[00000030h] 2_2_01614A35
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0167CA11 mov eax, dword ptr fs:[00000030h] 2_2_0167CA11
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0162AAEE mov eax, dword ptr fs:[00000030h] 2_2_0162AAEE
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_0162AAEE mov eax, dword ptr fs:[00000030h] 2_2_0162AAEE
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F0AD0 mov eax, dword ptr fs:[00000030h] 2_2_015F0AD0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01646ACC mov eax, dword ptr fs:[00000030h] 2_2_01646ACC
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01646ACC mov eax, dword ptr fs:[00000030h] 2_2_01646ACC
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01646ACC mov eax, dword ptr fs:[00000030h] 2_2_01646ACC
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01624AD0 mov eax, dword ptr fs:[00000030h] 2_2_01624AD0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01624AD0 mov eax, dword ptr fs:[00000030h] 2_2_01624AD0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01646AA4 mov eax, dword ptr fs:[00000030h] 2_2_01646AA4
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015FEA80 mov eax, dword ptr fs:[00000030h] 2_2_015FEA80
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015FEA80 mov eax, dword ptr fs:[00000030h] 2_2_015FEA80
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015FEA80 mov eax, dword ptr fs:[00000030h] 2_2_015FEA80
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015FEA80 mov eax, dword ptr fs:[00000030h] 2_2_015FEA80
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015FEA80 mov eax, dword ptr fs:[00000030h] 2_2_015FEA80
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015FEA80 mov eax, dword ptr fs:[00000030h] 2_2_015FEA80
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015FEA80 mov eax, dword ptr fs:[00000030h] 2_2_015FEA80
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015FEA80 mov eax, dword ptr fs:[00000030h] 2_2_015FEA80
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015FEA80 mov eax, dword ptr fs:[00000030h] 2_2_015FEA80
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_016C4A80 mov eax, dword ptr fs:[00000030h] 2_2_016C4A80
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01628A90 mov edx, dword ptr fs:[00000030h] 2_2_01628A90
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F8AA0 mov eax, dword ptr fs:[00000030h] 2_2_015F8AA0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F8AA0 mov eax, dword ptr fs:[00000030h] 2_2_015F8AA0
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_01688D6B mov eax, dword ptr fs:[00000030h] 2_2_01688D6B
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F0D59 mov eax, dword ptr fs:[00000030h] 2_2_015F0D59
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F0D59 mov eax, dword ptr fs:[00000030h] 2_2_015F0D59
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Code function: 2_2_015F0D59 mov eax, dword ptr fs:[00000030h] 2_2_015F0D59
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe NtWriteVirtualMemory: Direct from: 0x76F0490C Jump to behavior
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe NtOpenKeyEx: Direct from: 0x76F03C9C Jump to behavior
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe NtClose: Direct from: 0x76F02B6C
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe NtReadVirtualMemory: Direct from: 0x76F02E8C Jump to behavior
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe NtCreateKey: Direct from: 0x76F02C6C Jump to behavior
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe NtSetInformationThread: Direct from: 0x76F02B4C Jump to behavior
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe NtQueryAttributesFile: Direct from: 0x76F02E6C Jump to behavior
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe NtAllocateVirtualMemory: Direct from: 0x76F048EC Jump to behavior
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe NtQuerySystemInformation: Direct from: 0x76F048CC Jump to behavior
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe NtQueryVolumeInformationFile: Direct from: 0x76F02F2C Jump to behavior
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe NtOpenSection: Direct from: 0x76F02E0C Jump to behavior
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe NtSetInformationThread: Direct from: 0x76EF63F9 Jump to behavior
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe NtDeviceIoControlFile: Direct from: 0x76F02AEC Jump to behavior
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe NtQueryValueKey: Direct from: 0x76F02BEC Jump to behavior
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe NtCreateFile: Direct from: 0x76F02FEC Jump to behavior
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe NtOpenFile: Direct from: 0x76F02DCC Jump to behavior
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe NtQueryInformationToken: Direct from: 0x76F02CAC Jump to behavior
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe NtProtectVirtualMemory: Direct from: 0x76EF7B2E Jump to behavior
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe NtTerminateThread: Direct from: 0x76F02FCC Jump to behavior
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe NtOpenKeyEx: Direct from: 0x76F02B9C Jump to behavior
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe NtProtectVirtualMemory: Direct from: 0x76F02F9C Jump to behavior
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe NtSetInformationProcess: Direct from: 0x76F02C5C Jump to behavior
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe NtNotifyChangeKey: Direct from: 0x76F03C2C Jump to behavior
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe NtCreateMutant: Direct from: 0x76F035CC Jump to behavior
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe NtWriteVirtualMemory: Direct from: 0x76F02E3C Jump to behavior
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe NtMapViewOfSection: Direct from: 0x76F02D1C Jump to behavior
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe NtResumeThread: Direct from: 0x76F036AC Jump to behavior
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe NtAllocateVirtualMemory: Direct from: 0x76F02BFC Jump to behavior
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe NtReadFile: Direct from: 0x76F02ADC Jump to behavior
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe NtQuerySystemInformation: Direct from: 0x76F02DFC Jump to behavior
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe NtDelayExecution: Direct from: 0x76F02DDC Jump to behavior
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe NtQueryInformationProcess: Direct from: 0x76F02C26 Jump to behavior
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe NtResumeThread: Direct from: 0x76F02FBC Jump to behavior
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe NtCreateUserProcess: Direct from: 0x76F0371C Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Section loaded: NULL target: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Section loaded: NULL target: C:\Windows\SysWOW64\w32tm.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe Section loaded: NULL target: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe Section loaded: NULL target: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Windows\SysWOW64\w32tm.exe Thread register set: target process: 7680 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Windows\SysWOW64\w32tm.exe Thread APC queued: target process: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Process created: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe "C:\Users\user\Desktop\Inquiry No PJO-4010574.exe" Jump to behavior
Source: C:\Program Files (x86)\ZbEssRnWukuPlGPIxkeaXYZdLEtxsVgYCSZqRGJpShjyqOjGkYhKrfFdwRLRojZ\HeKTvWjrtOUnkuZfNlEvF.exe Process created: C:\Windows\SysWOW64\w32tm.exe "C:\Windows\SysWOW64\w32tm.exe" Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe" Jump to behavior
Source: HeKTvWjrtOUnkuZfNlEvF.exe, 00000006.00000002.4106583633.0000000000EE0000.00000002.00000001.00040000.00000000.sdmp, HeKTvWjrtOUnkuZfNlEvF.exe, 00000006.00000000.1907474608.0000000000EE0000.00000002.00000001.00040000.00000000.sdmp, HeKTvWjrtOUnkuZfNlEvF.exe, 00000008.00000000.2060606032.0000000001890000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: HeKTvWjrtOUnkuZfNlEvF.exe, 00000006.00000002.4106583633.0000000000EE0000.00000002.00000001.00040000.00000000.sdmp, HeKTvWjrtOUnkuZfNlEvF.exe, 00000006.00000000.1907474608.0000000000EE0000.00000002.00000001.00040000.00000000.sdmp, HeKTvWjrtOUnkuZfNlEvF.exe, 00000008.00000000.2060606032.0000000001890000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: HeKTvWjrtOUnkuZfNlEvF.exe, 00000006.00000002.4106583633.0000000000EE0000.00000002.00000001.00040000.00000000.sdmp, HeKTvWjrtOUnkuZfNlEvF.exe, 00000006.00000000.1907474608.0000000000EE0000.00000002.00000001.00040000.00000000.sdmp, HeKTvWjrtOUnkuZfNlEvF.exe, 00000008.00000000.2060606032.0000000001890000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Source: HeKTvWjrtOUnkuZfNlEvF.exe, 00000006.00000002.4106583633.0000000000EE0000.00000002.00000001.00040000.00000000.sdmp, HeKTvWjrtOUnkuZfNlEvF.exe, 00000006.00000000.1907474608.0000000000EE0000.00000002.00000001.00040000.00000000.sdmp, HeKTvWjrtOUnkuZfNlEvF.exe, 00000008.00000000.2060606032.0000000001890000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: }Program Manager
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\flat_officeFontsPreview.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\OFFSYM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Inquiry No PJO-4010574.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 2.2.Inquiry No PJO-4010574.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.Inquiry No PJO-4010574.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000007.00000002.4106839112.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.1994362170.0000000001910000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.1992596406.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.4105792819.0000000002C50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.4106877602.0000000003930000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.4109293629.0000000005670000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.1994602722.0000000002E20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.4107064100.0000000003280000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\SysWOW64\w32tm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State Jump to behavior
Source: C:\Windows\SysWOW64\w32tm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\SysWOW64\w32tm.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ Jump to behavior

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 2.2.Inquiry No PJO-4010574.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.Inquiry No PJO-4010574.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000007.00000002.4106839112.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.1994362170.0000000001910000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.1992596406.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.4105792819.0000000002C50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.4106877602.0000000003930000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.4109293629.0000000005670000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.1994602722.0000000002E20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.4107064100.0000000003280000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1466207 Sample: Inquiry No PJO-4010574.exe Startdate: 02/07/2024 Architecture: WINDOWS Score: 100 30 www.techsterverse.xyz 2->30 32 www.tedjp-x.com 2->32 34 13 other IPs or domains 2->34 44 Snort IDS alert for network traffic 2->44 46 Malicious sample detected (through community Yara rule) 2->46 48 Antivirus detection for URL or domain 2->48 52 7 other signatures 2->52 10 Inquiry No PJO-4010574.exe 3 2->10         started        signatures3 50 Performs DNS queries to domains with low reputation 30->50 process4 file5 28 C:\Users\...\Inquiry No PJO-4010574.exe.log, ASCII 10->28 dropped 13 Inquiry No PJO-4010574.exe 10->13         started        process6 signatures7 64 Maps a DLL or memory area into another process 13->64 16 HeKTvWjrtOUnkuZfNlEvF.exe 13->16 injected process8 signatures9 42 Found direct / indirect Syscall (likely to bypass EDR) 16->42 19 w32tm.exe 13 16->19         started        process10 signatures11 54 Tries to steal Mail credentials (via file / registry access) 19->54 56 Tries to harvest and steal browser information (history, passwords, etc) 19->56 58 Modifies the context of a thread in another process (thread injection) 19->58 60 3 other signatures 19->60 22 HeKTvWjrtOUnkuZfNlEvF.exe 19->22 injected 26 firefox.exe 19->26         started        process12 dnsIp13 36 jh03-site-25.cdn-ng.net 103.42.144.60, 49777, 49778, 49779 WSN-TW-NET-ASWorldstarNetworkTW Taiwan; Republic of China (ROC) 22->36 38 www.techsterverse.xyz 203.161.49.220, 49757, 49758, 49759 VNPT-AS-VNVNPTCorpVN Malaysia 22->38 40 8 other IPs or domains 22->40 62 Found direct / indirect Syscall (likely to bypass EDR) 22->62 signatures14
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
116.193.69.142
 www.capheconde.com Viet Nam
24085 QTSC-AS-VNQuangTrungSoftwareCityDevelopmentCompanyVN true
188.114.97.3
 www.oc7o0.top European Union
13335 CLOUDFLARENETUS true
212.32.237.101
 www.relationshipfirst.us Netherlands
60781 LEASEWEB-NL-AMS-01NetherlandsNL true
103.224.182.250
 www.globalcred.co Australia
133618 TRELLIAN-AS-APTrellianPtyLimitedAU true
170.130.64.114
 www.pblfishing.com United States
62904 EONIX-COMMUNICATIONS-ASBLOCK-62904US true
217.160.0.85
 www.bloomvice.com Germany
8560 ONEANDONE-ASBrauerstrasse48DE true
103.42.144.60
 jh03-site-25.cdn-ng.net Taiwan; Republic of China (ROC)
131603 WSN-TW-NET-ASWorldstarNetworkTW true
107.149.174.220
 www.balifafa.com United States
54600 PEGTECHINCUS true
203.161.49.220
 www.techsterverse.xyz Malaysia
45899 VNPT-AS-VNVNPTCorpVN true
162.43.101.114
 www.tedjp-x.com United States
11333 CYBERTRAILSUS true

Contacted Domains

Name IP Active
www.tedjp-x.com 162.43.101.114 true
www.pblfishing.com 170.130.64.114 true
www.relationshipfirst.us 212.32.237.101 true
www.techsterverse.xyz 203.161.49.220 true
www.capheconde.com 116.193.69.142 true
jh03-site-25.cdn-ng.net 103.42.144.60 true
www.balifafa.com 107.149.174.220 true
www.globalcred.co 103.224.182.250 true
www.ad14.fun 188.114.96.3 true
www.oc7o0.top 188.114.97.3 true
www.bloomvice.com 217.160.0.85 true
www.pp887300.com unknown unknown
www.newzionocala.com unknown unknown
www.colva.info unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.tedjp-x.com/c0wr/?iHmHOtK=I4+9foIZEqozW1CrO2Wz7/DZoylmFTPmq9Ir5hkT/AZ8BMXZmPqfikD+B7Zsb9R0Gx6spdbB+zho64Hj/e3L4EYjhZFv4l597JlEzTSXx7nmICgHg7bGrac=&L480=nFsp true
  • Avira URL Cloud: safe
 unknown
http://www.oc7o0.top/2zff/?iHmHOtK=4L8xoD0W4Zo4sy88OPxzXkM4Et1OXrliZZOBxyE5jHDJEgkxN8cq+PG6NIXzy1XRCqQIvL5VyJCknvUNNLKk7znic/DfJyEGJbg1Pv28u2ofuxZkWteJjYs=&L480=nFsp true
  • Avira URL Cloud: safe
 unknown
http://www.capheconde.com/9qp1/ true
  • Avira URL Cloud: malware
 unknown
http://www.pblfishing.com/os51/?L480=nFsp&iHmHOtK=c6Au0o4JaGbiIJhi/W9FlVa+W6eKgbIavfE1EfL2H5qYfZI58C4g2l7MAq/uJtf/bSwml0Abw9HN8qCtjnIFaNOIwu03UJk5/xo8eM0g569x/yUzTt9lNQI= true
  • Avira URL Cloud: safe
 unknown
http://www.pp887300.com/lhex/ true
  • Avira URL Cloud: safe
 unknown
http://www.tedjp-x.com/c0wr/ true
  • Avira URL Cloud: safe
 unknown
http://www.capheconde.com/9qp1/?L480=nFsp&iHmHOtK=piAR+Ff1iHDjdou/rhEQcU2b6yhYr5PYXWk6yO0m5khCtjLWm0pVMCsJ6m/O3zZYbcRJdhVWYb2ADKDO+u4ZlLMBcWRMf05zG4E+9fsN2UBlQi8qbNBOF5k= true
  • Avira URL Cloud: malware
 unknown
http://www.bloomvice.com/wryo/?iHmHOtK=LrRmgYPs8LsdxbzfghU7Rrkcqn/uiUbIhXBev7x5iSFC7eFMAdqrv0qIY78m6am6UfdI85MNKFNBcaa15Zv4z5hxclPHNGb5wEZvbrXrYulKcXi85eVkiLQ=&L480=nFsp true
  • Avira URL Cloud: safe
 unknown
http://www.techsterverse.xyz/5ane/?iHmHOtK=WTbBFWOTcFPDCMhESefslTJ6+GkUog7y940HcquptONdD9QmK5HdLPKC5ymHK27F/BdIZvlTb7atmdZ+8u/HwzLeEe0DEJwM8vfrVi/4VNBsPllMeibbLgY=&L480=nFsp true
  • Avira URL Cloud: safe
 unknown
http://www.relationshipfirst.us/zxku/ true
  • Avira URL Cloud: safe
 unknown
http://www.relationshipfirst.us/zxku/?L480=nFsp&iHmHOtK=LzaBpmw0qv0cK+7U3N9wzWvH1rfTwbRorxIVpXGhhpJEoQVn8DIg0i9de8yEo76YxD/IFdbD3aZ704STPEL3y7t+BH8DETSF9Xq3zszk+n+o3arCieFg2Q4= true
  • Avira URL Cloud: safe
 unknown
http://www.globalcred.co/q9jb/?L480=nFsp&iHmHOtK=j0olB4pKJNfBpTyLtiZxxDaYJCDISEWNP33SxFqZDhQbPJdYHiw3UTQ1/R0QXxI3ie6VZCuGDc6mq4FLm2kA6W78v7HmGQDG94BebamJgmWwFfSc9SoNlnA= true
  • Avira URL Cloud: safe
 unknown
http://www.bloomvice.com/wryo/ true
  • Avira URL Cloud: safe
 unknown
http://www.oc7o0.top/2zff/ true
  • Avira URL Cloud: safe
 unknown
http://www.balifafa.com/4ymg/ true
  • Avira URL Cloud: safe
 unknown
http://www.balifafa.com/4ymg/?iHmHOtK=nFZYYf4wbY50wWAChatr++kDEPB15Qhq/x7aQ1H7vt9GgS0wKUnOaHYV5VLziWgziYgeq4JZlKaG5KVexDT+ezFRclyCTcpNeugmvQJUYmTxZwPnAH2U+gM=&L480=nFsp true
  • Avira URL Cloud: safe
 unknown
http://www.techsterverse.xyz/5ane/ true
  • Avira URL Cloud: safe
 unknown
http://www.globalcred.co/q9jb/ true
  • Avira URL Cloud: safe
 unknown
http://www.pp887300.com/lhex/?iHmHOtK=AKDeU1MOdy2C7+0oZjuGTQm02UaFJku+bqnfKxS0A3LFBkNctrgbipmQYZQ6LZYpsVs9A7W3lG5h26zbDb4ShZiTrehhnNvLwO/B2qpeC52tMHhlrRNDNmI=&L480=nFsp true
  • Avira URL Cloud: safe
 unknown