Windows Analysis Report plAI22fb26.exe

Overview

General Information

Sample Name: plAI22fb26.exe
Analysis ID: 480042
MD5: ea30c0dc58f71a1720990021fda92d1e
SHA1: f375401470491a8f56b2ceb26b6a1d3ea84d8bd3
SHA256: a6512b5271bc6e383ec6e3141ebb91b92a8a76a5f1d532ee6e185a253dc20830
Infos:

Most interesting Screenshot:

Detection

Score: 23
Range: 0 - 100
Whitelisted: false
Confidence: 80%

Signatures

May use the Tor software to hide its network traffic
Sample file is different than original file name gathered from version info
PE file contains strange resources
PE file contains sections with non-standard names
PE file contains more sections than normal
JA3 SSL client fingerprint seen in connection with other malware
PE file contains executable resources (Code or Archives)
IP address seen in connection with other malware

Classification

Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49740 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49741 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49742 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49743 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49744 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49745 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49746 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49747 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49748 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49749 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49750 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49751 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49752 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49753 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49755 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49757 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49758 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49761 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49762 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49763 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49764 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49767 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49768 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49769 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49770 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49771 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49772 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49773 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49774 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49775 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49776 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49777 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49778 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49779 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49780 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49781 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49782 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49783 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49785 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49790 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49795 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49800 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49806 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49812 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49820 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49821 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49822 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49823 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49829 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49831 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49832 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49834 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49835 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49836 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49837 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49838 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49839 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49840 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49844 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49845 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49846 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49847 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49848 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49849 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49850 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49852 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49853 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49854 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49855 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49856 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49857 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49858 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49859 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49860 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49861 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49862 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49863 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49864 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49865 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49866 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49867 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49868 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49869 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49870 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49871 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49872 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49873 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49874 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49876 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49877 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49878 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49879 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49880 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49881 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49882 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49883 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49884 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49885 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49886 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49887 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49888 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49889 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49890 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49891 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49892 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49893 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49894 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49895 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49896 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49897 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49898 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49899 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49900 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49901 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49902 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49903 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49904 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49905 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49906 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49908 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49911 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49912 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49913 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49914 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49915 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49916 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49917 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49918 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49919 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49920 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49921 version: TLS 1.2

Networking:

barindex
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: ce5f3254611a8c095a3d821d44539877
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 54.207.65.61 54.207.65.61
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown Network traffic detected: HTTP traffic on port 49888 -> 443
Source: plAI22fb26.exe String found in binary or memory: http://94.228.123.161/dashboard/
Source: plAI22fb26.exe String found in binary or memory: http://94.228.126.231/lending/
Source: plAI22fb26.exe String found in binary or memory: http://abrilprorock2018.webcindario.com/br/config.php
Source: plAI22fb26.exe, 00000001.00000003.230880306.00000000016A0000.00000004.00000001.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: plAI22fb26.exe String found in binary or memory: http://www.indyproject.org/
Source: plAI22fb26.exe, 00000001.00000002.502887182.00000000017F6000.00000004.00000001.sdmp String found in binary or memory: https://pagead2.goog
Source: plAI22fb26.exe, 00000001.00000002.506812898.0000000004122000.00000004.00000001.sdmp, plAI22fb26.exe, 00000001.00000002.504054897.0000000001A08000.00000004.00000001.sdmp, plAI22fb26.exe, 00000001.00000002.502702393.00000000017B0000.00000004.00000001.sdmp String found in binary or memory: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-1714195545121238
Source: plAI22fb26.exe, 00000001.00000002.506627870.0000000003F20000.00000004.00000001.sdmp, plAI22fb26.exe, 00000001.00000002.502887182.00000000017F6000.00000004.00000001.sdmp String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: plAI22fb26.exe, 00000001.00000002.505647409.00000000039A0000.00000004.00000001.sdmp String found in binary or memory: https://www.instagram.com/invertexto/
Source: plAI22fb26.exe, 00000001.00000002.507249698.0000000006576000.00000004.00000001.sdmp String found in binary or memory: https://www.invertexto.com/
Source: plAI22fb26.exe, 00000001.00000002.503301808.0000000001884000.00000004.00000001.sdmp String found in binary or memory: https://www.invertexto.com/aja
Source: plAI22fb26.exe, 00000001.00000002.506627870.0000000003F20000.00000004.00000001.sdmp String found in binary or memory: https://www.invertexto.com/ajax/localizar-ip.php?ip=
Source: plAI22fb26.exe, 00000001.00000002.506443791.0000000003DE0000.00000004.00000001.sdmp String found in binary or memory: https://www.invertexto.com/img/face-note.png
Source: plAI22fb26.exe String found in binary or memory: https://www.invertexto.com/localizar-ip
Source: plAI22fb26.exe, 00000001.00000003.271630805.00000000016A0000.00000004.00000001.sdmp String found in binary or memory: https://www.invertexto.com/localizar-ip#f7
Source: plAI22fb26.exe, 00000001.00000003.295327958.0000000001673000.00000004.00000001.sdmp String found in binary or memory: https://www.invertexto.com/localizar-ip2
Source: plAI22fb26.exe, 00000001.00000003.255440186.00000000016A0000.00000004.00000001.sdmp String found in binary or memory: https://www.invertexto.com/localizar-ipSw
Source: plAI22fb26.exe, 00000001.00000002.502548803.00000000016A0000.00000004.00000020.sdmp String found in binary or memory: https://www.invertexto.com/localizar-ipgfs
Source: plAI22fb26.exe, 00000001.00000003.295327958.0000000001673000.00000004.00000001.sdmp String found in binary or memory: https://www.invertexto.com/localizar-ipo
Source: plAI22fb26.exe, 00000001.00000003.295292309.00000000016A0000.00000004.00000001.sdmp String found in binary or memory: https://www.invertexto.com/localizar-ips
Source: plAI22fb26.exe, 00000001.00000003.255440186.00000000016A0000.00000004.00000001.sdmp String found in binary or memory: https://www.invertexto.com/localizar-ipsgfs
Source: plAI22fb26.exe, 00000001.00000003.271630805.00000000016A0000.00000004.00000001.sdmp String found in binary or memory: https://www.invertexto.com/localizar-ipyfA
Source: plAI22fb26.exe, 00000001.00000003.255440186.00000000016A0000.00000004.00000001.sdmp String found in binary or memory: https://www.invertexto.com:443/localizar-ip
Source: plAI22fb26.exe, 00000001.00000002.502548803.00000000016A0000.00000004.00000020.sdmp String found in binary or memory: https://www.invertexto.com:443/localizar-ipO
Source: plAI22fb26.exe, 00000001.00000003.271630805.00000000016A0000.00000004.00000001.sdmp String found in binary or memory: https://www.invertexto.com:443/localizar-ipm
Source: unknown DNS traffic detected: queries for: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: global traffic HTTP traffic detected: GET /localizar-ip HTTP/1.1Connection: Keep-AliveUser-Agent: Embarcadero URI Client/1.0Host: www.invertexto.com
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49740 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49741 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49742 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49743 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49744 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49745 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49746 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49747 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49748 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49749 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49750 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49751 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49752 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49753 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49755 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49757 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49758 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49761 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49762 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49763 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49764 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49767 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49768 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49769 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49770 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49771 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49772 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49773 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49774 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49775 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49776 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49777 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49778 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49779 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49780 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49781 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49782 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49783 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49785 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49790 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49795 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49800 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49806 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49812 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49820 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49821 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49822 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49823 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49829 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49831 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49832 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49834 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49835 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49836 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49837 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49838 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49839 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49840 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49844 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49845 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49846 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49847 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49848 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49849 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49850 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49852 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49853 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49854 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49855 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49856 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49857 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49858 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49859 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49860 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49861 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49862 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49863 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49864 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49865 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49866 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49867 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49868 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49869 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49870 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49871 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49872 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49873 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49874 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49876 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49877 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49878 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49879 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49880 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49881 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49882 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49883 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49884 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49885 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49886 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49887 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49888 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49889 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49890 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49891 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49892 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49893 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49894 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49895 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49896 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49897 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49898 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49899 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49900 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49901 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49902 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49903 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49904 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49905 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49906 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49908 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49911 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49912 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49913 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49914 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49915 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49916 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49917 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49918 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49919 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49920 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.207.65.61:443 -> 192.168.2.3:49921 version: TLS 1.2

System Summary:

barindex
Sample file is different than original file name gathered from version info
Source: plAI22fb26.exe, 00000001.00000002.504108903.0000000001A34000.00000004.00000001.sdmp Binary or memory string: OriginalFilenamecomctl32.DLL.MUIj% vs plAI22fb26.exe
Source: plAI22fb26.exe, 00000001.00000002.501405224.000000000130E000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameTelegram Desktop> vs plAI22fb26.exe
Source: plAI22fb26.exe Binary or memory string: OriginalFilenameTelegram Desktop> vs plAI22fb26.exe
PE file contains strange resources
Source: plAI22fb26.exe Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: plAI22fb26.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
PE file contains more sections than normal
Source: plAI22fb26.exe Static PE information: Number of sections : 11 > 10
PE file contains executable resources (Code or Archives)
Source: plAI22fb26.exe Static PE information: Resource name: RT_STRING type: PDP-11 separate I&D executable not stripped
Source: plAI22fb26.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\plAI22fb26.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\plAI22fb26.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\plAI22fb26.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: plAI22fb26.exe String found in binary or memory: /Address family not supported by protocol family
Source: plAI22fb26.exe String found in binary or memory: ;application/vnd.adobe.air-application-installer-package+zip
Source: plAI22fb26.exe String found in binary or memory: application/vnd.groove-help
Source: plAI22fb26.exe String found in binary or memory: "application/x-install-instructions
Source: plAI22fb26.exe String found in binary or memory: NATS-SEFI-ADD
Source: plAI22fb26.exe String found in binary or memory: NATS-DANO-ADD
Source: plAI22fb26.exe String found in binary or memory: JIS_C6229-1984-b-add
Source: plAI22fb26.exe String found in binary or memory: jp-ocr-b-add
Source: plAI22fb26.exe String found in binary or memory: JIS_C6229-1984-hand-add
Source: plAI22fb26.exe String found in binary or memory: jp-ocr-hand-add
Source: plAI22fb26.exe String found in binary or memory: ISO_6937-2-add
Source: classification engine Classification label: sus23.evad.winEXE@1/0@131/1
Source: C:\Users\user\Desktop\plAI22fb26.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\plAI22fb26.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: plAI22fb26.exe Static file information: File size 18232832 > 1048576
Source: plAI22fb26.exe Static PE information: Virtual size of .text is bigger than: 0x100000
Source: plAI22fb26.exe Static PE information: Raw size of .text is bigger than: 0x100000 < 0xc46e00
Source: plAI22fb26.exe Static PE information: Raw size of .data is bigger than: 0x100000 < 0x114000
Source: plAI22fb26.exe Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x2b1e00
Source: plAI22fb26.exe Static PE information: More than 200 imports for user32.dll

Data Obfuscation:

barindex
PE file contains sections with non-standard names
Source: plAI22fb26.exe Static PE information: section name: .didata
Source: C:\Users\user\Desktop\plAI22fb26.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run AlphaColor Jump to behavior
Source: C:\Users\user\Desktop\plAI22fb26.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run AlphaColor Jump to behavior

Hooking and other Techniques for Hiding and Protection:

barindex
May use the Tor software to hide its network traffic
Source: plAI22fb26.exe Binary or memory string: torConnect
Source: C:\Users\user\Desktop\plAI22fb26.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\plAI22fb26.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\plAI22fb26.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\plAI22fb26.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\plAI22fb26.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: plAI22fb26.exe, 00000001.00000003.230880306.00000000016A0000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW
Source: plAI22fb26.exe, 00000001.00000002.505276352.0000000001EA0000.00000002.00020000.sdmp Binary or memory string: Program Manager
Source: plAI22fb26.exe, 00000001.00000002.505276352.0000000001EA0000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: plAI22fb26.exe, 00000001.00000002.505276352.0000000001EA0000.00000002.00020000.sdmp Binary or memory string: Progman
Source: plAI22fb26.exe, 00000001.00000002.505276352.0000000001EA0000.00000002.00020000.sdmp Binary or memory string: Progmanlock
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 480042 Sample: plAI22fb26.exe Startdate: 08/09/2021 Architecture: WINDOWS Score: 23 9 www.invertexto.com 2->9 13 May use the Tor software to hide its network traffic 2->13 6 plAI22fb26.exe 1 2->6         started        signatures3 process4 dnsIp5 11 www.invertexto.com 54.207.65.61, 443, 49740, 49741 AMAZON-02US United States 6->11
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
54.207.65.61
 www.invertexto.com United States
16509 AMAZON-02US false

Contacted Domains

Name IP Active
www.invertexto.com 54.207.65.61 true